docs(vuln): Include GitLab 15.0 integration (#2153)

* fix(k8s): summary report when when only vulns exit

Signed-off-by: Jose Donizetti <jdbjunior@gmail.com>

* fix(k8s): return error for not supported report

Signed-off-by: Jose Donizetti <jdbjunior@gmail.com>

* test(k8s): add tests for report Failed()

Signed-off-by: Jose Donizetti <jdbjunior@gmail.com>

* refactor: improve error message

Signed-off-by: Jose Donizetti <jdbjunior@gmail.com>

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Global
+*   @knqyf263
+
+# Helm chart
+helm/trivy/ @krol3
+
+# Kubernetes scanning
+pkg/k8s/                @josedonizetti @chen-keinan
+docs/docs/kubernetes/   @josedonizetti @chen-keinan

.github/ISSUE_TEMPLATE/WRONG_DETECTION.md

@@ -0,0 +1,33 @@
+---
+name: Wrong Detection
+labels: ["kind/bug"]
+about: If Trivy doesn't detect something, or shows false positive detection
+---
+
+## Checklist
+- [ ] I've read [the documentation regarding wrong detection](https://aquasecurity.github.io/trivy/latest/community/contribute/issue/#wrong-detection).
+- [ ] I've confirmed that a security advisory in data sources was correct.
+    - Run Trivy with `-f json` that shows data sources and make sure that the security advisory is correct.
+
+
+## Description
+
+<!--
+Briefly describe the CVE that aren't detected and information about artifacts with this CVE.
+-->
+
+## JSON Output of run with `-debug`:
+
+```
+(paste your output here)
+```
+
+## Output of `trivy -v`:
+
+```
+(paste your output here)
+```
+
+## Additional details (base image name, container registry info...):
+
+

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: monthly
+  - package-ecosystem: gomod
+    open-pull-requests-limit: 10
+    directory: /
+    schedule:
+      interval: monthly

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Description
+
+## Related issues
+- Close #XXX
+
+## Related PRs
+- [ ] #XXX
+- [ ] #YYY
+
+Remove this section if you don't have related PRs.
+
+## Checklist
+- [ ] I've read the [guidelines for contributing](https://aquasecurity.github.io/trivy/latest/community/contribute/pr/) to this repository.
+- [ ] I've followed the [conventions](https://aquasecurity.github.io/trivy/latest/community/contribute/pr/#title) in the PR title.
+- [ ] I've added tests that prove my fix is effective or that my feature works.
+- [ ] I've updated the [documentation](https://github.com/aquasecurity/trivy/blob/main/docs) with the relevant information (if needed).
+- [ ] I've added usage information (if the PR introduces new options)
+- [ ] I've included a "before" and "after" example to the description (if the PR is a user interface change).

.github/workflows/mkdocs-dev.yaml

@@ -12,18 +12,17 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       - name: Checkout main
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
           persist-credentials: true
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v3
         with:
           python-version: 3.x
       - name: Install dependencies
         run: |
           pip install git+https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git
-          pip install mike
-          pip install mkdocs-macros-plugin
+          pip install -r docs/build/requirements.txt
         env:
           GH_TOKEN: ${{ secrets.MKDOCS_AQUA_BOT }}
       - name: Configure the git user

.github/workflows/mkdocs-latest.yaml

@@ -14,18 +14,17 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
       - name: Checkout main
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
           persist-credentials: true
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v3
         with:
           python-version: 3.x
       - name: Install dependencies
         run: |
           pip install git+https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git
-          pip install mike
-          pip install mkdocs-macros-plugin
+          pip install -r docs/build/requirements.txt
         env:
           GH_TOKEN: ${{ secrets.MKDOCS_AQUA_BOT }}
       - name: Configure the git user

.github/workflows/publish-chart.yaml

@@ -1,45 +1,81 @@
-name: Publish Chart Helm
+
+name: Publish Helm chart
+
 on:
-  push:
-    branches: [main]
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
     paths:
       - 'helm/trivy/**'
-  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
 env:
   HELM_REP: helm-charts
   GH_OWNER: aquasecurity
   CHART_DIR: helm/trivy
+  KIND_VERSION: "v0.11.1"
+  KIND_IMAGE: "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
 jobs:
-  release:
+  test-chart:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
         with:
           fetch-depth: 0
       - name: Install Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@18bc76811624f360dbd7f18c2d4ecb32c7b87bab
         with:
           version: v3.5.0
+      - name: Set up python
+        uses: actions/setup-python@v3
+        with:
+          python-version: 3.7
+      - name: Setup Chart Linting
+        id: lint
+        uses: helm/chart-testing-action@dae259e86a35ff09145c0805e2d7dd3f7207064a
+      - name: Setup Kubernetes cluster (KIND)
+        uses: helm/kind-action@94729529f85113b88f4f819c17ce61382e6d8478
+        with:
+          version: ${{ env.KIND_VERSION }}
+          image: ${{ env.KIND_IMAGE }}
+      - name: Run chart-testing
+        run: ct lint-and-install --validate-maintainers=false --charts helm/trivy
+      - name: Run chart-testing (Ingress enabled)
+        run: |
+          sed -i -e '117s,false,'true',g' ./helm/trivy/values.yaml
+          ct lint-and-install --validate-maintainers=false --charts helm/trivy
+
+  publish-chart:
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    needs:
+      - test-chart
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        with:
+          fetch-depth: 0
       - name: Install chart-releaser
         run: |
-          wget https://github.com/helm/chart-releaser/releases/download/v1.1.1/chart-releaser_1.1.1_linux_amd64.tar.gz
-          tar xzvf chart-releaser_1.1.1_linux_amd64.tar.gz cr
+          wget https://github.com/helm/chart-releaser/releases/download/v1.3.0/chart-releaser_1.3.0_linux_amd64.tar.gz
+          echo "baed2315a9bb799efb71d512c5198a2a3b8dcd139d7f22f878777cffcd649a37  chart-releaser_1.3.0_linux_amd64.tar.gz" | sha256sum -c -
+          tar xzvf chart-releaser_1.3.0_linux_amd64.tar.gz cr
       - name: Package helm chart
         run: |
           ./cr package ${{ env.CHART_DIR }}
       - name: Upload helm chart
         # Failed with upload the same version: https://github.com/helm/chart-releaser/issues/101
         continue-on-error: true
-        ## Upload the tar in the Releases repository
         run: |
           ./cr upload -o ${{ env.GH_OWNER }} -r ${{ env.HELM_REP }} --token ${{ secrets.ORG_REPO_TOKEN }} -p .cr-release-packages
       - name: Index helm chart
         run: |
           ./cr index -o ${{ env.GH_OWNER }} -r ${{ env.HELM_REP }} -c https://${{ env.GH_OWNER }}.github.io/${{ env.HELM_REP }}/ -i index.yaml
-
       - name: Push index file
-        uses: dmnemec/copy_file_to_another_repo_action@v1.0.4
+        uses: dmnemec/copy_file_to_another_repo_action@c93037aa10fa8893de271f19978c980d0c1a9b37 #v1.1.1
         env:
           API_TOKEN_GITHUB: ${{ secrets.ORG_REPO_TOKEN }}
         with:

.github/workflows/release.yaml

@@ -4,7 +4,7 @@ on:
     tags:
       - "v*"
 env:
-  GO_VERSION: "1.16"
+  GO_VERSION: "1.18"
   GH_USER: "aqua-bot"
 jobs:
   release:
@@ -12,11 +12,16 @@ jobs:
     runs-on: ubuntu-18.04 # 20.04 doesn't provide createrepo for now
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
+    permissions:
+      id-token: write # For cosign
+      packages: write # For GHCR
+      contents: read  # Not required for public repositories, but for clarity
     steps:
       - name: Install dependencies
         run: |
           sudo apt-get -y update
           sudo apt-get -y install rpm reprepro createrepo distro-info
+      - uses: sigstore/cosign-installer@536b37ec5d5b543420bdfd9b744c5965bd4d8730
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
@@ -25,15 +30,15 @@ jobs:
       - name: Show available Docker Buildx platforms
         run: echo ${{ steps.buildx.outputs.platforms }}
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - name: Cache Go modules
-        uses: actions/cache@v2
+        uses: actions/cache@v3.0.2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -57,20 +62,19 @@ jobs:
           username: ${{ secrets.ECR_ACCESS_KEY_ID }}
           password: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
       - name: Generate SBOM
-        uses: CycloneDX/gh-gomod-generate-sbom@v0.2.0
+        uses: CycloneDX/gh-gomod-generate-sbom@v1
         with:
-          json: true
-          output: bom.json
-          version: latest
+          args: mod -licenses -json -output bom.json
+          version: ^v1
       - name: Release
         uses: goreleaser/goreleaser-action@v2
         with:
-          version: v0.164.0
+          version: v1.4.1
           args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
       - name: Checkout trivy-repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           repository: ${{ github.repository_owner }}/trivy-repo
           path: trivy-repo

.github/workflows/scan.yaml

@@ -1,25 +1,23 @@
-name: Scan
-on: [push, pull_request]
+name: Scan vulnerabilities
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
 jobs:
   build:
     name: Scan Go vulnerabilities
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - name: Run Trivy vulnerability scanner to scan for Critical Vulnerabilities
-        uses: aquasecurity/trivy-action@master
+      - name: Run Trivy vulnerability scanner and create GitHub issues
+        uses: knqyf263/trivy-issue-action@v0.0.4
         with:
-          scan-type: 'fs'
-          exit-code: '1'
-          severity: 'CRITICAL'
-          skip-dirs: integration
-
-      - name: Run Trivy vulnerability scanner to scan for Medium and High Vulnerabilities
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          exit-code: '0'
-          severity: 'HIGH,MEDIUM'
-          skip-dirs: integration
+          assignee: knqyf263
+          severity: CRITICAL
+          skip-dirs: integration,examples
+          label: vulnerability
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/semantic-pr.yaml

@@ -0,0 +1,86 @@
+name: "Lint PR title"
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+jobs:
+  main:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types:
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+            BREAKING
+
+          scopes:
+            vuln
+            misconf
+            secret
+
+            image
+            fs
+            repo
+            sbom
+            server
+            k8s
+
+            alpine
+            redhat
+            alma
+            rocky
+            mariner
+            oracle
+            debian
+            ubuntu
+            amazon
+            suse
+            photon
+            distroless
+
+            ruby
+            php
+            python
+            nodejs
+            rust
+            dotnet
+            java
+            go
+            
+            os
+            lang
+
+            kubernetes
+            dockerfile
+            terraform
+            cloudformation
+
+            docker
+            podman
+            containerd
+            oci
+
+            cli
+            flag
+
+            helm
+            report
+            db
+            deps

.github/workflows/stale-issues.yaml

@@ -7,7 +7,7 @@ jobs:
     timeout-minutes: 1
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v3
+    - uses: actions/stale@v5
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue is stale because it has been labeled with inactivity.'

.github/workflows/test.yaml

@@ -10,23 +10,23 @@ on:
       - 'LICENSE'
   pull_request:
 env:
-  GO_VERSION: "1.16"
+  GO_VERSION: "1.18"
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Lint
-        uses: golangci/golangci-lint-action@v2
+        uses: golangci/golangci-lint-action@v3.1.0
         with:
-          version: v1.41
+          version: v1.45
           args: --deadline=30m
 
       - name: Run unit tests
@@ -37,13 +37,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v3
       with:
         go-version: ${{ env.GO_VERSION }}
       id: go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Run integration tests
       run: make test-integration
@@ -65,17 +65,17 @@ jobs:
       run: echo ${{ steps.buildx.outputs.platforms }}
 
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: Set up Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v3
       with:
         go-version: ${{ env.GO_VERSION }}
 
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v2
       with:
-        version: v0.164.0
+        version: v1.4.1
         args: release --snapshot --rm-dist --skip-publish
 
   build-documents:
@@ -83,18 +83,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         fetch-depth: 0
         persist-credentials: true
-    - uses: actions/setup-python@v2
+    - uses: actions/setup-python@v3
       with:
         python-version: 3.x
     - name: Install dependencies
       run: |
-        pip install mkdocs-material
-        pip install mike
-        pip install mkdocs-macros-plugin
+        pip install -r docs/build/requirements.txt
     - name: Configure the git user
       run: |
         git config user.name "knqyf263"

.gitignore

@@ -4,7 +4,7 @@
 *.dll
 *.so
 *.dylib
-trivy
+/trivy
 
 ## chart release
 .cr-release-packages
@@ -27,3 +27,6 @@ integration/testdata/fixtures/images
 
 # SBOMs generated during CI
 /bom.json
+
+# goreleaser output
+dist

.golangci.yaml

@@ -9,7 +9,7 @@ linters-settings:
   revive:
     ignore-generated-header: true
   gocyclo:
-    min-complexity: 10
+    min-complexity: 20
   dupl:
     threshold: 100
   goconst:
@@ -19,6 +19,10 @@ linters-settings:
     locale: US
   goimports:
     local-prefixes: github.com/aquasecurity
+  gosec:
+    excludes:
+      - G204
+      - G402
 
 linters:
   disable-all: true
@@ -40,6 +44,7 @@ linters:
     - misspell
 
 run:
+  go: 1.18
   skip-files:
     - ".*._mock.go$"
     - ".*._test.go$"
@@ -53,9 +58,6 @@ issues:
     - linters:
         - gosec
       text: "Deferring unsafe method"
-    - linters:
-        - gosec
-      text: "G204: Subprocess launched with variable"
     - linters:
         - errcheck
       text: "Close` is not checked"

CONTRIBUTING.md

@@ -1,28 +1 @@
-Thank you for taking interest in contributing to Trivy !
-
-## Issues
-- Feel free to open issues for any reason. When you open a new issue, you'll have to select an issue kind: bug/feature/support and fill the required information based on the selected template.
-- Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate. If it is, please add your comment to the existing issue.
-- Remember users might be searching for your issue in the future, so please give it a meaningful title to help others.
-- The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information.
-
-## Pull Requests
-
-1. Every Pull Request should have an associated bug or feature issue unless you are fixing a trivial documentation issue.
-1. Your PR is more likely to be accepted if it focuses on just one change.
-1. Describe what the PR does. There's no convention enforced, but please try to be concise and descriptive. Treat the PR description as a commit message. Titles that starts with "fix"/"add"/"improve"/"remove" are good examples.
-1. Please add the associated Issue in the PR description.
-1. There's no need to add or tag reviewers.
-1. If a reviewer commented on your code or asked for changes, please remember to mark the discussion as resolved after you address it. PRs with unresolved issues should not be merged (even if the comment is unclear or requires no action from your side).
-1. Please include a comment with the results before and after your change.
-1. Your PR is more likely to be accepted if it includes tests (We have not historically been very strict about tests, but we would like to improve this!).
-1. If your PR affects the user experience in some way, please update the Readme and the CLI help accordingly.
-
-## Understand where your pull request belongs
-
-Trivy is composed of several different repositories that work together:
-
-- [Trivy](https://github.com/aquasecurity/trivy) is the client-side, user-facing, command line tool.
-- [vuln-list](https://github.com/aquasecurity/vuln-list) is a vulnerabilities database, aggregated from different sources, and normalized for easy consumption. This of this as the "server" side of the trivy command line tool. **There should be no pull requests to this repo** 
-- [vuln-list-update](https://github.com/aquasecurity/vuln-list-update) is the code that maintains the vuln-list database.
-- [fanal](https://github.com/aquasecurity/fanal) is a library for extracting system information containers. It is being used by Trivy to find testable subjects in the container image.
+See [Issues](https://aquasecurity.github.io/trivy/latest/community/contribute/issue/) and [Pull Requests](https://aquasecurity.github.io/trivy/latest/community/contribute/pr/)

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.13
+FROM alpine:3.15.4
 RUN apk --no-cache add ca-certificates git
 COPY trivy /usr/local/bin/trivy
 COPY contrib/*.tpl contrib/

Dockerfile.protoc

@@ -0,0 +1,12 @@
+FROM golang:1.18.1
+
+# Install protoc (cf. http://google.github.io/proto-lens/installing-protoc.html)
+ENV PROTOC_ZIP=protoc-3.19.4-linux-x86_64.zip
+RUN apt-get update && apt-get install -y unzip
+RUN curl --retry 5 -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.19.4/$PROTOC_ZIP \
+    && unzip -o $PROTOC_ZIP -d /usr/local bin/protoc \
+    && unzip -o $PROTOC_ZIP -d /usr/local 'include/*' \ 
+    && rm -f $PROTOC_ZIP
+
+RUN go install github.com/twitchtv/twirp/protoc-gen-twirp@v8.1.0
+RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.27.1

Makefile

@@ -27,7 +27,7 @@ deps:
 	go mod tidy
 
 $(GOBIN)/golangci-lint:
-	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(GOBIN) v1.41.1
+	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(GOBIN) v1.45.2
 
 .PHONY: test
 test:
@@ -54,7 +54,13 @@ build:
 
 .PHONY: protoc
 protoc:
-	find ./rpc/ -name "*.proto" -type f -exec protoc --proto_path=$(GOSRC):. --twirp_out=. --twirp_opt=paths=source_relative --go_out=. --go_opt=paths=source_relative {} \;
+	docker build -t trivy-protoc - < Dockerfile.protoc
+	docker run --rm -it -v ${PWD}:/app -w /app trivy-protoc make _$@
+
+_protoc:
+	for path in `find ./rpc/ -name "*.proto" -type f`; do \
+		protoc --twirp_out=. --twirp_opt=paths=source_relative --go_out=. --go_opt=paths=source_relative $${path} || exit; \
+	done
 
 .PHONY: install
 install:

README.md

@@ -22,24 +22,31 @@ Scanner for vulnerabilities in container images, file systems, and Git repositor
 `Trivy` (`tri` pronounced like **tri**gger, `vy` pronounced like en**vy**) is a simple and comprehensive scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues.
 `Trivy` detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and language-specific packages (Bundler, Composer, npm, yarn, etc.).
 In addition, `Trivy` scans Infrastructure as Code (IaC) files such as Terraform, Dockerfile and Kubernetes, to detect potential configuration issues that expose your deployments to the risk of attack.
+`Trivy` also scans hardcoded secrets like passwords, API keys and tokens.
 `Trivy` is easy to use. Just install the binary and you're ready to scan.
 
