mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-22 15:16:33 -08:00
60 lines
1.9 KiB
Markdown
60 lines
1.9 KiB
Markdown
# Helm
|
|
Trivy supports two types of Helm scanning, templates and packaged charts.
|
|
The following scanners are supported.
|
|
|
|
| Format | [Misconfiguration] | [Secret] |
|
|
| -------- | :----------------: | :------: |
|
|
| Template | ✓ | ✓ |
|
|
| Chart | ✓ | - |
|
|
|
|
## Misconfiguration
|
|
Trivy recursively searches directories and scans all found Helm files.
|
|
|
|
It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
|
|
See [here](../../scanner/misconfiguration/check/builtin.md) for more details on the built-in checks.
|
|
|
|
### Value overrides
|
|
There are a number of options for overriding values in Helm charts.
|
|
When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.
|
|
|
|
#### Setting inline value overrides
|
|
Overrides can be set inline on the command line
|
|
|
|
```bash
|
|
trivy config --helm-set securityContext.runAsUser=0 ./charts/mySql
|
|
```
|
|
|
|
#### Setting value file overrides
|
|
Overrides can be in a file that has the key=value set.
|
|
|
|
```yaml
|
|
# Example override file (overrides.yaml)
|
|
|
|
securityContext:
|
|
runAsUser: 0
|
|
```
|
|
|
|
```bash
|
|
trivy config --helm-values overrides.yaml ./charts/mySql
|
|
```
|
|
|
|
#### Setting value as explicit string
|
|
the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string
|
|
|
|
```bash
|
|
trivy config --helm-set-string name=false ./infrastructure/tf
|
|
```
|
|
|
|
#### Setting specific values from files
|
|
Specific override values can come from specific files
|
|
|
|
```bash
|
|
trivy config --helm-set-file environment=dev.values.yaml ./charts/mySql
|
|
```
|
|
|
|
## Secret
|
|
The secret scan is performed on plain text files, with no special treatment for Helm.
|
|
Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.
|
|
|
|
[Misconfiguration]: ../../scanner/misconfiguration/index.md
|
|
[Secret]: ../../scanner/secret.md |