- Home
- Kubernetes Security Software
- Trivy Operator
Trivy Operator
What it is
Trivy Operator is a free, self-hosted Kubernetes operator that scans clusters for security issues and makes reports available through the Kubernetes API. It watches Kubernetes state changes and can trigger scans when resources such as Pods are created. Reports can cover workload vulnerabilities, configuration audits, exposed secrets, RBAC, Kubernetes infrastructure, and deprecated API use. Audits can apply predefined rules or custom Open Policy Agent policies. The operator also creates compliance reports for Kubernetes hardening guidance, the CIS Kubernetes Benchmark, and Pod Security Standards profiles, as well as Software Bill of Materials reports for workloads. It exposes a /metrics endpoint by default, with metrics for vulnerabilities, exposed secrets, RBAC assessments, and configuration audits. Installation options are Helm, kubectl manifests, and Operator Lifecycle Manager; Helm is recommended for tracking custom configuration. Documentation describes integrations for metrics, a Lens extension, webhooks, and Policy Reporter. There is no user interface. The project is described as incubating, and some APIs and custom resource definitions may change. Users can discuss the project in GitHub Discussions or Slack, and contribution guidance is available.
For and against
For
- Automatically scans workloads and audits configuration
- Produces compliance and Software Bill of Materials reports
- Supports Helm, kubectl manifests, and Operator Lifecycle Manager
- Exposes metrics for Prometheus to scrape
Against
- Does not have a user interface
- Some APIs and custom resource definitions may change
The verdict
Trivy Operator provides a broad set of Kubernetes security scans and reports at no cost. Teams should account for its lack of a UI and its incubating project status.
Who it suits
Trivy Operator suits teams operating Kubernetes clusters who want security reports accessible through the Kubernetes API. It is self-hosted and has no user interface.
Plans and prices
Trivy Operator
Open source Kubernetes operator · scans security issues and stores reports as Kubernetes resources
Read 2 Oct 2026 · aquasecurity.github.io
On the record
- Automatic scans
- It watches Kubernetes state changes and triggers scans when resources change, such as when a Pod is created.aquasecurity.github.io · read 2 Oct 2026
- Company ownership status
- Crunchbase describes Aqua Security as a private Series E company headquartered in Ramat Gan, Tel Aviv, Israel, with a 251–500 employee range.crunchbase.com · read 15 Oct 2026
- Compliance
- It produces compliance reports for Kubernetes hardening guidance, the CIS Kubernetes Benchmark, and Pod Security Standards profiles.aquasecurity.github.io · read 2 Oct 2026
- Compliance reports
- Built-in compliance outputs cover NSA/CISA Kubernetes hardening guidance, CIS Kubernetes Benchmark 1.23, and Kubernetes Pod Security Standards baseline and restricted profiles.github.com · read 15 Oct 2026
- Configuration auditing
- It audits Kubernetes resources with predefined rules or custom Open Policy Agent policies.github.com · read 15 Oct 2026
- Configuration audits
- It audits Kubernetes resource configuration using predefined rules or custom Open Policy Agent policies.aquasecurity.github.io · read 2 Oct 2026
- Configuration limits
- Documented defaults include a five-minute scan-job timeout, a maximum of 10 concurrent scan jobs, one concurrent node-collector job, and 30-second retry delay.aquasecurity.github.io · read 15 Oct 2026
- Custom resources
- The project defines namespaced VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport and SbomReport resource types plus cluster-level report types.aquasecurity.github.io · read 15 Oct 2026
- Documentation depth
- Official documentation includes installation, configuration, troubleshooting, quick starts, tutorials, integrations, scanner settings, private registries, compliance, CRD schemas, and FAQ material.aquasecurity.github.io · read 15 Oct 2026
- Exposed secrets
- It creates reports identifying exposed secrets and their locations in cluster workloads.github.com · read 15 Oct 2026
- Helm installation
- The Helm instructions add Aqua's chart repository and install into a trivy-system namespace.aquasecurity.github.io · read 15 Oct 2026
- Independent field benchmark
- Safeguard reported a 31-minute first full-coverage time for 1,400 pods and a 14-second median scan for an 800 MB image in its v0.30/v0.70 test.safeguard.sh · read 15 Oct 2026
- Infrastructure assessment
- It assesses configuration of Kubernetes core components such as etcd, the API server, scheduler, and controller manager.github.com · read 15 Oct 2026
- Installation
- It can be installed through Helm, kubectl manifests, or Operator Lifecycle Manager; Helm is recommended for tracking custom configuration.aquasecurity.github.io · read 2 Oct 2026
- Installation methods
- Installation is documented through static YAML manifests, Helm, and Operator Lifecycle Manager.aquasecurity.github.io · read 15 Oct 2026
- Integrations
- Official documentation describes metrics, Lens extension, webhook, and Policy Reporter integrations.aquasecurity.github.io · read 2 Oct 2026
- Kubernetes API
- Security reports are Kubernetes Custom Resource Definitions and are readable through normal Kubernetes API mechanisms.aquasecurity.github.io · read 15 Oct 2026
- KubeVela integration
- KubeVela documents a Trivy Operator add-on with a metrics service reachable on port 9115.kubevela.io · read 15 Oct 2026