-<p align="center">
+<figure style="text-aligh: center">
   <img src="docs/imgs/overview.png" width="800" alt="Trivy Overview">
-</p>
+</figure>
 
 ### Demo: Vulnerability Detection (Container Image)
-<p align="center">
+<figure style="text-aligh: center">
   <img src="docs/imgs/vuln-demo.gif" width="1000" alt="Vulnerability Detection">
-</p>
+</figure>
 
 ### Demo: Misconfiguration Detection (IaC Files)
-<p align="center">
+<figure style="text-aligh: center">
   <img src="docs/imgs/misconf-demo.gif" width="1000" alt="Misconfiguration Detection">
-</p>
+</figure>
+
+### Demo: Secret Detection
+<figure style="text-aligh: center">
+  <img src="docs/imgs/secret-demo.gif" width="1000">
+</figure>
+
 
 # Quick Start
-## Scan Image for Vulnerabilities
+## Scan Image for Vulnerabilities and Secrets
 Simply specify an image name (and a tag).
 
 ```
@@ -72,17 +79,17 @@ Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
 ```
 </details>
 
-## Scan Filesystem for Vulnerabilities and Misconfigurations
+## Scan Filesystem for Vulnerabilities, Secrets and Misconfigurations
 Simply specify a directory to scan.
 
 ```bash
-$ trivy fs --security-checks vuln,config [YOUR_PROJECT_DIR]
+$ trivy fs --security-checks vuln,secret,config [YOUR_PROJECT_DIR]
 ```
 
 For example:
 
 ```bash
-$ trivy fs --security-checks vuln,config myproject/
+$ trivy fs --security-checks vuln,secret,config myproject/
 ```
 
 <details>
@@ -165,12 +172,16 @@ Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
 # Features
 
 - Comprehensive vulnerability detection
-  - OS packages (Alpine Linux, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless)
+  - OS packages (Alpine Linux, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, AlmaLinux, Rocky Linux, CBL-Mariner, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless)
   - **Language-specific packages** (Bundler, Composer, Pipenv, Poetry, npm, yarn, Cargo, NuGet, Maven, and Go)
 - Misconfiguration detection (IaC scanning) 
   - A wide variety of built-in policies are provided **out of the box**
     - Kubernetes, Docker, Terraform, and more coming soon
   - Support custom policies
+- Secret detection
+  - A wide variety of built-in rules are provided **out of the box**
+  - Support custom rules
+  - Scan container images at high speed
 - Simple
   - Specify only an image name, a path to config files, or an artifact name
 - Fast
@@ -185,6 +196,9 @@ Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
   - **Suitable for CI** such as GitHub Actions, Jenkins, GitLab CI, etc.
 - Support multiple targets
   - container image, local filesystem and remote git repository
+- Supply chain security (SBOM support)
+  - Support CycloneDX
+  - Support SPDX
 
 # Integrations
 - [GitHub Actions][action]
@@ -193,6 +207,12 @@ Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
 # Documentation
 The official documentation, which provides detailed installation, configuration, and quick start guides, is available at https://aquasecurity.github.io/trivy/.
 
+---
+
+Trivy is an [Aqua Security][aquasec] open source project.  
+Learn about our open source work and portfolio [here][oss].  
+Contact us about any matter by opening a GitHub Discussion [here][discussions]
+
 [test]: https://github.com/aquasecurity/trivy/actions/workflows/test.yaml
 [test-img]: https://github.com/aquasecurity/trivy/actions/workflows/test.yaml/badge.svg
 [go-report]: https://goreportcard.com/report/github.com/aquasecurity/trivy
@@ -207,3 +227,7 @@ The official documentation, which provides detailed installation, configuration,
 [alpine]: https://ariadne.space/2021/06/08/the-vulnerability-remediation-lifecycle-of-alpine-containers/
 [action]: https://github.com/aquasecurity/trivy-action
 [vscode]: https://github.com/aquasecurity/trivy-vscode-extension
+
+[aquasec]: https://aquasec.com
+[oss]: https://www.aquasec.com/products/open-source-projects/
+[discussions]: https://github.com/aquasecurity/trivy/discussions

ci/deploy-deb.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 DEBIAN_RELEASES=$(debian-distro-info --supported)
-UBUNTU_RELEASES=$(ubuntu-distro-info --supported)
+UBUNTU_RELEASES=$(sort -u <(ubuntu-distro-info --supported-esm) <(ubuntu-distro-info --supported))
 
 cd trivy-repo/deb
 
@@ -9,12 +9,14 @@ for release in ${DEBIAN_RELEASES[@]} ${UBUNTU_RELEASES[@]}; do
   echo "Removing deb package of $release"
   reprepro -A i386 remove $release trivy
   reprepro -A amd64 remove $release trivy
+  reprepro -A arm64 remove $release trivy
 done
 
 for release in ${DEBIAN_RELEASES[@]} ${UBUNTU_RELEASES[@]}; do
   echo "Adding deb package to $release"
   reprepro includedeb $release ../../dist/*Linux-64bit.deb
   reprepro includedeb $release ../../dist/*Linux-32bit.deb
+  reprepro includedeb $release ../../dist/*Linux-ARM64.deb
 done
 
 git add .

contrib/Trivy.gitlab-ci.yml

@@ -10,7 +10,7 @@ Trivy_container_scanning:
     IMAGE: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"
   allow_failure: true
   before_script:
-    - export TRIVY_VERSION=${TRIVY_VERSION:-v0.4.3}
+    - export TRIVY_VERSION=${TRIVY_VERSION:-v0.19.2}
     - apk add --no-cache curl docker-cli
     - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
     - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${TRIVY_VERSION}

contrib/asff.tpl

@@ -1,66 +1,72 @@
-[
-{{- $t_first := true -}}
-{{- range . -}}
-{{- $target := .Target -}}
-{{- range .Vulnerabilities -}}
-{{- if $t_first -}}
-  {{- $t_first = false -}}
-{{- else -}}
-  ,
-{{- end -}}
-{{- $severity := .Severity -}}
-{{- if eq $severity "UNKNOWN" -}}
-{{- $severity = "INFORMATIONAL" -}}
-{{- end -}}
-{{- $description := .Description -}}
-{{- if gt (len $description ) 1021 -}}
-    {{- $description = (substr 0 1021 $description) | printf "%v .." -}}
-{{- end}}
-    {
-        "SchemaVersion": "2018-10-08",
-        "Id": "{{ $target }}/{{ .VulnerabilityID }}",
-        "ProductArn": "arn:aws:securityhub:{{ getEnv "AWS_REGION" }}::product/aquasecurity/aquasecurity",
-        "GeneratorId": "Trivy",
-        "AwsAccountId": "{{ getEnv "AWS_ACCOUNT_ID" }}",
-        "Types": [ "Software and Configuration Checks/Vulnerabilities/CVE" ],
-        "CreatedAt": "{{ getCurrentTime }}",
-        "UpdatedAt": "{{ getCurrentTime }}",
-        "Severity": {
-            "Label": "{{ $severity }}"
-        },
-        "Title": "Trivy found a vulnerability to {{ .VulnerabilityID }} in container {{ $target }}",
-        "Description": {{ escapeString $description | printf "%q" }},
-        "Remediation": {
-            "Recommendation": {
-                "Text": "More information on this vulnerability is provided in the hyperlink",
-                "Url": "{{ .PrimaryURL }}"
-            }
-        },
-        "ProductFields": { "Product Name": "Trivy" },
-        "Resources": [
-            {
-                "Type": "Container",
-                "Id": "{{ $target }}",
-                "Partition": "aws",
-                "Region": "{{ getEnv "AWS_REGION" }}",
-                "Details": {
-                    "Container": { "ImageName": "{{ $target }}" },
-                    "Other": {
-                        "CVE ID": "{{ .VulnerabilityID }}",
-                        "CVE Title": {{ .Title | printf "%q" }},
-                        "PkgName": "{{ .PkgName }}",
-                        "Installed Package": "{{ .InstalledVersion }}",
-                        "Patched Package": "{{ .FixedVersion }}",
-                        "NvdCvssScoreV3": "{{ (index .CVSS "nvd").V3Score }}",
-                        "NvdCvssVectorV3": "{{ (index .CVSS "nvd").V3Vector }}",
-                        "NvdCvssScoreV2": "{{ (index .CVSS "nvd").V2Score }}",
-                        "NvdCvssVectorV2": "{{ (index .CVSS "nvd").V2Vector }}"
+{
+    "Findings": [
+    {{- $t_first := true -}}
+    {{- range . -}}
+    {{- $target := .Target -}}
+    {{- $image := .Target -}}
+    {{- if gt (len $image) 127 -}}
+        {{- $image = $image | regexFind ".{124}$" | printf "...%v" -}}
+    {{- end}}
+    {{- range .Vulnerabilities -}}
+    {{- if $t_first -}}
+      {{- $t_first = false -}}
+    {{- else -}}
+      ,
+    {{- end -}}
+    {{- $severity := .Severity -}}
+    {{- if eq $severity "UNKNOWN" -}}
+    {{- $severity = "INFORMATIONAL" -}}
+    {{- end -}}
+    {{- $description := .Description -}}
+    {{- if gt (len $description ) 512 -}}
+        {{- $description = (substr 0 512 $description) | printf "%v .." -}}
+    {{- end}}
+        {
+            "SchemaVersion": "2018-10-08",
+            "Id": "{{ $target }}/{{ .VulnerabilityID }}",
+            "ProductArn": "arn:aws:securityhub:{{ env "AWS_REGION" }}::product/aquasecurity/aquasecurity",
+            "GeneratorId": "Trivy/{{ .VulnerabilityID }}",
+            "AwsAccountId": "{{ env "AWS_ACCOUNT_ID" }}",
+            "Types": [ "Software and Configuration Checks/Vulnerabilities/CVE" ],
+            "CreatedAt": "{{ now | date "2006-01-02T15:04:05.999999999Z07:00" }}",
+            "UpdatedAt": "{{ now | date "2006-01-02T15:04:05.999999999Z07:00" }}",
+            "Severity": {
+                "Label": "{{ $severity }}"
+            },
+            "Title": "Trivy found a vulnerability to {{ .VulnerabilityID }} in container {{ $target }}",
+            "Description": {{ escapeString $description | printf "%q" }},
+            "Remediation": {
+                "Recommendation": {
+                    "Text": "More information on this vulnerability is provided in the hyperlink",
+                    "Url": "{{ .PrimaryURL }}"
+                }
+            },
+            "ProductFields": { "Product Name": "Trivy" },
+            "Resources": [
+                {
+                    "Type": "Container",
+                    "Id": "{{ $target }}",
+                    "Partition": "aws",
+                    "Region": "{{ env "AWS_REGION" }}",
+                    "Details": {
+                        "Container": { "ImageName": "{{ $image }}" },
+                        "Other": {
+                            "CVE ID": "{{ .VulnerabilityID }}",
+                            "CVE Title": {{ .Title | printf "%q" }},
+                            "PkgName": "{{ .PkgName }}",
+                            "Installed Package": "{{ .InstalledVersion }}",
+                            "Patched Package": "{{ .FixedVersion }}",
+                            "NvdCvssScoreV3": "{{ (index .CVSS (sourceID "nvd")).V3Score }}",
+                            "NvdCvssVectorV3": "{{ (index .CVSS (sourceID "nvd")).V3Vector }}",
+                            "NvdCvssScoreV2": "{{ (index .CVSS (sourceID "nvd")).V2Score }}",
+                            "NvdCvssVectorV2": "{{ (index .CVSS (sourceID "nvd")).V2Vector }}"
+                        }
                     }
                 }
-            }
-        ],
-        "RecordState": "ACTIVE"
-    }
-   {{- end -}}
-  {{- end }}
-]
+            ],
+            "RecordState": "ACTIVE"
+        }
+       {{- end -}}
+      {{- end }}
+    ]
+}

contrib/example_policy/advanced.rego

@@ -5,30 +5,42 @@ import data.lib.trivy
 default ignore = false
 
 nvd_v3_vector = v {
-	v := input.CVSS.nvd.v3
+	v := input.CVSS.nvd.V3Vector
+}
+
+redhat_v3_vector = v {
+	v := input.CVSS.redhat.V3Vector
 }
 
 # Ignore a vulnerability which requires high privilege
 ignore {
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
-	cvss_vector.PrivilegesRequired == "High"
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector.PrivilegesRequired == "High"
+
+        # Check against RedHat scores as well as NVD
+	redhat_cvss_vector := trivy.parse_cvss_vector_v3(redhat_v3_vector)
+	redhat_cvss_vector.PrivilegesRequired == "High"
 }
 
 # Ignore a vulnerability which requires user interaction
 ignore {
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
-	cvss_vector.UserInteraction == "Required"
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector.UserInteraction == "Required"
+
+        # Check against RedHat scores as well as NVD
+	redhat_cvss_vector := trivy.parse_cvss_vector_v3(redhat_v3_vector)
+	redhat_cvss_vector.UserInteraction == "Required"
 }
 
 ignore {
 	input.PkgName == "openssl"
 
 	# Split CVSSv3 vector
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
 
 	# Evaluate Attack Vector
 	ignore_attack_vectors := {"Physical", "Local"}
-	cvss_vector.AttackVector == ignore_attack_vectors[_]
+	nvd_cvss_vector.AttackVector == ignore_attack_vectors[_]
 }
 
 ignore {
@@ -50,11 +62,11 @@ ignore {
 	input.PkgName == "bash"
 
 	# Split CVSSv3 vector
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
 
 	# Evaluate Attack Vector
 	ignore_attack_vectors := {"Physical", "Local", "Adjacent"}
-	cvss_vector.AttackVector == ignore_attack_vectors[_]
+	nvd_cvss_vector.AttackVector == ignore_attack_vectors[_]
 
 	# Evaluate severity
 	input.Severity == {"LOW", "MEDIUM", "HIGH"}[_]
@@ -64,11 +76,11 @@ ignore {
 	input.PkgName == "django"
 
 	# Split CVSSv3 vector
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
 
 	# Evaluate Attack Vector
 	ignore_attack_vectors := {"Physical", "Local"}
-	cvss_vector.AttackVector == ignore_attack_vectors[_]
+	nvd_cvss_vector.AttackVector == ignore_attack_vectors[_]
 
 	# Evaluate severity
 	input.Severity == {"LOW", "MEDIUM"}[_]
@@ -86,7 +98,7 @@ ignore {
 	input.PkgName == "jquery"
 
 	# Split CVSSv3 vector
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
 
 	# Evaluate CWE-ID
 	deny_cwe_ids := {"CWE-79"} # XSS

contrib/example_policy/basic.rego

@@ -9,7 +9,11 @@ ignore_pkgs := {"bash", "bind-license", "rpm", "vim", "vim-minimal"}
 ignore_severities := {"LOW", "MEDIUM"}
 
 nvd_v3_vector = v {
-	v := input.CVSS.nvd.v3
+	v := input.CVSS.nvd.V3Vector
+}
+
+redhat_v3_vector = v {
+	v := input.CVSS.redhat.V3Vector
 }
 
 ignore {
@@ -22,20 +26,29 @@ ignore {
 
 # Ignore a vulnerability which is not remotely exploitable
 ignore {
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
-	cvss_vector.AttackVector != "Network"
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector.AttackVector != "Network"
+
+	redhat_cvss_vector := trivy.parse_cvss_vector_v3(redhat_v3_vector)
+	redhat_cvss_vector.AttackVector != "Network"
 }
 
 # Ignore a vulnerability which requires high privilege
 ignore {
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
-	cvss_vector.PrivilegesRequired == "High"
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector.PrivilegesRequired == "High"
+
+	redhat_cvss_vector := trivy.parse_cvss_vector_v3(redhat_v3_vector)
+	redhat_cvss_vector.PrivilegesRequired == "High"
 }
 
 # Ignore a vulnerability which requires user interaction
 ignore {
-	cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
-	cvss_vector.UserInteraction == "Required"
+	nvd_cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector)
+	nvd_cvss_vector.UserInteraction == "Required"
+
+	redhat_cvss_vector := trivy.parse_cvss_vector_v3(redhat_v3_vector)
+	redhat_cvss_vector.UserInteraction == "Required"
 }
 
