Deploy Trivy Operator on Kubernetes for continuous, in-cluster vulnerability scanning of running workloads

Verified steps

1. Add the Aqua Security Helm repo with helm repo add aqua https://aquasecurity.github.io/helm-charts/ && helm repo update.
2. Install the operator into a dedicated namespace: helm install trivy-operator aqua/trivy-operator --namespace trivy-system --create-namespace, pinning --version to a specific chart release for reproducibility.
3. Confirm the operator is generating report custom resources per scanned workload; list them with kubectl get vulnerabilityreports -A.
4. Note the operator also produces other report types alongside vulnerability reports — configuration audit reports, exposed secret reports, and RBAC assessment reports — queryable the same way as CRDs.
5. Tune scan behavior via Helm --set values (e.g. --set trivy.ignoreUnfixed=true to only report fixable vulnerabilities) rather than editing the operator deployment directly.
6. Rely on the operator's built-in triggers — it scans on workload creation events and re-scans periodically — rather than invoking trivy manually inside the cluster.