Viewing vulnerability reports

Trivy Operator scans custom application images and saves the results to VulnerabilityReport resources.

Using the CLIUsing the CLI

1. Get a list of reports for all namespaces:

   kubectl get vulnerabilityreports.aquasecurity.github.io --all-namespaces
   

2. View the report in question:

   kubectl get vulnerabilityreport <report_name> \
     --namespace <namespace> \
     --output yaml
   

   The main fields include:

   • report.registry.server: Scanned image registry.
   • report.artifact: Repository, digest, tag, and MIME type of the scanned image.
   • report.scanner: Trivy version that created the report.
   • report.summary: Number of detected vulnerabilities by severity score.
   • report.vulnerabilities: Vulnerability ID, identified and fixed package version, score, and link to a description.

3. If needed, get standard Policy Manager reports created by the adapter for VulnerabilityReport with detected vulnerabilities:

   kubectl get policyreports.wgpolicyk8s.io --all-namespaces \
     --selector trivy-operator.source=VulnerabilityReport
   

Using the management consoleUsing the management console

Critical and high vulnerabilities are shown together with other Policy Manager reports. A CVE name is shown as text: it is not a Kyverno policy, and you cannot create ClusterPolicyMute for such a row.

If you did not get a reportIf you did not get a report

Check the following:

• PolicyManagerConfig.spec.enabled and PolicyManagerConfig.spec.settings.trivy.enabled are not set to false.
• The namespace is not included in the exclusion list.
• The initial load can upload an image with the specified ServiceAccount and imagePullSecrets.
• The scan task in the namespace is complete stackland-policy-manager.
• The scanner image and Trivy Server successfully received the Java DB and main vulnerability DB included in the distribution, or both parameters of the relevant external mirror.