 # Ignore CSRF

contrib/gitlab-codequality.tpl

@@ -13,7 +13,8 @@
       "type": "issue",
       "check_name": "container_scanning",
       "categories": [ "Security" ],
-      "description": "{{ .VulnerabilityID }}: {{ .Title }}",
+      "description": {{ list .VulnerabilityID .PkgName .InstalledVersion .Title | join " - " | printf "%q" }},
+      "fingerprint": "{{ list .VulnerabilityID .PkgName .InstalledVersion $target | join "" | sha1sum }}",
       "content": {{ .Description | printf "%q" }},
       "severity": {{ if eq .Severity "LOW" -}}
                     "info"
@@ -27,12 +28,44 @@
                     "info"
                   {{- end }},
       "location": {
-        "path": "{{ .PkgName }}-{{ .InstalledVersion }}",
+        "path": "{{ $target }}",
         "lines": {
-          "begin": 1
+          "begin": 0
+        }
+      }
+    }
+    {{- end -}}
+    {{- range .Misconfigurations -}}
+    {{- if $t_first -}}
+      {{- $t_first = false -}}
+    {{ else -}}
+      ,
+    {{- end }}
+    {
+      "type": "issue",
+      "check_name": "container_scanning",
+      "categories": [ "Security" ],
+      "description": {{ list .ID .Title | join ": " | printf "%q" }},
+      "fingerprint": "{{ list .ID .Title $target | join "" | sha1sum }}",
+      "content": {{ .Description | printf "%q" }},
+      "severity": {{ if eq .Severity "LOW" -}}
+                    "info"
+                  {{- else if eq .Severity "MEDIUM" -}}
+                    "minor"
+                  {{- else if eq .Severity "HIGH" -}}
+                    "major"
+                  {{- else if eq .Severity "CRITICAL" -}}
+                    "critical"
+                  {{-  else -}}
+                    "info"
+                  {{- end }},
+      "location": {
+        "path": "{{ $target }}",
+        "lines": {
+          "begin": {{ .IacMetadata.StartLine }}
         }
       }
     }
     {{- end -}}
   {{- end }}
-]
+]

contrib/html.tpl

@@ -52,7 +52,7 @@
       }
       a.toggle-more-links { cursor: pointer; }
     </style>
-    <title>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ getCurrentTime }}</title>
+    <title>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }} </title>
     <script>
       window.onload = function() {
         document.querySelectorAll('td.links').forEach(function(linkCell) {
@@ -82,7 +82,7 @@
     </script>
   </head>
   <body>
-    <h1>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ getCurrentTime }}</h1>
+    <h1>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }}</h1>
     <table>
     {{- range . }}
       <tr class="group-header"><th colspan="6">{{ escapeXML .Type }}</th></tr>
@@ -112,6 +112,31 @@
       </tr>
         {{- end }}
       {{- end }}
+      {{- if (eq (len .Misconfigurations ) 0) }}
+      <tr><th colspan="6">No Misconfigurations found</th></tr>
+      {{- else }}
+      <tr class="sub-header">
+        <th>Type</th>
+        <th>Misconf ID</th>
+        <th>Check</th>
+        <th>Severity</th>
+        <th>Message</th>
+      </tr>
+        {{- range .Misconfigurations }}
+      <tr class="severity-{{ escapeXML .Severity }}">
+        <td class="misconf-type">{{ escapeXML .Type }}</td>
+        <td>{{ escapeXML .ID }}</td>
+        <td class="misconf-check">{{ escapeXML .Title }}</td>
+        <td class="severity">{{ escapeXML .Severity }}</td>
+        <td class="link" data-more-links="off"  style="white-space:normal;"">
+          {{ escapeXML .Message }}
+          <br>
+            <a href={{ escapeXML .PrimaryURL | printf "%q" }}>{{ escapeXML .PrimaryURL }}</a>
+          </br>
+        </td>
+      </tr>
+        {{- end }}
+      {{- end }}
     {{- end }}
     </table>
 {{- else }}

contrib/install.sh

@@ -182,11 +182,11 @@ log_tag() {
 }
 log_debug() {
   log_priority 7 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+  echo "$(log_prefix)" "$(log_tag 7)" "$@"
 }
 log_info() {
   log_priority 6 || return 0
-  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+  echo "$(log_prefix)" "$(log_tag 6)" "$@"
 }
 log_err() {
   log_priority 3 || return 0

contrib/junit.tpl

@@ -14,5 +14,18 @@
         </testcase>
     {{- end }}
     </testsuite>
+{{- $failures := len .Misconfigurations }}
+    <testsuite tests="{{ $failures }}" failures="{{ $failures }}" name="{{  .Target }}" errors="0" skipped="0" time="">
+    {{- if not (eq .Type "") }}
+        <properties>
+            <property name="type" value="{{ .Type }}"></property>
+        </properties>
+        {{- end -}}
+        {{ range .Misconfigurations }}
+        <testcase classname="{{ .Type }}" name="[{{ .Severity }}] {{ .ID }}" time="">
+            <failure message="{{ escapeXML .Title }}" type="description">{{ escapeXML .Description }}</failure>
+        </testcase>
+    {{- end }}
+    </testsuite>
 {{- end }}
 </testsuites>

contrib/sarif.tpl

@@ -1,95 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
-  "version": "2.1.0",
-  "runs": [
-    {
-      "tool": {
-        "driver": {
-          "name": "Trivy",
-          "informationUri": "https://github.com/aquasecurity/trivy",
-          "fullName": "Trivy Vulnerability Scanner",
-          "version": "0.15.0",
-          "rules": [
-        {{- $t_first := true }}
-        {{- range $result := . }}
-            {{- $vulnerabilityType := .Type }}
-            {{- range .Vulnerabilities -}}
-              {{- if $t_first -}}
-                {{- $t_first = false -}}
-              {{ else -}}
-                ,
-              {{- end }}
-            {
-              "id": {{ printf "%s: %s-%s %s" $result.Target .PkgName .InstalledVersion .VulnerabilityID | toJson }},
-              "name": "{{ toSarifRuleName $vulnerabilityType }}",
-              "shortDescription": {
-                "text": {{ printf "%v Package: %v" .VulnerabilityID .PkgName | printf "%q" }}
-              },
-              "fullDescription": {
-                "text": {{ endWithPeriod (escapeString .Title) | printf "%q" }}
-              },
-              "defaultConfiguration": {
-                "level": "{{ toSarifErrorLevel .Vulnerability.Severity }}"
-              }
-              {{- with $help_uri := .PrimaryURL -}}
-              ,
-              {{ $help_uri | printf "\"helpUri\": %q," -}}
-              {{- else -}}
-              ,
-              {{- end }}
-              "help": {
-                "text": {{ printf "Vulnerability %v\nSeverity: %v\nPackage: %v\nInstalled Version: %v\nFixed Version: %v\nLink: [%v](%v)" .VulnerabilityID .Vulnerability.Severity .PkgName .InstalledVersion .FixedVersion .VulnerabilityID .PrimaryURL | printf "%q"}},
-                "markdown": {{ printf "**Vulnerability %v**\n| Severity | Package | Installed Version | Fixed Version | Link |\n| --- | --- | --- | --- | --- |\n|%v|%v|%v|%v|[%v](%v)|\n" .VulnerabilityID .Vulnerability.Severity .PkgName .InstalledVersion .FixedVersion .VulnerabilityID .PrimaryURL | printf "%q"}}
-              },
-              "properties": {
-                "tags": [
-                  "vulnerability",
-                  "{{ .Vulnerability.Severity }}",
-                  {{ .PkgName | printf "%q" }}
-                ],
-                "precision": "very-high"
-              }
-            }
-            {{- end -}}
-         {{- end -}}
-          ]
-        }
-      },
-      "results": [
-    {{- $t_first := true }}
-    {{- range $result := . }}
-        {{- $filePath := .Target }}
-        {{- range $index, $vulnerability := .Vulnerabilities -}}
-          {{- if $t_first -}}
-            {{- $t_first = false -}}
-          {{ else -}}
-            ,
-          {{- end }}
-        {
-          "ruleId": {{ printf "%s: %s-%s %s" $result.Target .PkgName .InstalledVersion .VulnerabilityID | toJson }},
-          "ruleIndex": {{ $index }},
-          "level": "{{ toSarifErrorLevel $vulnerability.Vulnerability.Severity }}",
-          "message": {
-            "text": {{ endWithPeriod (escapeString $vulnerability.Description) | printf "%q" }}
-          },
-          "locations": [{
-            "physicalLocation": {
-              "artifactLocation": {
-                "uri": "{{ toPathUri $filePath }}",
-                "uriBaseId": "ROOTPATH"
-              }
-            }
-          }]
-        }
-        {{- end -}}
-      {{- end -}}
-      ],
-      "columnKind": "utf16CodeUnits",
-      "originalUriBaseIds": {
-        "ROOTPATH": {
-          "uri": "/"
-        }
-      }
-    }
-  ]
-}

docs/advanced/air-gap.md

@@ -1,57 +0,0 @@
-# Air-Gapped Environment
-
-Trivy can be used in air-gapped environments.
-
-## Download the vulnerability database
-At first, you need to download the vulnerability database for use in air-gapped environments.
-Go to [trivy-db][trivy-db] and download `trivy-offline.db.tgz` in the latest release.
-If you download `trivy-light-offline.db.tgz`, you have to run Trivy with `--light` option.
-
-```
-$ wget https://github.com/aquasecurity/trivy-db/releases/latest/download/trivy-offline.db.tgz
-```
-
-## Transfer the DB file into the air-gapped environment
-The way of transfer depends on the environment.
-
-```
-$ rsync -av -e ssh /path/to/trivy-offline.db.tgz [user]@[host]:dst
-```
-
-## Put the DB file in Trivy's cache directory
-You have to know where to put the DB file. The following command shows the default cache directory.
-
-```
-$ ssh user@host
-$ trivy -h | grep cache
-   --cache-dir value  cache directory (default: "/home/myuser/.cache/trivy") [$TRIVY_CACHE_DIR]
-```
-
-Put the DB file in the cache directory + `/db`.
-
-```
-$ mkdir -p /home/myuser/.cache/trivy/db
-$ cd /home/myuser/.cache/trivy/db
-$ mv /path/to/trivy-offline.db.tgz .
-```
-
-Then, decompress it.
-`trivy-offline.db.tgz` file includes two files, `trivy.db` and `metadata.json`.
-
-```
-$ tar xvf trivy-offline.db.tgz
-x trivy.db
-x metadata.json
-$ rm trivy-offline.db.tgz
-```
-
-In an air-gapped environment it is your responsibility to update the Trivy database on a regular basis, so that the scanner can detect recently-identified vulnerabilities. 
-
-## Run Trivy with --skip-update option
-In an air-gapped environment, specify `--skip-update` so that Trivy doesn't attempt to download the latest database file.
-
-```
-$ trivy image --skip-update alpine:3.12
-```
-
-[trivy-db]: https://github.com/aquasecurity/trivy-db/releases

docs/advanced/index.md

@@ -1,2 +0,0 @@
-# Advanced
-This section describes advanced features, integrations, etc.

docs/advanced/modes/client-server.md

@@ -1,59 +0,0 @@
-# Client/Server
-
-Trivy has client/server mode. Trivy server has vulnerability database and Trivy client doesn't have to download vulnerability database. It is useful if you want to scan images at multiple locations and do not want to download the database at every location.
-
-## Server
-At first, you need to launch Trivy server. It downloads vulnerability database automatically and continue to fetch the latest DB in the background.
-```
-$ trivy server --listen localhost:8080
-2019-12-12T15:17:06.551+0200    INFO    Need to update DB
-2019-12-12T15:17:56.706+0200    INFO    Reopening DB...
-2019-12-12T15:17:56.707+0200    INFO    Listening localhost:8080...
-```
-
-If you want to accept a connection from outside, you have to specify `0.0.0.0` or your ip address, not `localhost`.
-
-```
-$ trivy server --listen 0.0.0.0:8080
-```
-
-## Client
-Then, specify the remote address.
-```
-$ trivy client --remote http://localhost:8080 alpine:3.10
-```
-
-<details>
-<summary>Result</summary>
-
-```
-alpine:3.10 (alpine 3.10.2)
-===========================
-Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 0, CRITICAL: 0)
-
-+---------+------------------+----------+-------------------+---------------+
-| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |
-+---------+------------------+----------+-------------------+---------------+
-| openssl | CVE-2019-1549    | MEDIUM   | 1.1.1c-r0         | 1.1.1d-r0     |
-+         +------------------+          +                   +               +
-|         | CVE-2019-1563    |          |                   |               |
-+         +------------------+----------+                   +               +
-|         | CVE-2019-1547    | LOW      |                   |               |
-+---------+------------------+----------+-------------------+---------------+
-```
-</details>
-
-## Authentication
-
-```
-$ trivy server --listen localhost:8080 --token dummy
-```
-
-```
-$ trivy client --remote http://localhost:8080 --token dummy alpine:3.10
-```
-
-## Architecture
-
-![architecture](../../imgs/client-server.png)
-

docs/advanced/private-registries/gcr.md

@@ -1,7 +0,0 @@
-Trivy uses Google Cloud SDK. You don't need to install `gcloud` command.
-
-If you want to use target project's repository, you can settle via `GOOGLE_APPLICATION_CREDENTIAL`.
-```bash
-# must set TRIVY_USERNAME empty char
-export GOOGLE_APPLICATION_CREDENTIALS=/path/to/credential.json
-```

docs/build/Dockerfile

@@ -1,4 +1,4 @@
-FROM squidfunk/mkdocs-material:7.0.6
+FROM squidfunk/mkdocs-material:8.2.10
 
 ## If you want to see exactly the same version as is published to GitHub pages
 ## use a private image for insiders, which requires authentication.
@@ -6,4 +6,5 @@ FROM squidfunk/mkdocs-material:7.0.6
 # docker login -u ${GITHUB_USERNAME} -p ${GITHUB_TOKEN} ghcr.io
 # FROM ghcr.io/squidfunk/mkdocs-material-insiders
 
-RUN pip install mike mkdocs-macros-plugin
+COPY requirements.txt .
+RUN pip install -r requirements.txt

docs/build/requirements.txt

@@ -0,0 +1,30 @@
+click==8.1.2
+csscompressor==0.9.5
+ghp-import==2.0.2
+htmlmin==0.1.12
+importlib-metadata==4.11.3
+Jinja2==3.1.1
+jsmin==3.0.1
+Markdown==3.3.6
+MarkupSafe==2.1.1
+mergedeep==1.3.4
+mike==1.1.2
+mkdocs==1.3.0
+mkdocs-macros-plugin==0.7.0
+mkdocs-material==8.2.10
+mkdocs-material-extensions==1.0.3
+mkdocs-minify-plugin==0.5.0
+mkdocs-redirects==1.0.4
+packaging==21.3
+Pygments==2.11.2
+pymdown-extensions==9.3
+pyparsing==3.0.8
+python-dateutil==2.8.2
+PyYAML==6.0
+pyyaml-env-tag==0.1
+six==1.16.0
+termcolor==1.1.0
+verspec==0.1.0
+watchdog==2.1.7
+zipp==3.8.0
+

docs/community/cks.md

@@ -0,0 +1,21 @@
+# CKS preparation resources
+
+Community Resources
+
+- [Trivy Video overview (short)][overview]
+- [Example questions from the exam][exam]
+- [More example questions][questions]
+
+Aqua Security Blog posts
+
+- Supply chain security best [practices][supply-chain-best-practices]
+- Supply chain [attacks][supply-chain-attacks]
+- 
+If you know of interesting resources, please start a PR to add those to the list.
+
+[overview]: https://youtu.be/2cjH6Zkieys
+[exam]: https://jonathan18186.medium.com/certified-kubernetes-security-specialist-cks-preparation-part-7-supply-chain-security-9cf62c34cf6a
+[questions]: https://github.com/kodekloudhub/certified-kubernetes-security-specialist-cks-course/blob/main/docs/06-Supply-Chain-Security/09-Scan-images-for-known-vulnerabilities-(Trivy).md
+
+[supply-chain-best-practices]: https://blog.aquasec.com/supply-chain-security-best-practices
+[supply-chain-attacks]: https://blog.aquasec.com/supply-chain-threats-using-container-images

docs/community/contribute/issue.md

@@ -0,0 +1,31 @@
+Thank you for taking interest in contributing to Trivy!
+
+- Feel free to open issues for any reason. When you open a new issue, you'll have to select an issue kind: bug/feature/support and fill the required information based on the selected template.
+- Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate. If it is, please add your comment to the existing issue.
+- Remember that users might search for your issue in the future, so please give it a meaningful title to help others.
+- The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information.
+
+## Wrong detection
+Trivy depends on [multiple data sources](https://aquasecurity.github.io/trivy/latest/docs/vulnerability/detection/data-source/).
+Sometime these databases contain mistakes.
+
+If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps:
+
+1. Run Trivy with `-f json` that shows data sources.
+2. According to the shown data source, make sure that the security advisory in the data source is correct.
+
+If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy.
+
+### GitHub Advisory Database
+Visit [here](https://github.com/advisories) and search CVE-ID.
+
+If you find a problem, it'll be nice to fix it: [How to contribute to a GitHub security advisory](https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/)
+ 
+### GitLab Advisory Database
+Visit [here](https://advisories.gitlab.com/) and search CVE-ID.
+
+If you find a problem, it'll be nice to fix it: [Create an issue to GitLab Advisory Database](https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/issues/new)
+ 
+### Red Hat CVE Database
+Visit [here](https://access.redhat.com/security/security-updates/?cwe=476#/cve) and search CVE-ID.
+

docs/community/contribute/pr.md

@@ -0,0 +1,164 @@
+Thank you for taking interest in contributing to Trivy!
+
+1. Every Pull Request should have an associated bug or feature issue unless you are fixing a trivial documentation issue.
+1. Please add the associated Issue link in the PR description.
+1. Your PR is more likely to be accepted if it focuses on just one change.
+1. There's no need to add or tag reviewers.
+1. If a reviewer commented on your code or asked for changes, please remember to respond with comment. Do not mark discussion as resolved. It's up to reviewer to mark it resolved (in case if suggested fix addresses problem properly). PRs with unresolved issues should not be merged (even if the comment is unclear or requires no action from your side).
+1. Please include a comment with the results before and after your change.
+1. Your PR is more likely to be accepted if it includes tests (We have not historically been very strict about tests, but we would like to improve this!).
+1. If your PR affects the user experience in some way, please update the README.md and the CLI help accordingly.
+
+### Title
+It is not that strict, but we use the title conventions in this repository.
+Each commit message doesn't have to follow the conventions as long as it is clear and descriptive since it will be squashed and merged.
+
+#### Format of the title
+
+```
+<type>(<scope>): <subject>
+```
+
+The `type` and `scope` should always be lowercase as shown below.
+
+**Allowed `<type>` values:**
+
+- **feat** for a new feature for the user, not a new feature for build script. Such commit will trigger a release bumping a MINOR version.
+- **fix** for a bug fix for the user, not a fix to a build script. Such commit will trigger a release bumping a PATCH version.
+- **perf** for performance improvements. Such commit will trigger a release bumping a PATCH version.
+- **docs** for changes to the documentation.
+- **style** for formatting changes, missing semicolons, etc.
+- **refactor** for refactoring production code, e.g. renaming a variable.
+- **test** for adding missing tests, refactoring tests; no production code change.
+- **build** for updating build configuration, development tools or other changes irrelevant to the user.
+- **chore** for updates that do not apply to the above, such as dependency updates.
+- **ci** for changes to CI configuration files and scripts
+- **revert** for revert to a previous commit
+
+**Allowed `<scope>` values:**
+
+checks:
+
+- vuln
+- misconf
+- secret
+
+mode:
+
+- image
+- fs
+- repo
+- sbom
+- server
+
+os:
+
+- alpine
+- redhat
+- alma
+- rocky
+- mariner
+- oracle
+- debian
+- ubuntu
+- amazon
+- suse
+- photon
+- distroless
+
+language:
+
+- ruby
+- php
+- python
+- nodejs
+- rust
+- dotnet
+- java
+- go
+
+vuln:
+
+- os
+- lang
+
+config:
+
+- kubernetes
+- dockerfile
+- terraform
+- cloudformation
+
+container
+
+- docker
+- podman
+- containerd
+- oci
+
+cli:
+
+- cli
+- flag
+
+others:
+
+- helm
+- report
+- db
+- deps
+
+The `<scope>` can be empty (e.g. if the change is a global or difficult to assign to a single component), in which case the parentheses are omitted.
+
+#### Example titles
+
+```
+feat(alma): add support for AlmaLinux
+```
+
+```
+fix(oracle): handle advisories with ksplice versions
+```
+
+```
+docs(misconf): add comparison with Conftest and TFsec
+```
+
+```
+chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0
+```
+
+**NOTE**: please do not use `chore(deps): update fanal` and something like that if you add new features or fix bugs in Trivy-related projects.
+The PR title should describe what the PR adds or fixes even though it just updates the dependency in Trivy.
+
+### Unit tests
+Your PR must pass all the unit tests. You can test it as below.
+
+```
+$ make test
+```
+
+### Integration tests
+Your PR must pass all the integration tests. You can test it as below.
+
+```
+$ make test-integration
+```
+
+### Documentation
+You can build the documents as below and view it at http://localhost:8000.
+
+```
+$ make mkdocs-serve
+```
+
+## Understand where your pull request belongs
+
+Trivy is composed of several repositories that work together:
+
+- [Trivy](https://github.com/aquasecurity/trivy) is the client-side, user-facing, command line tool.
+- [vuln-list](https://github.com/aquasecurity/vuln-list) is a vulnerabilities database, aggregated from different sources, and normalized for easy consumption. Think of this as the "server" side of the trivy command line tool. **There should be no pull requests to this repo**
+- [vuln-list-update](https://github.com/aquasecurity/vuln-list-update) is the code that maintains the vuln-list database.
+- [trivy-db](https://github.com/aquasecurity/trivy-db) maintains the vulnerability database pulled by Trivy CLI.
+- [fanal](https://github.com/aquasecurity/fanal) is a library for extracting system information from containers. It is being used by Trivy to find testable subjects in the container image.
+- [go-dep-parser](https://github.com/aquasecurity/go-dep-parser) is a library for parsing lock files such as package-lock.json and Gemfile.lock.

docs/community/maintainer/triage.md

@@ -1,7 +1,10 @@
+# Triage
+
 Triage is an important part of maintaining the health of the trivy repo.
 A well organized repo allows maintainers to prioritize feature requests, fix bugs, and respond to users facing difficulty with the tool as quickly as possible.
 
 Triage includes:
+
 - Labeling issues
 - Responding to issues
 - Closing issues
@@ -185,7 +188,7 @@ We use two labels [help wanted](https://github.com/aquasecurity/trivy/issues?q=i
 and [good first issue](https://github.com/aquasecurity/trivy/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22)
 to identify issues that have been specially groomed for new contributors.
 
-We have specific [guidelines](/docs/advanced/contribd/contrib/help-wanted.md)
+We have specific [guidelines](/docs/docs/advanced/contribd/contrib/help-wanted.md)
 for how to use these labels. If you see an issue that satisfies these
 guidelines, you can add the `help wanted` label and the `good first issue` label.
 Please note that adding the `good first issue` label must also 

docs/community/references.md

@@ -0,0 +1,48 @@
+# Additional References
+There are external blogs and evaluations.
+
+## Blogs
+- [Trivy Vulnerability Scanner Joins the Aqua Open-source Family][join]
+- [Trivy Image Vulnerability Scanner Now Under Apache 2.0 License][license]
+- [DevSecOps with Trivy and GitHub Actions][actions]
+- [Find Image Vulnerabilities Using GitHub and Aqua Security Trivy Action][actions2]
+- [Using Trivy to Discover Vulnerabilities in VS Code Projects][vscode]
+- [the vulnerability remediation lifecycle of Alpine containers][alpine]
+- [Continuous Container Vulnerability Testing with Trivy][semaphore]
+- [Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy][round-up]
+- [Docker Image Security: Static Analysis Tool Comparison – Anchore Engine vs Clair vs Trivy][tool-comparison]
+
+## Links
+- [Research Spike: evaluate Trivy for scanning running containers][gitlab]
+- [Istio evaluates scanners][istio]
+
+## Presentations
+- Aqua Security YouTube Channel
+    - [Trivy - container image scanning][intro]
+    - [Using Trivy in client server mode][server]
+    - [Tweaking Trivy output to fit your workflow][tweaking]
+    - [How does a vulnerability scanner identify packages?][identify]
+- CNCF Webinar 2020
+    - [Trivy Open Source Scanner for Container Images – Just Download and Run!][cncf]
+- KubeCon + CloudNativeCon Europe 2020 Virtual
+    - [Handling Container Vulnerabilities with Open Policy Agent - Teppei Fukuda, Aqua Security][kubecon]
+
+[alpine]: https://ariadne.space/2021/06/08/the-vulnerability-remediation-lifecycle-of-alpine-containers/
+[semaphore]: https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy
+[round-up]: https://boxboat.com/2020/04/24/image-scanning-tech-compared/
+[tool-comparison]: https://www.a10o.net/devsecops/docker-image-security-static-analysis-tool-comparison-anchore-engine-vs-clair-vs-trivy/
+[gitlab]: https://gitlab.com/gitlab-org/gitlab/-/issues/270888
+[istio]: https://github.com/istio/release-builder/pull/687#issuecomment-874938417
+
+[intro]: https://www.youtube.com/watch?v=AzOBGm7XxOA
+[cncf]: https://www.youtube.com/watch?v=XnYxX9uueoQ
+[server]: https://www.youtube.com/watch?v=tNQ-VlahtYM
+[kubecon]: https://www.youtube.com/watch?v=WKE2XNZ2zr4
+[identify]: https://www.youtube.com/watch?v=PaMnzeHBa8M
+[tweaking]: https://www.youtube.com/watch?v=wFIGUjcRLnU
+
+[join]: https://blog.aquasec.com/trivy-vulnerability-scanner-joins-aqua-family
+[license]: https://blog.aquasec.com/trivy-open-source-vulnerability-scanner-apache2.0-license
+[actions]: https://blog.aquasec.com/devsecops-with-trivy-github-actions
+[actions2]: https://blog.aquasec.com/github-vulnerability-scanner-trivy
+[vscode]: https://blog.aquasec.com/trivy-open-source-vulnerability-scanner-vs-code

docs/community/tools.md

@@ -0,0 +1,37 @@
+# Community Tools
+The open source community has been hard at work developing new tools for Trivy. You can check out some of them here.
+
+Have you created a tool that’s not listed? Add the name and description of your integration and open a pull request in the GitHub repository to get your change merged.
+
+## GitHub Actions
+
+| Actions                                    | Description                                                                      |
+| ------------------------------------------ | -------------------------------------------------------------------------------- |
+| [gitrivy][gitrivy]                         | GitHub Issue + Trivy                                                             |
+| [trivy-github-issues][trivy-github-issues] | GitHub Actions for creating GitHub Issues according to the Trivy scanning result |
+
+## Semaphore
+
+| Name                                                   | Description                               |
+| -------------------------------------------------------| ----------------------------------------- |
+| [Continuous Vulnerability Testing with Trivy][semaphore-tutorial] | Tutorial on scanning code, containers, infrastructure, and Kubernetes with Semaphore CI/CD. |
+
+
+## CircleCI
+
+| Orb                                      | Description                               |
+| -----------------------------------------| ----------------------------------------- |
+| [fifteen5/trivy-orb][fifteen5/trivy-orb] | Orb for running Trivy, a security scanner |
+
+## Others
+
+| Name                                     | Description                               |
+| -----------------------------------------| ----------------------------------------- |
+| [Trivy Vulnerability Explorer][explorer] | Explore trivy vulnerability reports in your browser and create .trivyignore files interactively. Can be integrated in your CI/CD tooling with deep links.   |
+
+
+[trivy-github-issues]: https://github.com/marketplace/actions/trivy-github-issues
+[fifteen5/trivy-orb]: https://circleci.com/developer/orbs/orb/fifteen5/trivy-orb
+[gitrivy]: https://github.com/marketplace/actions/trivy-action
+[explorer]: https://dbsystel.github.io/trivy-vulnerability-explorer/
+[semaphore-tutorial]: https://semaphoreci.com/blog/continuous-container-vulnerability-testing-with-trivy

docs/docs/advanced/air-gap.md

@@ -0,0 +1,66 @@
+# Air-Gapped Environment
+
+Trivy can be used in air-gapped environments. Note that an allowlist is [here][allowlist].
+
+## Air-Gapped Environment for vulnerabilities
+
+### Download the vulnerability database
+At first, you need to download the vulnerability database for use in air-gapped environments.
+Please follow [oras installation instruction][oras].
+
+Download `db.tar.gz`:
+
+```
+$ oras pull ghcr.io/aquasecurity/trivy-db:2 -a
+```
+
+### Transfer the DB file into the air-gapped environment
+The way of transfer depends on the environment.
+
+```
+$ rsync -av -e ssh /path/to/db.tar.gz [user]@[host]:dst
+```
+
+### Put the DB file in Trivy's cache directory
+You have to know where to put the DB file. The following command shows the default cache directory.
+
+```
+$ ssh user@host
+$ trivy -h | grep cache
+   --cache-dir value  cache directory (default: "/home/myuser/.cache/trivy") [$TRIVY_CACHE_DIR]
+```
+
+Put the DB file in the cache directory + `/db`.
+
+```
+$ mkdir -p /home/myuser/.cache/trivy/db
+$ cd /home/myuser/.cache/trivy/db
+$ tar xvf /path/to/db.tar.gz -C /home/myuser/.cache/trivy/db
+x trivy.db
+x metadata.json
+$ rm /path/to/db.tar.gz
+```
+
+In an air-gapped environment it is your responsibility to update the Trivy database on a regular basis, so that the scanner can detect recently-identified vulnerabilities. 
+
+### Run Trivy with --skip-update and --offline-scan option
+In an air-gapped environment, specify `--skip-update` so that Trivy doesn't attempt to download the latest database file.
+In addition, if you want to scan Java dependencies such as JAR and pom.xml, you need to specify `--offline-scan` since Trivy tries to issue API requests for scanning Java applications by default.
+
+```
+$ trivy image --skip-update --offline-scan alpine:3.12
+```
+
+## Air-Gapped Environment for misconfigurations
+
+No special measures are required to detect misconfigurations in an air-gapped environment.
+
+### Run Trivy with --skip-policy-update option
+In an air-gapped environment, specify `--skip-policy-update` so that Trivy doesn't attempt to download the latest misconfiguration policies.
+
+```
+$ trivy conf --skip-policy-update /path/to/conf
+```
+
+[allowlist]: ../references/troubleshooting.md
+[oras]: https://oras.land/cli/

docs/docs/advanced/container/embed-in-dockerfile.md

@@ -10,7 +10,7 @@ FROM alpine:3.7
 
 RUN apk add curl \
     && curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \
-    && trivy filesystem --exit-code 1 --no-progress /
+    && trivy rootfs --exit-code 1 --no-progress /
 
 $ docker build -t vulnerable-image .
 ```
@@ -21,7 +21,7 @@ insecure `curl | sh`. Also the image is not changed.
 # Run vulnerability scan on build image
 FROM build AS vulnscan
 COPY --from=aquasec/trivy:latest /usr/local/bin/trivy /usr/local/bin/trivy
-RUN trivy filesystem --exit-code 1 --no-progress /
+RUN trivy rootfs --exit-code 1 --no-progress /
 [...]
 ```
 

docs/docs/advanced/container/unpacked-filesystem.md

@@ -1,12 +1,12 @@
 # Unpacked Filesystem
 
-Scan aan unpacked container image filesystem.
+Scan an unpacked container image filesystem.
 
 In this case, Trivy works the same way when scanning containers
 
 ```bash
 $ docker export $(docker create alpine:3.10.2) | tar -C /tmp/rootfs -xvf -
-$ trivy fs /tmp/rootfs
+$ trivy rootfs /tmp/rootfs
 ```
 
 <details>

docs/docs/advanced/private-registries/acr.md

@@ -0,0 +1,27 @@
+# Requirements
+None, Trivy uses Azure SDK for Go. You don't need to install `az` command.
+
+# Privileges
+Service principal must have the `AcrPull` permissions.
+
+## Creation of a service principal
+```bash
+export SP_DATA=$(az ad sp create-for-rbac --name TrivyTest --role AcrPull --scope "/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.ContainerRegistry/registries/<registry_name>")
+```
+
+# Usage
+```bash
+# must set TRIVY_USERNAME empty char
+export AZURE_CLIENT_ID$(echo $SP_DATA | jq -r .appId)
+export AZURE_CLIENT_SECRET$(echo $SP_DATA | jq -r .password)
+export AZURE_TENANT_ID$(echo $SP_DATA | jq -r .tenant)
+```
+
+# Testing
+You can test credentials in the following manner.
+
+```bash
+docker run -it --rm -v /tmp:/tmp\
+  -e AZURE_CLIENT_ID=${AZURE_CLIENT_ID} -e AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET} \
+  -e AZURE_TENANT_ID=${AZURE_TENANT_ID} aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag
+```

docs/docs/advanced/private-registries/gcr.md

@@ -0,0 +1,40 @@
+# Requirements
+None, Trivy uses Google Cloud SDK. You don't need to install `gcloud` command.
+
+# Privileges
+Credential file must have the `roles/storage.objectViewer` permissions.
+More information can be found in [Google's documentation](https://cloud.google.com/container-registry/docs/access-control)
+
+## JSON File Format
+The JSON file specified should have the following format provided by google's service account mechanisms:
+
+```json
+{
+  "type": "service_account",
+  "project_id": "your_special_project",
+  "private_key_id": "XXXXXXXXXXXXXXXXXXXXxx",
+  "private_key": "-----BEGIN PRIVATE KEY-----\nNONONONO\n-----END PRIVATE KEY-----\n",
+  "client_email": "somedude@your_special_project.iam.gserviceaccount.com",
+  "client_id": "1234567890",
+  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+  "token_uri": "https://oauth2.googleapis.com/token",
+  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/somedude%40your_special_project.iam.gserviceaccount.com"
+}
+```
+
+# Usage
+If you want to use target project's repository, you can set them via `GOOGLE_APPLICATION_CREDENTIALS`.
+```bash
+# must set TRIVY_USERNAME empty char
+export GOOGLE_APPLICATION_CREDENTIALS=/path/to/credential.json
+```
+
+# Testing
+You can test credentials in the following manner (assuming they are in `/tmp` on host machine).
+
+```bash
+docker run -it --rm -v /tmp:/tmp\
+  -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/service_account.json\
+  aquasec/trivy image gcr.io/your_special_project/your_special_image:your_special_tag
+```

docs/docs/index.md

@@ -0,0 +1,93 @@
+# Docs
+
+Trivy detects two types of security issues:
+
+- [Vulnerabilities][vuln]
+- [Misconfigurations][misconf]
+
+Trivy can scan four different artifacts:
+
+- [Container Images][container]
+- [Filesystem][filesystem] and [Rootfs][rootfs]
+- [Git Repositories][repo]
+- [Kubernetes][kubernetes]
+
+Trivy can be run in two different modes:
+
+- [Standalone][standalone]
+- [Client/Server][client-server]
+
+Trivy can be run as a Kubernetes Operator:
+
+- [Kubernetes Operator][kubernetesoperator]
+
+It is designed to be used in CI. Before pushing to a container registry or deploying your application, you can scan your local container image and other artifacts easily.
+See [Integrations][integrations] for details.
+
+## Features
+
+- Comprehensive vulnerability detection
+    - [OS packages][os] (Alpine, Red Hat Universal Base Image, Red Hat Enterprise Linux, CentOS, AlmaLinux, Rocky Linux, CBL-Mariner, Oracle Linux, Debian, Ubuntu, Amazon Linux, openSUSE Leap, SUSE Enterprise Linux, Photon OS and Distroless)
+    - [**Language-specific packages**][lang] (Bundler, Composer, Pipenv, Poetry, npm, yarn, Cargo, NuGet, Maven, and Go)
+- Detect IaC misconfigurations
+    - A wide variety of [built-in policies][builtin] are provided **out of the box**:
+        - Kubernetes
+        - Docker
+        - Terraform
+        - more coming soon
+    - Support custom policies
+- Simple
+    - Specify only an image name, a directory containing IaC configs, or an artifact name
+    - See [Quick Start][quickstart]
+- Fast
+    - The first scan will finish within 10 seconds (depending on your network). Consequent scans will finish in single seconds.
+    - Unlike other scanners that take long to fetch vulnerability information (~10 minutes) on the first run, and encourage you to maintain a durable vulnerability database, Trivy is stateless and requires no maintenance or preparation.
+- Easy installation
+    - `apt-get install`, `yum install` and `brew install` is possible (See [Installation][installation])
+    - **No pre-requisites** such as installation of DB, libraries, etc.
+- High accuracy
+    - **Especially Alpine Linux and RHEL/CentOS**
+    - Other OSes are also high
+- DevSecOps
+    - **Suitable for CI** such as Travis CI, CircleCI, Jenkins, GitLab CI, etc.
+    - See [CI Example][integrations]
+- Support multiple formats
+    - container image
+        - A local image in Docker Engine which is running as a daemon
+        - A local image in [Podman][podman] (>=2.0) which is exposing a socket
+        - A remote image in Docker Registry such as Docker Hub, ECR, GCR and ACR
+        - A tar archive stored in the `docker save` / `podman save` formatted file
+        - An image directory compliant with [OCI Image Format][oci]
+    - local filesystem and rootfs
+    - remote git repository
+- [SBOM][sbom] (Software Bill of Materials) support
+    - CycloneDX
+    - SPDX
+
+Please see [LICENSE][license] for Trivy licensing information.
+
+[installation]: ../getting-started/installation.md
+[vuln]: ../docs/vulnerability/scanning/index.md
+[misconf]: ../docs/misconfiguration/scanning.md
+[kubernetesoperator]: ../docs/kubernetes/operator/index.md
+[container]: ../docs/vulnerability/scanning/image.md
+[rootfs]: ../docs/vulnerability/scanning/rootfs.md
+[filesystem]: ../docs/vulnerability/scanning/filesystem.md
+[repo]: ../docs/vulnerability/scanning/git-repository.md
+[kubernetes]: ../docs/kubernetes/cli/scanning.md
+
+[standalone]: ../docs/references/modes/standalone.md
+[client-server]: ../docs/references/modes/client-server.md
+[integrations]: ../docs/integrations/index.md
+
+[os]: ../docs/vulnerability/detection/os.md
+[lang]: ../docs/vulnerability/detection/language.md
+
+[builtin]: ../docs/misconfiguration/policy/builtin.md
+[quickstart]: ../getting-started/quickstart.md
+[podman]: ../docs/advanced/container/podman.md
+
+[sbom]: ../docs/sbom/index.md
+
+[oci]: https://github.com/opencontainers/image-spec
+[license]:  https://github.com/aquasecurity/trivy/blob/main/LICENSE

docs/docs/integrations/bitbucket.md

@@ -0,0 +1,5 @@
+# Bitbucket Pipelines
+
+See [trivy-pipe][trivy-pipe] for the details.
+
+[trivy-pipe]: https://github.com/aquasecurity/trivy-pipe

docs/docs/integrations/circleci.md

@@ -19,7 +19,7 @@ jobs:
             curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
       - run:
           name: Scan the local image with trivy
-          command: trivy --exit-code 0 --no-progress trivy-ci-test:${CIRCLE_SHA1}
+          command: trivy image --exit-code 0 --no-progress trivy-ci-test:${CIRCLE_SHA1}
 workflows:
   version: 2
   release:

docs/docs/integrations/gitlab-ci.md

@@ -1,5 +1,18 @@
 # GitLab CI
 
+GitLab 15.0 includes [free](https://gitlab.com/groups/gitlab-org/-/epics/2233) integration with Trivy.
+
+To [configure container scanning with Trivy in GitLab](https://docs.gitlab.com/ee/user/application_security/container_scanning/#configuration), simply include the CI template in your `.gitlab-ci.yml` file:
+
+```yaml
+include:
+  - template: Security/Container-Scanning.gitlab-ci.yml
+```
+
+If you're a GitLab 14.x Ultimate customer, you can use the same configuration above.
+
+Alternatively, you can always use the example configurations below. Note that the examples use [`contrib/gitlab.tpl`](https://github.com/aquasecurity/trivy/blob/main/contrib/gitlab.tpl), which does not work with GitLab 15.0 and above (for details, see [issue 1598](https://github.com/aquasecurity/trivy/issues/1598)).
+
 ```yaml
 stages:
   - test
@@ -17,6 +30,8 @@ trivy:
     # See https://github.com/docker-library/docker/pull/166
     DOCKER_TLS_CERTDIR: ""
     IMAGE: trivy-ci-test:$CI_COMMIT_SHA
+    TRIVY_NO_PROGRESS: "true"
+    TRIVY_CACHE_DIR: ".trivycache/"
   before_script:
     - export TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
     - echo $TRIVY_VERSION
@@ -26,11 +41,11 @@ trivy:
     # Build image
     - docker build -t $IMAGE .
     # Build report
-    - ./trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@contrib/gitlab.tpl" -o gl-container-scanning-report.json $IMAGE
+    - ./trivy image --exit-code 0 --format template --template "@contrib/gitlab.tpl" -o gl-container-scanning-report.json $IMAGE
     # Print report
-    - ./trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --severity HIGH $IMAGE
+    - ./trivy image --exit-code 0 --severity HIGH $IMAGE
     # Fail on severe vulnerabilities
-    - ./trivy --exit-code 1 --cache-dir .trivycache/ --severity CRITICAL --no-progress $IMAGE
+    - ./trivy image --exit-code 1 --severity CRITICAL $IMAGE
   cache:
     paths:
       - .trivycache/
@@ -65,20 +80,22 @@ container_scanning:
     TRIVY_USERNAME: "$CI_REGISTRY_USER"
     TRIVY_PASSWORD: "$CI_REGISTRY_PASSWORD"
     TRIVY_AUTH_URL: "$CI_REGISTRY"
+    TRIVY_NO_PROGRESS: "true"
+    TRIVY_CACHE_DIR: ".trivycache/"
     FULL_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
   script:
     - trivy --version
     # cache cleanup is needed when scanning images with the same tags, it does not remove the database
     - time trivy image --clear-cache
     # update vulnerabilities db
-    - time trivy --download-db-only --no-progress --cache-dir .trivycache/
+    - time trivy image --download-db-only
     # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there
-    - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@/contrib/gitlab.tpl"
+    - time trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl"
         --output "$CI_PROJECT_DIR/gl-container-scanning-report.json" "$FULL_IMAGE_NAME"
     # Prints full report
-    - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress "$FULL_IMAGE_NAME"
+    - time trivy image --exit-code 0 "$FULL_IMAGE_NAME"
     # Fail on critical vulnerabilities
-    - time trivy --exit-code 1 --cache-dir .trivycache/ --severity CRITICAL --no-progress "$FULL_IMAGE_NAME"
+    - time trivy image --exit-code 1 --severity CRITICAL "$FULL_IMAGE_NAME"
   cache:
     paths:
       - .trivycache/
@@ -120,6 +137,8 @@ trivy:
     # See https://github.com/docker-library/docker/pull/166
     DOCKER_TLS_CERTDIR: ""
     IMAGE: trivy-ci-test:$CI_COMMIT_SHA
+    TRIVY_NO_PROGRESS: "true"
+    TRIVY_CACHE_DIR: ".trivycache/"
   before_script:
     - export TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
     - echo $TRIVY_VERSION
@@ -128,15 +147,20 @@ trivy:
   script:
     # Build image
     - docker build -t $IMAGE .
-    # Build report
-    - ./trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@contrib/gitlab-codeclimate.tpl" -o gl-codeclimate.json $IMAGE
+    # Image report
+    - ./trivy image --exit-code 0 --format template --template "@contrib/gitlab-codequality.tpl" -o gl-codeclimate-image.json $IMAGE
+    # Filesystem report
+    - ./trivy filesystem --security-checks config,vuln --exit-code 0 --format template --template "@contrib/gitlab-codequality.tpl" -o gl-codeclimate-fs.json .
+    # Combine report
+    - apk update && apk add jq
+    - jq -s 'add' gl-codeclimate-image.json gl-codeclimate-fs.json > gl-codeclimate.json
   cache:
     paths:
       - .trivycache/
   # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold)
   artifacts:
     paths:
-      gl-codeclimate.json
+      - gl-codeclimate.json
     reports:
       codequality: gl-codeclimate.json
 ```
@@ -149,3 +173,9 @@ already have a code quality report in your pipeline, you can use
 be necessary to rename the artifact if you want to reuse the name. To then
 combine the previous artifact with the output of trivy, the following `jq`
 command can be used, `jq -s 'add' prev-codeclimate.json trivy-codeclimate.json > gl-codeclimate.json`.
+
+### Gitlab CI alternative template example report
+
+You'll be able to see a full report in the Gitlab pipeline code quality UI, where filesystem vulnerabilities and misconfigurations include links to the flagged files and image vulnerabilities report the image/os or runtime/library that the vulnerability originates from instead.
+
+![codequality](../../imgs/gitlab-codequality.png)

docs/docs/integrations/index.md

@@ -1,4 +1,2 @@
 # Integrations
 Scan your image automatically as part of your CI workflow, failing the workflow if a vulnerability is found. When you don't want to fail the test, specify `--exit-code 0`.
-
-Since in automated scenarios such as CI/CD you are only interested in the end result, and not the full report, use the `--light` flag to optimize for this scenario and get fast results.

docs/docs/integrations/travis-ci.md

@@ -15,8 +15,8 @@ before_install:
   - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz
   - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz
 script:
-  - ./trivy --exit-code 0 --severity HIGH --no-progress trivy-ci-test:${COMMIT}
-  - ./trivy --exit-code 1 --severity CRITICAL --no-progress trivy-ci-test:${COMMIT}
+  - ./trivy image --exit-code 0 --severity HIGH --no-progress trivy-ci-test:${COMMIT}
+  - ./trivy image --exit-code 1 --severity CRITICAL --no-progress trivy-ci-test:${COMMIT}
 cache:
   directories:
     - $HOME/.cache/trivy

docs/docs/kubernetes/cli/scanning.md

@@ -0,0 +1,200 @@
+# Kubernetes
+
+!!! warning "EXPERIMENTAL"
+
+This feature might change without preserving backwards compatibility.
+
+Scan your Kubernetes cluster for both Vulnerabilities and Misconfigurations.
+
+Trivy uses your local kubectl configuration to access the API server to list artifacts.
+
+Scan a full cluster and generate a simple summary report:
+
+```
+$ trivy k8s --report=summary
+```
+
+![k8s Summary Report](../../../imgs/k8s-summary.png)
+
+The summary report is the default. To get all of the detail the output contains, use `--report all`.
+
+Filter by severity:
+
+```
+$ trivy k8s --severity=CRITICAL --report=all
+```
+
+Scan a specific namespace:
+
+```
+$ trivy k8s -n kube-system --report=summary
+```
+
+Scan a specific resource and get all the output:
+
+```
+$ trivy k8s deployment/appname
+```
+
+The supported formats are `table`, which is the default, and `json`.
+To get a JSON output on a full cluster scan:
+
+```
+$ trivy k8s --format json -o results.json
+```
+
+<details>
+<summary>Result</summary>
+
+```json
+{
+  "ClusterName": "minikube",
+  "Vulnerabilities": [
+    {
+      "Namespace": "default",
+      "Kind": "Deployment",
+      "Name": "app",
+      "Results": [
+        {
+          "Target": "ubuntu:latest (ubuntu 22.04)",
+          "Class": "os-pkgs",
+          "Type": "ubuntu",
+          "Vulnerabilities": [
+            {
+              "VulnerabilityID": "CVE-2016-2781",
+              "PkgName": "coreutils",
+              "InstalledVersion": "8.32-4.1ubuntu1",
+              "Layer": {
+                "Digest": "sha256:125a6e411906fe6b0aaa50fc9d600bf6ff9bb11a8651727ce1ed482dc271c24c",
+                "DiffID": "sha256:e59fc94956120a6c7629f085027578e6357b48061d45714107e79f04a81a6f0c"
+              },
+              "SeveritySource": "ubuntu",
+              "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-2781",
+              "DataSource": {
+                "ID": "ubuntu",
+                "Name": "Ubuntu CVE Tracker",
+                "URL": "https://git.launchpad.net/ubuntu-cve-tracker"
+              },
+              "Title": "coreutils: Non-privileged session can escape to the parent session in chroot",
+              "Description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
+              "Severity": "LOW",
+              "CweIDs": [
+                "CWE-20"
+              ],
+              "VendorSeverity": {
+                "cbl-mariner": 2,
+                "nvd": 2,
+                "redhat": 2,
+                "ubuntu": 1
+              },
+              "CVSS": {
+                "nvd": {
+                  "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
+                  "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
+                  "V2Score": 2.1,
+                  "V3Score": 6.5
+                },
+                "redhat": {
+                  "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
+                  "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
+                  "V2Score": 6.2,
+                  "V3Score": 8.6
+                }
+              },
+              "References": [
+                "http://seclists.org/oss-sec/2016/q1/452",
+                "http://www.openwall.com/lists/oss-security/2016/02/28/2",
+                "http://www.openwall.com/lists/oss-security/2016/02/28/3",
+                "https://access.redhat.com/security/cve/CVE-2016-2781",
+                "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781",
+                "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E",
+                "https://lore.kernel.org/patchwork/patch/793178/",
+                "https://nvd.nist.gov/vuln/detail/CVE-2016-2781"
+              ],
+              "PublishedDate": "2017-02-07T15:59:00Z",
+              "LastModifiedDate": "2021-02-25T17:15:00Z"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "Misconfigurations": [
+    {
+      "Namespace": "default",
+      "Kind": "Deployment",
+      "Name": "app",
+      "Results": [
+        {
+          "Target": "Deployment/app",
+          "Class": "config",
+          "Type": "kubernetes",
+          "MisconfSummary": {
+            "Successes": 20,
+            "Failures": 19,
+            "Exceptions": 0
+          },
+          "Misconfigurations": [
+            {
+              "Type": "Kubernetes Security Check",
+              "ID": "KSV001",
+              "Title": "Process can elevate its own privileges",
+              "Description": "A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.",
+              "Message": "Container 'app' of Deployment 'app' should set 'securityContext.allowPrivilegeEscalation' to false",
+              "Namespace": "builtin.kubernetes.KSV001",
+              "Query": "data.builtin.kubernetes.KSV001.deny",
+              "Resolution": "Set 'set containers[].securityContext.allowPrivilegeEscalation' to 'false'.",
+              "Severity": "MEDIUM",
+              "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv001",
+              "References": [
+                "https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted",
+                "https://avd.aquasec.com/misconfig/ksv001"
+              ],
+              "Status": "FAIL",
+              "Layer": {},
+              "IacMetadata": {
+                "Provider": "Kubernetes",
+                "Service": "general",
+                "StartLine": 121,
+                "EndLine": 133
+              }
+            },
+            {
+              "Type": "Kubernetes Security Check",
+              "ID": "KSV003",
+              "Title": "Default capabilities not dropped",
+              "Description": "The container should drop all default capabilities and add only those that are needed for its execution.",
+              "Message": "Container 'app' of Deployment 'app' should add 'ALL' to 'securityContext.capabilities.drop'",
+              "Namespace": "builtin.kubernetes.KSV003",
+              "Query": "data.builtin.kubernetes.KSV003.deny",
+              "Resolution": "Add 'ALL' to containers[].securityContext.capabilities.drop.",
+              "Severity": "LOW",
+              "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv003",
+              "References": [
+                "https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/",
+                "https://avd.aquasec.com/misconfig/ksv003"
+              ],
+              "Status": "FAIL",
+              "Layer": {},
+              "IacMetadata": {
+                "Provider": "Kubernetes",
+                "Service": "general",
+                "StartLine": 121,
+                "EndLine": 133
+              }
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "Namespace": "default",
+      "Kind": "ConfigMap",
+      "Name": "kube-root-ca.crt"
+    }
+  ]
+}
+
+```
+
+</details>

docs/docs/kubernetes/operator/configuration-auditing/built-in-policies.md

@@ -0,0 +1,108 @@
+# Built-in Configuration Audit Policies
+
+The following sections list built-in configuration audit policies installed with trivy-operator. They are stored in the
+`trivy-operator-policies-config` ConfigMap created in the installation namespace (e.g. `trivy-system`). You can modify
+them or add a new policy. For example, follow the [Writing Custom Configuration Audit Policies] tutorial to add a custom
+policy that checks for recommended Kubernetes labels on any resource kind.
+
+## General
+
+| NAME                                       | DESCRIPTION                                                                                                                                                                                                         | KINDS    |
+|--------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
+| [CPU not limited]                          | Enforcing CPU limits prevents DoS via resource exhaustion.                                                                                                                                                          | Workload |
+| [CPU requests not specified]               | When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.                                             | Workload |
+| [SYS_ADMIN capability added]               | SYS_ADMIN gives the processes running inside the container privileges that are equivalent to root.                                                                                                                  | Workload |
+| [Default capabilities not dropped]         | The container should drop all default capabilities and add only those that are needed for its execution.                                                                                                            | Workload |
+| [Root file system is not read-only]        | An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. | Workload |
+| [Memory not limited]                       | Enforcing memory limits prevents DoS via resource exhaustion.                                                                                                                                                       | Workload |
+| [Memory requests not specified]            | When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.                                               | Workload |
+| [hostPath volume mounted with docker.sock] | Mounting docker.sock from the host can give the container full root access to the host.                                                                                                                             | Workload |
+| [Runs with low group ID]                   | Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.                                                                                                                     | Workload |
+| [Runs with low user ID]                    | Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.                                                                                                                      | Workload |
+| [Tiller Is Deployed]                       | Check if Helm Tiller component is deployed.                                                                                                                                                                         | Workload |
+| [Image tag ':latest' used]                 | It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.                | Workload |
+
+## Advanced
+
+| NAME                                                           | DESCRIPTION                                                                                                                              | KINDS         |
+|----------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|---------------|
+| [Unused capabilities should be dropped (drop any)]             | Security best practices require containers to run with minimal required capabilities.                                                    | Workload      |
+| [hostAliases is set]                                           | Managing /etc/hosts aliases can prevent the container engine from modifying the file after a pod’s containers have already been started. | Workload      |
+| [User Pods should not be placed in kube-system namespace]      | ensure that User pods are not placed in kube-system namespace                                                                            | Workload      |
+| [Protecting Pod service account tokens]                        | ensure that Pod specifications disable the secret token being mounted by setting automountServiceAccountToken: false                     | Workload      |
+| [Selector usage in network policies]                           | ensure that network policies selectors are applied to pods or namespaces to restricted ingress and egress traffic within the pod network | NetworkPolicy |
+| [limit range usage]                                            | ensure limit range policy has configure in order to limit resource usage for namespaces or nodes                                         | LimitRange    |
+| [resource quota usage]                                         | ensure resource quota policy has configure in order to limit aggregate resource usage within namespace                                   | ResourceQuota |
+| [All container images must start with the *.azurecr.io domain] | Containers should only use images from trusted registries.                                                                               | Workload      |
+| [All container images must start with a GCR domain]            | Containers should only use images from trusted GCR registries.                                                                           | Workload      |
+
+## Pod Security Standard
+
+### Baseline
+
+| NAME                               | DESCRIPTION                                                                                                                                                                                                                                                                              | KINDS    |
+|------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
+| [Access to host IPC namespace]     | Sharing the host’s IPC namespace allows container processes to communicate with processes on the host.                                                                                                                                                                                   | Workload |
+| [Access to host network]           | Sharing the host’s network namespace permits processes in the pod to communicate with processes bound to the host’s loopback adapter.                                                                                                                                                    | Workload |
+| [Access to host PID]               | Sharing the host’s PID namespace allows visibility on host processes, potentially leaking information such as environment variables and configuration.                                                                                                                                   | Workload |
+| [Privileged container]             | Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.                                                                                                           | Workload |
+| [Non-default capabilities added]   | Adding NET_RAW or capabilities beyond the default set must be disallowed.                                                                                                                                                                                                                | Workload |
+| [hostPath volumes mounted]         | HostPath volumes must be forbidden.                                                                                                                                                                                                                                                      | Workload |
+| [Access to host ports]             | HostPorts should be disallowed, or at minimum restricted to a known list.                                                                                                                                                                                                                | Workload |
+| [Default AppArmor profile not set] | A program inside the container can bypass AppArmor protection policies.                                                                                                                                                                                                                  | Workload |
+| [SELinux custom options set]       | Setting a custom SELinux user or role option should be forbidden.                                                                                                                                                                                                                        | Workload |
+| [Non-default /proc masks set]      | The default /proc masks are set up to reduce attack surface, and should be required.                                                                                                                                                                                                     | Workload |
+| [Unsafe sysctl options set]        | Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed 'safe' subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. | Workload |
+
+### Restricted
+
+| NAME                                      | DESCRIPTION                                                                                                                                      | KINDS    |
+|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|----------|
+| [Non-ephemeral volume types used]         | In addition to restricting HostPath volumes, usage of non-ephemeral volume types should be limited to those defined through PersistentVolumes.   | Workload |
+| [Process can elevate its own privileges]  | A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. | Workload |
+| [Runs as root user]                       | 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.                                                    | Workload |
+| [A root primary or supplementary GID set] | Containers should be forbidden from running with a root primary or supplementary GID.                                                            | Workload |
+| [Default Seccomp profile not set]         | The RuntimeDefault seccomp profile must be required, or allow specific additional profiles.                                                      | Workload |
+
+[Writing Custom Configuration Audit Policies]: ./../tutorials/writing-custom-configuration-audit-policies.md
+
+[CPU not limited]: https://avd.aquasec.com/misconfig/kubernetes/ksv011/
+[CPU requests not specified]: https://avd.aquasec.com/misconfig/kubernetes/ksv015/
+[SYS_ADMIN capability added]: https://avd.aquasec.com/misconfig/kubernetes/ksv005/
+[Default capabilities not dropped]: https://avd.aquasec.com/misconfig/kubernetes/ksv003/
+[Root file system is not read-only]: https://avd.aquasec.com/misconfig/kubernetes/ksv014/
+[Memory not limited]: https://avd.aquasec.com/misconfig/kubernetes/ksv018/
+[Memory requests not specified]: https://avd.aquasec.com/misconfig/kubernetes/ksv016/
+[hostPath volume mounted with docker.sock]: https://avd.aquasec.com/misconfig/kubernetes/ksv006/
+[Runs with low group ID]: https://avd.aquasec.com/misconfig/kubernetes/ksv021/
+[Runs with low user ID]: https://avd.aquasec.com/misconfig/kubernetes/ksv020/
+[Tiller Is Deployed]: https://avd.aquasec.com/misconfig/kubernetes/ksv102/
+[Image tag ':latest' used]: https://avd.aquasec.com/misconfig/kubernetes/ksv013/
+
+[Unused capabilities should be dropped (drop any)]: https://avd.aquasec.com/misconfig/kubernetes/ksv004/
+[hostAliases is set]: https://avd.aquasec.com/misconfig/kubernetes/ksv007/
+[User Pods should not be placed in kube-system namespace]: https://avd.aquasec.com/misconfig/kubernetes/ksv037/
+[Protecting Pod service account tokens]: https://avd.aquasec.com/misconfig/kubernetes/ksv036/
+[Selector usage in network policies]: https://avd.aquasec.com/misconfig/kubernetes/ksv038/
+[limit range usage]: https://avd.aquasec.com/misconfig/kubernetes/ksv039/
+[resource quota usage]: https://avd.aquasec.com/misconfig/kubernetes/ksv040/
+[All container images must start with the *.azurecr.io domain]: https://avd.aquasec.com/misconfig/kubernetes/ksv032/
+[All container images must start with a GCR domain]: https://avd.aquasec.com/misconfig/kubernetes/ksv033/
+
+[Access to host IPC namespace]: https://avd.aquasec.com/misconfig/kubernetes/ksv008/
+[Access to host network]: https://avd.aquasec.com/misconfig/kubernetes/ksv009/
+[Access to host PID]: https://avd.aquasec.com/misconfig/kubernetes/ksv010/
+[Privileged container]: https://avd.aquasec.com/misconfig/kubernetes/ksv017/
+[Non-default capabilities added]: https://avd.aquasec.com/misconfig/kubernetes/ksv022/
+[hostPath volumes mounted]: https://avd.aquasec.com/misconfig/kubernetes/ksv023/
+[Access to host ports]: https://avd.aquasec.com/misconfig/kubernetes/ksv024/
+[Default AppArmor profile not set]: https://avd.aquasec.com/misconfig/kubernetes/ksv002/
+[SELinux custom options set]: https://avd.aquasec.com/misconfig/kubernetes/ksv025/
+[Non-default /proc masks set]: https://avd.aquasec.com/misconfig/kubernetes/ksv027/
+[Unsafe sysctl options set]: https://avd.aquasec.com/misconfig/kubernetes/ksv026/
+
+[Non-ephemeral volume types used]: https://avd.aquasec.com/misconfig/kubernetes/ksv028/
+[Process can elevate its own privileges]: https://avd.aquasec.com/misconfig/kubernetes/ksv001/
+[Runs as root user]: https://avd.aquasec.com/misconfig/kubernetes/ksv012/
+[A root primary or supplementary GID set]: https://avd.aquasec.com/misconfig/kubernetes/ksv029/
+[Default Seccomp profile not set]: https://avd.aquasec.com/misconfig/kubernetes/ksv030/

docs/docs/kubernetes/operator/configuration-auditing/index.md

@@ -0,0 +1,18 @@
+# Configuration Auditing
+
+As your organization deploys containerized workloads in Kubernetes environments, you will be faced with many
+configuration choices related to images, containers, control plane, and data plane. Setting these configurations
+improperly creates a high-impact security and compliance risk. DevOps, and platform owners need the ability to
+continuously assess build artifacts, workloads, and infrastructure against configuration hardening standards to
+remediate any violations.
+
+trivy-operator configuration audit capabilities are purpose-built for Kubernetes environments. In particular, trivy
+Operator continuously checks images, workloads, and Kubernetes infrastructure components against common configurations
+security standards and generates detailed assessment reports, which are then stored in the default Kubernetes database.
+
+Kubernetes applications and other core configuration objects, such as Ingress, NetworkPolicy and ResourceQuota resources, are evaluated against [Built-in Policies]. 
+Additionally, application and infrastructure owners can integrate these reports into incident response workflows for
+active remediation.
+
+[Built-in Policies]: ./built-in-policies.md
+

docs/docs/kubernetes/operator/configuration.md

@@ -0,0 +1,100 @@
+# Configuration
+
+You can configure Trivy-Operator to control it's behavior and adapt it to your needs. Aspects of the operator machinery are configured using environment variables on the operator Pod, while aspects of the scanning behavior are controlled by ConfigMaps and Secrets.
+
+# Operator Configuration
+
+| NAME| DEFAULT| DESCRIPTION|
+|---|---|---|
+| `OPERATOR_NAMESPACE`| N/A| See [Install modes](#install-modes)|
+| `OPERATOR_TARGET_NAMESPACES`| N/A| See [Install modes](#install-modes)|
+| `OPERATOR_EXCLUDE_NAMESPACES`| N/A| A comma separated list of namespaces (or glob patterns) to be excluded from scanning in all namespaces [Install mode](#install-modes).|
+| `OPERATOR_SERVICE_ACCOUNT`| `trivy-operator`| The name of the service account assigned to the operator's pod|
+| `OPERATOR_LOG_DEV_MODE`| `false`| The flag to use (or not use) development mode (more human-readable output, extra stack traces and logging information, etc).|
+| `OPERATOR_SCAN_JOB_TIMEOUT`| `5m`| The length of time to wait before giving up on a scan job|
+| `OPERATOR_CONCURRENT_SCAN_JOBS_LIMIT`| `10`| The maximum number of scan jobs create by the operator|
+| `OPERATOR_SCAN_JOB_RETRY_AFTER`| `30s`| The duration to wait before retrying a failed scan job|
+| `OPERATOR_BATCH_DELETE_LIMIT`| `10`| The maximum number of config audit reports deleted by the operator when the plugin's config has changed.|
+| `OPERATOR_BATCH_DELETE_DELAY`| `10s`| The duration to wait before deleting another batch of config audit reports.|
+| `OPERATOR_METRICS_BIND_ADDRESS`| `:8080`| The TCP address to bind to for serving [Prometheus][prometheus] metrics. It can be set to `0` to disable the metrics serving.|
+| `OPERATOR_HEALTH_PROBE_BIND_ADDRESS`| `:9090`| The TCP address to bind to for serving health probes, i.e. `/healthz/` and `/readyz/` endpoints.|
+| `OPERATOR_VULNERABILITY_SCANNER_ENABLED`| `true`| The flag to enable vulnerability scanner|
+| `OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED`| `false`| The flag to enable configuration audit scanner|
+| `OPERATOR_CONFIG_AUDIT_SCANNER_SCAN_ONLY_CURRENT_REVISIONS`| `false`| The flag to enable config audit scanner to only scan the current revision of a deployment|
+| `OPERATOR_CONFIG_AUDIT_SCANNER_BUILTIN`| `true`| The flag to enable built-in configuration audit scanner|
+| `OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS`| `false`| The flag to enable vulnerability scanner to only scan the current revision of a deployment|
+| `OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL`| `""`| The flag to set how long a vulnerability report should exist. When a old report is deleted a new one will be created by the controller. It can be set to `""` to disabled the TTL for vulnerability scanner. |
+| `OPERATOR_LEADER_ELECTION_ENABLED`| `false`| The flag to enable operator replica leader election|
+| `OPERATOR_LEADER_ELECTION_ID`| `trivy-operator-lock`| The name of the resource lock for leader election|
+
+The values of the `OPERATOR_NAMESPACE` and `OPERATOR_TARGET_NAMESPACES` determine the install mode, which in turn determines the multitenancy support of the operator.
+
+| MODE| OPERATOR_NAMESPACE | OPERATOR_TARGET_NAMESPACES | DESCRIPTION|
+|---|---|---|---|
+| OwnNamespace| `operators`| `operators`| The operator can be configured to watch events in the namespace it is deployed in.                             |
+| SingleNamespace| `operators`| `foo`| The operator can be configured to watch for events in a single namespace that the operator is not deployed in. |
+| MultiNamespace| `operators`| `foo,bar,baz`| The operator can be configured to watch for events in more than one namespace.                                 |
+| AllNamespaces| `operators`| (blank string)| The operator can be configured to watch for events in all namespaces.|
+
+## Example - configure namespaces to scan
+
+To change the target namespace from all namespaces to the `default` namespace edit the `trivy-operator` Deployment and change the value of the `OPERATOR_TARGET_NAMESPACES` environment variable from the blank string (`""`) to the `default` value.
+
+# Scanning configuration
+
+| CONFIGMAP KEY| DEFAULT| DESCRIPTION|
+|---|---|---|
+| `vulnerabilityReports.scanner`| `Trivy`| The name of the plugin that generates vulnerability reports. Either `Trivy` or `Aqua`.|
+| `vulnerabilityReports.scanJobsInSameNamespace` | `"false"`| Whether to run vulnerability scan jobs in same namespace of workload. Set `"true"` to enable.|
+| `scanJob.tolerations`| N/A| JSON representation of the [tolerations] to be applied to the scanner pods so that they can run on nodes with matching taints. Example: `'[{"key":"key1", "operator":"Equal", "value":"value1", "effect":"NoSchedule"}]'`|
+| `scanJob.annotations`| N/A| One-line comma-separated representation of the annotations which the user wants the scanner pods to be annotated with. Example: `foo=bar,env=stage` will annotate the scanner pods with the annotations `foo: bar` and `env: stage` |
+| `scanJob.templateLabel`| N/A| One-line comma-separated representation of the template labels which the user wants the scanner pods to be labeled with. Example: `foo=bar,env=stage` will labeled the scanner pods with the labels `foo: bar` and `env: stage`|
+
+## Example - patch ConfigMap
+
+By default Trivy displays vulnerabilities with all severity levels (`UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). To display only `HIGH` and `CRITICAL` vulnerabilities by patching the `trivy.severity` value in the `trivy-operator-trivy-config` ConfigMap:
+
+```bash
+kubectl patch cm trivy-operator-trivy-config -n trivy-operator \
+  --type merge \
+  -p "$(cat <<EOF
+{
+  "data": {
+    "trivy.severity": "HIGH,CRITICAL"
+  }
+}
+EOF
+)"
+```
+
+## Example - patch Secret
+
+To set the GitHub token used by Trivy scanner add the `trivy.githubToken` value to the `trivy-operator-trivy-config` Secret:
+
+```bash
+kubectl patch secret trivy-operator-trivy-config -n trivy-operator \
+  --type merge \
+  -p "$(cat <<EOF
+{
+  "data": {
+    "trivy.githubToken": "$(echo -n <your token> | base64)"
+  }
+}
+EOF
+)"
+```
+
+## Example - delete a key
+
+The following `kubectl patch` command deletes the `trivy.httpProxy` key:
+
+```bash
+kubectl patch cm trivy-operator-trivy-config -n trivy-operator \
+  --type json \
+  -p '[{"op": "remove", "path": "/data/trivy.httpProxy"}]'
+```
+
+[tolerations]: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration
+
+
+[prometheus]: https://github.com/prometheus

docs/docs/kubernetes/operator/getting-started.md

@@ -0,0 +1,202 @@
+# Getting Started
+
+## Before you Begin
+
+You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your
+cluster. If you do not already have a cluster, you can create one by installing [minikube] or [kind], or you can use one
+of these Kubernetes playgrounds:
+
+* [Katacoda]
+* [Play with Kubernetes]
+
+You also need the Trivy-Operator to be installed in the `trivy-system` namespace, e.g. with
+[kubectl](./installation/kubectl.md) or [Helm](./installation/helm.md). Let's also assume that the operator is
+configured to discover built-in Kubernetes resources in all namespaces, except `kube-system` and `trivy-system`.
+
+## Workloads Scanning
+
+Let's create the `nginx` Deployment that we know is vulnerable:
+
+```
+kubectl create deployment nginx --image nginx:1.16
+```
+
+When the `nginx` Deployment is created, the operator immediately detects its current revision (aka active ReplicaSet)
+and scans the `nginx:1.16` image for vulnerabilities. It also audits the ReplicaSet's specification for common pitfalls
+such as running the `nginx` container as root.
+
+If everything goes fine, the operator saves scan reports as VulnerabilityReport and ConfigAuditReport resources in the
+`default` namespace. Reports are named after the scanned ReplicaSet. For image vulnerability scans, the operator creates
+a VulnerabilityReport for each different container. In this example there is just one container image called `nginx`:
+
+```
+kubectl get vulnerabilityreports -o wide
+```
+<details>
+<summary>Result</summary>
+
+```
+NAME                                REPOSITORY      TAG    SCANNER   AGE   CRITICAL   HIGH   MEDIUM   LOW   UNKNOWN
+replicaset-nginx-78449c65d4-nginx   library/nginx   1.16   Trivy     85s   33         62     49       114   1
+```
+</details>
+
+```
+kubectl get configauditreports -o wide
+```
+<details>
+<summary>Result</summary>
+
+```
+NAME                          SCANNER     AGE    CRITICAL  HIGH   MEDIUM   LOW
+replicaset-nginx-78449c65d4   Trivy-Operator   2m7s   0         0      6        7
+```
+</details>
+
+Notice that scan reports generated by the operator are controlled by Kubernetes workloads. In our example,
+VulnerabilityReport and ConfigAuditReport resources are controlled by the active ReplicaSet of the `nginx` Deployment:
+
+```console
+kubectl tree deploy nginx
+```
+
+<details>
+<summary>Result</summary>
+
+```
+NAMESPACE  NAME                                                       READY  REASON  AGE
+default    Deployment/nginx                                           -              7h2m
+default    └─ReplicaSet/nginx-78449c65d4                              -              7h2m
+default      ├─ConfigAuditReport/replicaset-nginx-78449c65d4          -              2m31s
+default      ├─Pod/nginx-78449c65d4-5wvdx                             True           7h2m
+default      └─VulnerabilityReport/replicaset-nginx-78449c65d4-nginx  -              2m7s
+```
+</details>
+
+!!! note
+    The [tree] command is a kubectl plugin to browse Kubernetes object hierarchies as a tree.
+
+Moving forward, let's update the container image of the `nginx` Deployment from `nginx:1.16` to `nginx:1.17`. This will
+trigger a rolling update of the Deployment and eventually create another ReplicaSet.
+
+```
+kubectl set image deployment nginx nginx=nginx:1.17
+```
+
+Even this time the operator will pick up changes and rescan our Deployment with updated configuration:
+
+```
+kubectl tree deploy nginx
+```
+
+<details>
+<summary>Result</summary>
+
+```
+NAMESPACE  NAME                                                       READY  REASON  AGE
+default    Deployment/nginx                                           -              7h5m
+default    ├─ReplicaSet/nginx-5fbc65fff                               -              2m36s
+default    │ ├─ConfigAuditReport/replicaset-nginx-5fbc65fff           -              2m36s
+default    │ ├─Pod/nginx-5fbc65fff-j7zl2                              True           2m36s
+default    │ └─VulnerabilityReport/replicaset-nginx-5fbc65fff-nginx   -              2m22s
+default    └─ReplicaSet/nginx-78449c65d4                              -              7h5m
+default      ├─ConfigAuditReport/replicaset-nginx-78449c65d4          -              5m46s
+default      └─VulnerabilityReport/replicaset-nginx-78449c65d4-nginx  -              5m22s
+```
+</details>
+
+By following this guide you could realize that the operator knows how to attach VulnerabilityReport and
+ConfigAuditReport resources to build-in Kubernetes objects. What's more, in this approach where a custom resource
+inherits a life cycle of the built-in resource we could leverage Kubernetes garbage collection. For example, when the
+previous ReplicaSet named `nginx-78449c65d4` is deleted the VulnerabilityReport named `replicaset-nginx-78449c65d4-nginx`
+as well as the ConfigAuditReport named `replicaset-nginx-78449c65d46` are automatically garbage collected.
+
+!!! tip
+    If you only want the latest ReplicaSet in your Deployment to be scanned for vulnerabilities, you can set the value
+    of the `OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS` environment variable to `true` in the operator's
+    deployment descriptor. This is useful to identify vulnerabilities that impact only the running workloads.
+
+!!! tip
+    If you only want the latest ReplicaSet in your Deployment to be scanned for config audit, you can set the value
+    of the `OPERATOR_CONFIG_AUDIT_SCANNER_SCAN_ONLY_CURRENT_REVISIONS` environment variable to `true` in the operator's
+    deployment descriptor. This is useful to identify config issues that impact only the running workloads.
+
+!!! tip
+    You can get and describe `vulnerabilityreports` and `configauditreports` as built-in Kubernetes objects:
+    ```
+    kubectl get vulnerabilityreport replicaset-nginx-5fbc65fff-nginx -o json
+    kubectl describe configauditreport replicaset-nginx-5fbc65fff
+    ```
+
+Notice that scaling up the `nginx` Deployment will not schedule new scans because all replica Pods refer to the same Pod
+template defined by the `nginx-5fbc65fff` ReplicaSet.
+
+```
+kubectl scale deploy nginx --replicas 3
+```
+
+```
+kubectl tree deploy nginx
+```
+
+<details>
+<summary>Result</summary>
+
+```
+NAMESPACE  NAME                                                       READY  REASON  AGE
+default    Deployment/nginx                                           -              7h6m
+default    ├─ReplicaSet/nginx-5fbc65fff                               -              4m7s
+default    │ ├─ConfigAuditReport/replicaset-nginx-5fbc65fff           -              4m7s
+default    │ ├─Pod/nginx-5fbc65fff-458n7                              True           8s
+default    │ ├─Pod/nginx-5fbc65fff-fk847                              True           8s
+default    │ ├─Pod/nginx-5fbc65fff-j7zl2                              True           4m7s
+default    │ └─VulnerabilityReport/replicaset-nginx-5fbc65fff-nginx   -              3m53s
+default    └─ReplicaSet/nginx-78449c65d4                              -              7h6m
+default      ├─ConfigAuditReport/replicaset-nginx-78449c65d4          -              7m17s
+default      └─VulnerabilityReport/replicaset-nginx-78449c65d4-nginx  -              6m53s
+```
+</details>
+
+Finally, when you delete the `nginx` Deployment, orphaned security reports will be deleted in the background by the
+Kubernetes garbage collection controller.
+
+```
+kubectl delete deploy nginx
+```
+
+```console
+kubectl get vuln,configaudit
+```
+
+<details>
+<summary>Result</summary>
+
+```
+No resources found in default namespace.
+```
+</details>
+
+!!! Tip
+    Use `vuln` and `configaudit` as short names for `vulnerabilityreports` and `configauditreports` resources.
+
+!!! Note
+    You can define the validity period for VulnerabilityReports by setting the duration as the value of the
+    `OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL` environment variable. For example, setting the value to `24h`
+    would delete reports after 24 hours. When a VulnerabilityReport gets deleted Trivy-Operator will automatically
+
+
+
+## What's Next?
+
+- Find out how the operator scans workloads that use container images from [Private Registries].
+- By default, the operator uses Trivy as [Vulnerability Scanner] and Polaris as [Configuration Checker], but you can
+  choose other tools that are integrated with Trivy-Operator or even implement you own plugin.
+
+[minikube]: https://minikube.sigs.k8s.io/docs/
+[kind]: https://kind.sigs.k8s.io/docs/
+[Katacoda]: https://www.katacoda.com/courses/kubernetes/playground/
+[Play with Kubernetes]: http://labs.play-with-k8s.com/
+[tree]: https://github.com/ahmetb/kubectl-tree
+[Private Registries]: ./../vulnerability-scanning/private-registries.md
+[Vulnerability Scanner]: ./../vulnerability-scanning/index.md
+[Configuration Checker]: ./../configuration-auditing/index.md

docs/docs/kubernetes/operator/images/trivy-operator-icon-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 22"><path d="M19.90856,11.37359l-.94046,1.16318.04433.42088a.66075.66075,0,0,1,.00653.25385l-.00778.04071a.66193.66193,0,0,1-.08906.21314c-.01313.01986-.027.03932-.0384.0537l-4.57928,5.69351a.70189.70189,0,0,1-.53066.25266l-7.34439-.00171a.70458.70458,0,0,1-.52974-.25154L1.32209,13.51754a.64957.64957,0,0,1-.096-.16658.71032.71032,0,0,1-.02863-.08952.66205.66205,0,0,1-.00515-.30511l1.6348-7.10077a.66883.66883,0,0,1,.1355-.274.65915.65915,0,0,1,.22568-.17666L9.80881,2.24386a.69063.69063,0,0,1,.29475-.0667l.00515.0002.03424.00112a.68668.68668,0,0,1,.25649.06544l6.61569,3.161a.66765.66765,0,0,1,.21678.165.675.675,0,0,1,.14909.29139l.60521,2.64815,1.1606-.20569-.61853-2.70614a1.85372,1.85372,0,0,0-1.00544-1.25474l-6.616-3.16113a1.84812,1.84812,0,0,0-.67883-.17726l-.03061-.00218c-.02692-.00125-.05416-.00152-.05851-.00152L10.10146,1a1.87317,1.87317,0,0,0-.80022.18175l-6.62038,3.161a1.83083,1.83083,0,0,0-.62572.48916,1.84956,1.84956,0,0,0-.37523.75964L.04518,12.69226a1.84474,1.84474,0,0,0,.00956.8516,1.88289,1.88289,0,0,0,.07772.24244,1.826,1.826,0,0,0,.27219.46878L4.98281,19.9503a1.8815,1.8815,0,0,0,1.4473.6903l7.34394.00172a1.87874,1.87874,0,0,0,1.4475-.69182l4.58278-5.698c.03609-.04578.07026-.093.10252-.14243a1.82018,1.82018,0,0,0,.25207-.59695c.00805-.03517.01484-.07079.021-.10773a1.8273,1.8273,0,0,0-.02032-.71135Z" style="fill:#fff"/><polygon points="9.436 4.863 9.332 11.183 12.92 10.115 9.436 4.863" style="fill:#fff"/><polygon points="7.913 11.605 8.265 11.5 8.617 11.395 8.629 11.392 8.74 4.605 8.753 3.838 8.384 4.915 8.015 5.994 5.964 11.986 6.684 11.971 7.913 11.605" style="fill:#fff"/><polygon points="5.738 13.279 5.888 12.956 6.014 12.685 5.723 12.691 5.352 12.699 5.06 12.705 1.918 12.771 4.498 15.952 5.588 13.603 5.738 13.279" style="fill:#fff"/><polygon points="14.026 10.516 13.675 10.621 13.324 10.725 9.32 11.917 8.969 12.021 8.617 12.126 8.604 12.13 8.252 12.235 7.9 12.339 7.593 12.431 7.894 12.688 8.238 12.982 8.583 13.277 8.598 13.289 8.943 13.584 9.288 13.879 9.61 14.154 9.896 14.398 10.183 14.643 14.064 17.958 22 8.143 14.026 10.516" style="fill:#fff"/><polygon points="9.273 14.787 9.229 14.749 8.943 14.505 8.928 14.492 8.583 14.197 8.567 14.183 8.222 13.889 7.877 13.594 7.362 13.154 7.086 12.919 6.81 12.683 6.794 12.669 6.641 12.998 6.488 13.328 6.468 13.371 6.318 13.694 6.168 14.017 4.989 16.557 4.989 16.558 4.99 16.558 4.992 16.559 5.341 16.638 5.691 16.716 12.164 18.175 12.895 18.339 13.625 18.504 9.516 14.994 9.273 14.787" style="fill:#fff"/></svg>

docs/docs/kubernetes/operator/index.md

@@ -0,0 +1,15 @@
+# Trivy Operator 
+
+Trivy has a native [Kubernetes Operator](operator) which continuously scans your Kubernetes cluster for security issues, and generates security reports as Kubernetes [Custom Resources](crd). It does it by watching Kubernetes for state changes and automatically triggering scans in response to changes, for example initiating a vulnerability scan when a new Pod is created.
+
+> Trivy Operator is based on existing Aqua OSS project - [Starboard], and shares some of the design, principles and code with it. Existing content that relates to Starboard Operator might also be relevant for Trivy Operator. To learn more about the transition from Starboard from Trivy, see the [announcement discussion](starboard-announcement).
+
+<figure>
+  <img src="./images/operator/trivy-operator-workloads.png" />
+  <figcaption>Workload reconcilers discover K8s controllers, manage scan jobs, and create VulnerabilityReport and ConfigAuditReport objects.</figcaption>
+</figure>
+
+[operator]: https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
+[crd]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/
+[Starboard]: https://github.com/aquasecurity/starboard
+[starboard-announcement]: https://github.com/aquasecurity/starboard/discussions/1173

docs/docs/kubernetes/operator/installation/helm.md

@@ -0,0 +1,90 @@
+# Helm
+
+[Helm], which is a popular package manager for Kubernetes, allows installing applications from parameterized
+YAML manifests called Helm [charts].
+
+The Helm chart is available on GitHub in [https://github.com/aquasecurity/trivy-operator](https://github.com/aquasecurity/trivy-operator) under `/deploy/helm` and is also hosted in a Chart repository for your convenience under [https://aquasecurity.github.io/helm-charts/](https://aquasecurity.github.io/helm-charts/).
+
+## Example - Chart repository
+
+This will install the operator in the `trivy-system` namespace and configure it to scan all namespaces, except `kube-system` and `trivy-system`:
+
+```bash
+helm repo add aqua https://aquasecurity.github.io/helm-charts/
+helm repo update
+helm install trivy-operator aqua/trivy-operator \
+   --namespace trivy-system \
+   --create-namespace \
+   --set="trivy.ignoreUnfixed=true" \
+   --version {{ var.operator_version }}
+```
+
+## Example - Download the chart
+
+This will install the operator in the `trivy-system` namespace and configure it to scan all namespaces, except `kube-system` and `trivy-system`:
+
+```bash
+git clone --depth 1 --branch {{ var.operator_version }} https://github.com/aquasecurity/trivy-operator.git
+cd trivy-operator
+helm install trivy-operator ./deploy/helm \
+--namespace trivy-system \
+--create-namespace \
+--set="trivy.ignoreUnfixed=true"
+```
+
+## Post install sanity check
+
+Check that the `trivy-operator` Helm release is created in the `trivy-system` namespace, and it has status `deployed`:
+
+```console
+$ helm list -n trivy-system
+NAME              	NAMESPACE         	REVISION	UPDATED                             	STATUS  	CHART                   	APP VERSION
+trivy-operator	trivy-system	1       	2021-01-27 20:09:53.158961 +0100 CET	deployed	trivy-operator-{{ var.operator_version }}	{{  var.operator_version[1:] }}
+```
+
+To confirm that the operator is running, check that the `trivy-operator` Deployment in the `trivy-system`
+namespace is available and all its containers are ready:
+
+```console
+$ kubectl get deployment -n trivy-system
+NAME                 READY   UP-TO-DATE   AVAILABLE   AGE
+trivy-operator   1/1     1            1           11m
+```
+
+If for some reason it's not ready yet, check the logs of the Deployment for errors:
+
+```
+kubectl logs deployment/trivy-operator -n trivy-system
+```
+
+## Advanced Configuration
+
+The Helm chart supports all available [installation modes](./../configuration.md#install-modes) of Trivy Operator. 
+
+Please refer to the chart's [values] file for configuration options.
+
+## Uninstall
+
+You can uninstall the operator with the following command:
+
+```
+helm uninstall trivy-operator -n trivy-system
+```
+
+You have to manually delete custom resource definitions created by the `helm install` command:
+
+!!! danger
+    Deleting custom resource definitions will also delete all security reports generated by the operator.
+
+    ```
+    kubectl delete crd vulnerabilityreports.aquasecurity.github.io
+    kubectl delete crd clustervulnerabilityreports.aquasecurity.github.io
+    kubectl delete crd configauditreports.aquasecurity.github.io
+    kubectl delete crd clusterconfigauditreports.aquasecurity.github.io
+    kubectl delete crd clustercompliancereports.aquasecurity.github.io
+    kubectl delete crd clustercompliancedetailreports.aquasecurity.github.io
+    ```
+
+[Helm]: https://helm.sh/
+[charts]: https://helm.sh/docs/topics/charts/
+[values]: https://raw.githubusercontent.com/aquasecurity/trivy-operator/{{  var.operator_version }}/deploy/helm/values.yaml

docs/docs/kubernetes/operator/installation/kubectl.md

@@ -0,0 +1,45 @@
+# kubectl
+
+Kubernetes Yaml deployment files are available on GitHub in [https://github.com/aquasecurity/trivy-operator](https://github.com/aquasecurity/trivy-operator) under `/deploy/static`.
+
+## Example - Deploy from GitHub
+
+This will install the operator in the `trivy-system` namespace and configure it to scan all namespaces, except `kube-system` and `trivy-system`:
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/aquasecurity/trivy-operator/{{ var.operator_version }}/deploy/static/trivy-operator.yaml
+```
+
+To confirm that the operator is running, check that the `trivy-operator` Deployment in the `trivy-system`
+namespace is available and all its containers are ready:
+
+```bash
+$ kubectl get deployment -n trivy-system
+NAME                 READY   UP-TO-DATE   AVAILABLE   AGE
+trivy-operator   1/1     1            1           11m
+```
+
+If for some reason it's not ready yet, check the logs of the `trivy-operator` Deployment for errors:
+
+```bash
+kubectl logs deployment/trivy-operator -n trivy-system
+```
+
+## Advanced Configuration
+
+You can configure Trivy-Operator to control it's behavior and adapt it to your needs. Aspects of the operator machinery are configured using environment variables on the operator Pod, while aspects of the scanning behavior are controlled by ConfigMaps and Secrets.
+To learn more, please refer to the [Configuration](config) documentation.
+
+## Uninstall
+
+!!! danger
+    Uninstalling the operator and deleting custom resource definitions will also delete all generated security reports.
+
+You can uninstall the operator with the following command:
+
+```
+kubectl delete -f https://raw.githubusercontent.com/aquasecurity/trivy-operator/{{  var.operator_version }}/deploy/static/trivy-operator.yaml
+```
+
+[Settings]: ./../../settings.md
+[Helm]: ./helm.md

docs/docs/kubernetes/operator/installation/upgrade.md

@@ -0,0 +1,10 @@
+# Upgrade
+
+We recommend that you upgrade Trivy Operator often to stay up to date with the latest fixes and enhancements.
+
+However, at this stage we do not provide automated upgrades. Therefore, uninstall the previous version of the operator
+before you install the latest release.
+
+!!! warning
+    Consult release notes and changelog to revisit and migrate configuration settings which may not be compatible
+    between different versions.

docs/docs/kubernetes/operator/troubleshooting.md

@@ -0,0 +1,106 @@
+# Troubleshooting the Trivy Operator
+
+The Trivy Operator installs several Kubernetes resources into your Kubernetes cluster.
+
+Here are the common steps to check whether the operator is running correctly and to troubleshoot common issues.
+
+So in addition to this section, you might want to check [issues](https://github.com/aquasecurity/trivy/issues), [discussion forum](https://github.com/aquasecurity/trivy/discussions), or [Slack](https://slack.aquasec.com) to see if someone from the community had similar problems before.
+
+Also note that Trivy Operator is based on existing Aqua OSS project - [Starboard], and shares some of the design, principles and code with it. Existing content that relates to Starboard Operator might also be relevant for Trivy Operator, and Starboard's [issues](https://github.com/aquasecurity/starboard/issues), [discussion forum](https://github.com/aquasecurity/starboard/discussions), or [Slack](https://slack.aquasec.com) might also be interesting to check.  
+In some cases you might want to refer to [Starboard's Design documents](https://aquasecurity.github.io/starboard/latest/design/)
+
+## Installation
+
+Make sure that the latest version of the Trivy Operator is installed. For this, have a look at the installation [options.](./installation/helm.md)
+
+For instance, if your are using the Helm deployment, you need to check the Helm Chart version deployed to your cluster. You can check the Helm Chart version with the following command:
+```
+helm list -n trivy-operator
+```
+
+## Operator Pod Not Running
+
+The Trivy Operator will run a pod inside your cluster. If you have followed the installation guide, you will have installed the Operator to the `trivy-system`.
+
+Make sure that the pod is in the `Running` status:
+```
+kubectl get pods -n trivy-operator
+```
+
+This is how it will look if it is running okay:
+
+```
+NAMESPACE            NAME                                         READY   STATUS    RESTARTS      AGE
+trivy-operator     trivy-operator-6c9bd97d58-hsz4g          1/1     Running   5 (19m ago)   30h
+```
+
+If the pod is in `Failed`, `Pending`, or `Unknown` check the events and the logs of the pod.
+
+First, check the events, since they might be more descriptive of the problem. However, if the events do not give a clear reason why the pod cannot spin up, then you want to check the logs, which provide more detail.
+
+```
+kubectl describe pod <POD-NAME> -n trivy-system
+```
+
+To check the logs, use the following command:
+```
+kubectl logs deployment/trivy-operator -n trivy-system
+```
+
+If your pod is not running, try to look for errors as they can give an indication on the problem.
+
+If there are too many logs messages, try deleting the Trivy pod and observe its behavior upon restarting. A new pod should spin up automatically after deleting the failed pod.
+
+## ImagePullBackOff or ErrImagePull
+
+Check the status of the Trivy Operator pod running inside of your Kubernetes cluster. If the Status is ImagePullBackOff or ErrImagePull, it means that the Operator either
+
+* tries to access the wrong image
+* cannot pull the image from the registry
+
+Make sure that you are providing the right resources upon installing the Trivy Operator.
+
+## CrashLoopBackOff
+
+If your pod is in `CrashLoopBackOff`, it is likely the case that the pod cannot be scheduled on the Kubernetes node that it is trying to schedule on.
+In this case, you want to investigate further whether there is an issue with the node. It could for instance be the case that the node does not have sufficient resources.
+
+## Reconcilation Error
+
+It could happen that the pod appears to be running normally but does not reconcile the resources inside of your Kubernetes cluster.
+
+Check the logs for reconcilation errors:
+```
+kubectl logs deployment/trivy-operator -n trivy-system
+```
+
+If this is the case, the Trivy Operator likely does not have the right configurations to access your resource. 
+
+## Operator does not Create VulnerabilityReports
+
+VulnerabilityReports are owned and controlled by the immediate Kubernetes workload. Every VulnerabilityReport of a pod is thus, linked to a [ReplicaSet.](./index.md) In case the Trivy Operator does not create a VulnerabilityReport for your workloads, it could be that it is not monitoring the namespace that your workloads are running on.
+
+An easy way to check this is by looking for the `ClusterRoleBinding` for the Trivy Operator:
+
+```
+kubectl get ClusterRoleBinding | grep "trivy-operator"
+```
+
+Alternatively, you could use the `kubectl-who-can` [plugin by Aqua](https://github.com/aquasecurity/kubectl-who-can):
+
+```console
+$ kubectl who-can list vulnerabilityreports
+No subjects found with permissions to list vulnerabilityreports assigned through RoleBindings
+
+CLUSTERROLEBINDING                           SUBJECT                         TYPE            SA-NAMESPACE
+cluster-admin                                system:masters                  Group
+trivy-operator                           trivy-operator              ServiceAccount  trivy-system
+system:controller:generic-garbage-collector  generic-garbage-collector       ServiceAccount  kube-system
+system:controller:namespace-controller       namespace-controller            ServiceAccount  kube-system
+system:controller:resourcequota-controller   resourcequota-controller        ServiceAccount  kube-system
+system:kube-controller-manager               system:kube-controller-manager  User
+```
+
+If the `ClusterRoleBinding` does not exist, Trivy currently cannot monitor any namespace outside of the `trivy-system` namespace. 
+
+For instance, if you are using the [Helm Chart](./installation/helm.md), you want to make sure to set the `targetNamespace` to the namespace that you want the Operator to monitor.

docs/docs/kubernetes/operator/vulnerability-scanning/configuration.md

@@ -0,0 +1,109 @@
+# Vulnerability Scanning Configuration
+
+## Standalone
+
+The default configuration settings enable Trivy `vulnerabilityReports.scanner` in [`Standalone`][trivy-standalone]
+`trivy.mode`. Even though it doesn't require any additional setup, it's the least efficient method. Each Pod created
+by a scan Job has the init container that downloads the Trivy vulnerabilities database from the GitHub releases page
+and stores it in the local file system of the [emptyDir volume]. This volume is then shared with containers that perform
+the actual scanning. Finally, the Pod is deleted along with the emptyDir volume.
+
+![](./../images/design/trivy-standalone.png)
+
+The number of containers defined by a scan Job equals the number of containers defined by the scanned Kubernetes
+workload, so the cache in this mode is useful only if the workload defines multiple containers.
+
+Beyond that, frequent downloads from GitHub might lead to a [rate limiting] problem. The limits are imposed by GitHub on
+all anonymous requests originating from a given IP. To mitigate such problems you can add the `trivy.githubToken` key to
+the `trivy-operator` secret.
+
+```bash
+
+kubectl patch secret trivy-operator-trivy-config -n trivy-operator \
+  --type merge \
+  -p "$(cat <<EOF
+{
+  "data": {
+    "trivy.githubToken": "$(echo -n <GITHUB_TOKEN> | base64)"
+  }
+}
+EOF
+)"
+```
+
+## ClientServer
+
+You can connect Trivy to an external Trivy server by changing the default `trivy.mode` from
+[`Standalone`][trivy-standalone] to [`ClientServer`][trivy-clientserver] and specifying `trivy.serverURL`.
+
+```bash
+kubectl patch cm trivy-operator-trivy-config -n trivy-operator \
+  --type merge \
+  -p "$(cat <<EOF
+{
+  "data": {
+    "trivy.mode":      "ClientServer",
+    "trivy.serverURL": "<TRIVY_SERVER_URL>"
+  }
+}
+EOF
+)"
+```
+
+The Trivy server could be your own deployment, or it could be an external service. See [Trivy server][trivy-clientserver] documentation for more information.
+
+If the server requires access token and/or custom HTTP authentication headers, you may add `trivy.serverToken` and `trivy.serverCustomHeaders` properties to the Trivy Operator secret.
+
+```bash
+kubectl patch secret trivy-operator-trivy-config -n trivy-operator \
+  --type merge \
+  -p "$(cat <<EOF
+{
+  "data": {
+    "trivy.serverToken":         "$(echo -n <SERVER_TOKEN> | base64)",
+    "trivy.serverCustomHeaders": "$(echo -n x-api-token:<X_API_TOKEN> | base64)"
+  }
+}
+EOF
+)"
+```
+
+![](./../images/design/trivy-clientserver.png)
+
+## Settings
+
+| CONFIGMAP KEY| DEFAULT| DESCRIPTION|
+|---|---|---|
+| `trivy.imageRef`| `docker.io/aquasec/trivy:0.25.2`| Trivy image reference|
+| `trivy.dbRepository`| `ghcr.io/aquasecurity/trivy-db`| External OCI Registry to download the vulnerability database|
+| `trivy.mode`| `Standalone`| Trivy client mode. Either `Standalone` or `ClientServer`. Depending on the active mode other settings might be applicable or required.                              |
+| `trivy.severity`| `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | A comma separated list of severity levels reported by Trivy|
+| `trivy.ignoreUnfixed`| N/A| Whether to show only fixed vulnerabilities in vulnerabilities reported by Trivy. Set to `"true"` to enable it.|
+| `trivy.skipFiles`| N/A| A comma separated list of file paths for Trivy to skip traversal.|
+| `trivy.skipDirs`| N/A| A comma separated list of directories for Trivy to skip traversal.|
+| `trivy.ignoreFile`| N/A| It specifies the `.trivyignore` file which contains a list of vulnerability IDs to be ignored from vulnerabilities reported by Trivy.|
+| `trivy.timeout`| `5m0s`| The duration to wait for scan completion|
+| `trivy.serverURL`| N/A| The endpoint URL of the Trivy server. Required in `ClientServer` mode.|
+| `trivy.serverTokenHeader`| `Trivy-Token`| The name of the HTTP header to send the authentication token to Trivy server. Only application in `ClientServer` mode when `trivy.serverToken` is specified.|
+| `trivy.serverInsecure`| N/A| The Flag to enable insecure connection to the Trivy server.|
+| `trivy.insecureRegistry.<id>`| N/A| The registry to which insecure connections are allowed. There can be multiple registries with different registry `<id>`.|
+| `trivy.nonSslRegistry.<id>`| N/A| A registry without SSL. There can be multiple registries with different registry `<id>`.|
+| `trivy.registry.mirror.<registry>` | N/A| Mirror for the registry `<registry>`, e.g. `trivy.registry.mirror.index.docker.io: mirror.io` would use `mirror.io` to get images originated from `index.docker.io` |
+| `trivy.httpProxy`| N/A| The HTTP proxy used by Trivy to download the vulnerabilities database from GitHub.|
+| `trivy.httpsProxy`| N/A| The HTTPS proxy used by Trivy to download the vulnerabilities database from GitHub.|
+| `trivy.noProxy`| N/A| A comma separated list of IPs and domain names that are not subject to proxy settings.|
+| `trivy.resources.requests.cpu`| `100m`| The minimum amount of CPU required to run Trivy scanner pod.|
+| `trivy.resources.requests.memory`| `100M`| The minimum amount of memory required to run Trivy scanner pod.|
+| `trivy.resources.limits.cpu`| `500m`| The maximum amount of CPU allowed to run Trivy scanner pod.|
+| `trivy.resources.limits.memory`| `500M`| The maximum amount of memory allowed to run Trivy scanner pod.|
+
+| SECRET KEY| DESCRIPTION|
+|---|---|
+| `trivy.githubToken`| The GitHub access token used by Trivy to download the vulnerabilities database from GitHub. Only applicable in `Standalone` mode. |
+| `trivy.serverToken`| The token to authenticate Trivy client with Trivy server. Only applicable in `ClientServer` mode.|
+| `trivy.serverCustomHeaders`| A comma separated list of custom HTTP headers sent by Trivy client to Trivy server. Only applicable in `ClientServer` mode.|
+
+[trivy-standalone]: https://aquasecurity.github.io/trivy/latest/modes/standalone/
+[emptyDir volume]: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir
+[rate limiting]: https://docs.github.com/en/free-pro-team@latest/rest/overview/resources-in-the-rest-api#rate-limiting
+[trivy-clientserver]: https://aquasecurity.github.io/trivy/latest/advanced/modes/client-server/

docs/docs/kubernetes/operator/vulnerability-scanning/faq.md

@@ -0,0 +1,29 @@
+# Frequently Asked Questions
+
+## Why do you duplicate instances of VulnerabilityReports for the same image digest?
+
+Docker image reference is not a first class citizen in Kubernetes. It's a
+property of the container definition. Trivy-operator relies on label selectors to
+associate VulnerabilityReports with corresponding Kubernetes workloads, not
+particular image references. For example, we can get all reports for the
+wordpress Deployment with the following command:
+
+```text
+kubectl get vulnerabilityreports \
+  -l trivy-operator.resource.kind=Deployment \
+  -l trivy-operator.resource.name=wordpress
+```
+
+Beyond that, for each instance of the VulnerabilityReports we set the owner
+reference pointing to the corresponding pods controller. By doing that we can
+manage orphaned VulnerabilityReports and leverage Kubernetes garbage collection.
+For example, if the `wordpress` Deployment is deleted, all related
+VulnerabilityReports are automatically garbage collected.
+
+## Why do you create an instance of the VulnerabilityReport for each container?
+The idea is to partition VulnerabilityReports generated for a particular
+Kubernetes workload by containers is to mitigate the risk of exceeding the etcd
+request payload limit. By default, the payload of each Kubernetes object stored
+etcd is subject to 1.5 MiB.
+
+

docs/docs/kubernetes/operator/vulnerability-scanning/index.md

@@ -0,0 +1,21 @@
+# Vulnerability Scanners
+
+Vulnerability scanning is an important way to identify and remediate security gaps in Kubernetes workloads. The
+process involves scanning container images to check all software on them and report any vulnerabilities found.
+
+Trivy Operator automatically discovers and scans all images that are being used in a Kubernetes cluster, including
+images of application pods and system pods. Scan reports are saved as [VulnerabilityReport] resources, which are owned
+by a Kubernetes controller.
+
+For example, when Trivy scans a Deployment, the corresponding VulnerabilityReport instance is attached to its
+current revision. In other words, the VulnerabilityReport inherits the life cycle of the Kubernetes controller. This
+also implies that when a Deployment is rolling updated, it will get scanned automatically, and a new instance of the
+VulnerabilityReport will be created and attached to the new revision. On the other hand, if the previous revision is
+deleted, the corresponding VulnerabilityReport will be deleted automatically by the Kubernetes garbage collector.
+
+Trivy may scan Kubernetes workloads that run images from [Private Registries] and certain [Managed Registries].
+
+[VulnerabilityReport]: ./../crds/vulnerability-report.md
+[Trivy]: ./trivy.md
+[Private Registries]: ./private-registries.md
+[Managed Registries]: ./managed-registries.md

docs/docs/kubernetes/operator/vulnerability-scanning/managed-registries.md

@@ -0,0 +1,77 @@
+## Amazon Elastic Container Registry (ECR)
+
+You must create an IAM OIDC identity provider for your cluster:
+
+```
+eksctl utils associate-iam-oidc-provider \
+  --cluster <cluster_name> \
+  --approve
+```
+
+Override the existing `trivy-operator` service account and
+attach the IAM policy to grant it permission to pull images from the ECR:
+
+```
+eksctl create iamserviceaccount \
+  --name trivy-operator \
+  --namespace trivy-operator \
+  --cluster <cluster_name> \
+  --attach-policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
+  --approve \
+  --override-existing-serviceaccounts
+```
+
+## Azure Container Registry (ACR)
+
+Before you can start, you need to install `aad-pod-identity` inside your cluster, see installation instructions:
+https://azure.github.io/aad-pod-identity/docs/getting-started/installation/
+
+Create a managed identity and assign the permission to the ACR.
+```sh
+export IDENTITY_NAME=trivy-operator-identity
+export AZURE_RESOURCE_GROUP=<my_resource_group>
+export AZURE_LOCATION=westeurope
+export ACR_NAME=<my_azure_container_registry>
+
+az identity create --name ${IDENTITY_NAME} --resource-group ${AZURE_RESOURCE_GROUP} --location ${AZURE_LOCATION}
+
+export IDENTITY_ID=(az identity show --name ${IDENTITY_NAME} --resource-group ${AZURE_RESOURCE_GROUP} --query id -o tsv)
+export IDENTITY_CLIENT_ID=$(az identity show --name ${IDENTITY_NAME} --resource-group ${AZURE_RESOURCE_GROUP} --query clientId -o tsv)
+export ACR_ID=$(az acr show --name ${ACR_NAME} --query id -o tsv)
+
+az role assignment create --assignee ${IDENTITY_CLIENT_ID} --role 'AcrPull' --scope ${ACR_ID}
+```
+
+create an `AzureIdentity` and `AzureIdentityBinding` resource inside your kubernetes cluster:
+```yaml
+apiVersion: aadpodidentity.k8s.io/v1
+kind: AzureIdentity
+metadata:
+  name: trivy-identity
+  namespace: trivy-operator
+spec:
+  clientID: ${IDENTITY_ID}
+  resourceID: ${IDENTITY_CLIENT_ID}
+  type: 0
+```
+
+```yaml
+ apiVersion: aadpodidentity.k8s.io/v1
+ kind: AzureIdentityBinding
+ metadata:
+   name: trivy-id-binding
+   namespace: trivy-operator
+ spec:
+   azureIdentity: trivy-operator-identity
+   selector: trivy-operator-label
+```
+
+add `scanJob.podTemplateLabels` to the Trivy Operator config map, the value must match the `AzureIdentityBinding` selector.
+
+```sh
+kubectl -n trivy-operator edit cm trivy-operator
+# Insert scanJob.podTemplateLabels: aadpodidbinding=trivy-operator-label in data block
+
+# validate
+trivy-operator config --get scanJob.podTemplateLabels
+```

docs/docs/misconfiguration/comparison/cfsec.md

@@ -0,0 +1,24 @@
+# vs cfsec
+[cfsec][cfsec] uses static analysis of your CloudFormation templates to spot potential security issues.
+Trivy uses cfsec internally to scan both JSON and YAML configuration files, but Trivy doesn't support some features provided by cfsec.
+This section describes the differences between Trivy and cfsec.
+
+| Feature               | Trivy                                                  | cfsec                        |
+|-----------------------|--------------------------------------------------------|------------------------------|
+| Built-in Policies     | :material-check:                                       | :material-check:             |
+| Custom Policies       | :material-check:                                       | :material-close:             |
+| Policy Metadata[^1]   | :material-check:                                       | :material-check:             |
+| Show Successes        | :material-check:                                       | :material-check:             |
+| Disable Policies      | :material-check:                                       | :material-check:             |
+| Show Issue Lines      | :material-check:                                       | :material-check:             |
+| View Statistics       | :material-close:                                       | :material-check:             |
+| Filtering by Severity | :material-check:                                       | :material-close:             |
+| Supported Formats     | Dockerfile, JSON, YAML, Terraform, CloudFormation etc. | CloudFormation JSON and YAML |
+
+[^1]: To enrich the results such as ID, Title, Description, Severity, etc.
+
+cfsec is designed for CloudFormation.
+People who use only want to scan their CloudFormation templates should use cfsec.
+People who want to scan a wide range of configuration files should use Trivy.
+
+[cfsec]: https://github.com/aquasecurity/cfsec

docs/docs/misconfiguration/comparison/tfsec.md

@@ -0,0 +1,25 @@
+# vs tfsec
+[tfsec][tfsec] uses static analysis of your Terraform templates to spot potential security issues.
+Trivy uses tfsec internally to scan Terraform HCL files, but Trivy doesn't support some features provided by tfsec.
+This section describes the differences between Trivy and tfsec.
+
+| Feature               | Trivy                                                  | tfsec                |
+|-----------------------|--------------------------------------------------------|----------------------|
+| Built-in Policies     | :material-check:                                       | :material-check:     |
+| Custom Policies       | Rego                                                   | Rego, JSON, and YAML |
+| Policy Metadata[^1]   | :material-check:                                       | :material-check:     |
+| Show Successes        | :material-check:                                       | :material-check:     |
+| Disable Policies      | :material-check:                                       | :material-check:     |
+| Show Issue Lines      | :material-check:                                       | :material-check:     |
+| Support .tfvars       | :material-close:                                       | :material-check:     |
+| View Statistics       | :material-close:                                       | :material-check:     |
+| Filtering by Severity | :material-check:                                       | :material-check:     |
+| Supported Formats     | Dockerfile, JSON, YAML, Terraform, CloudFormation etc. | Terraform            |
+
+[^1]: To enrich the results such as ID, Title, Description, Severity, etc.
+
+tfsec is designed for Terraform.
+People who use only Terraform should use tfsec.
+People who want to scan a wide range of configuration files should use Trivy.
+
+[tfsec]: https://github.com/aquasecurity/tfsec