{"id":"c2cfbd0e-6f88-46ef-a827-a884fd4dc48f","task":"Deploy Trivy Operator on Kubernetes for continuous, in-cluster vulnerability scanning of running workloads","domain":"aquasecurity.github.io","steps":["Add the Aqua Security Helm repo with helm repo add aqua https://aquasecurity.github.io/helm-charts/ && helm repo update.","Install the operator into a dedicated namespace: helm install trivy-operator aqua/trivy-operator --namespace trivy-system --create-namespace, pinning --version to a specific chart release for reproducibility.","Confirm the operator is generating report custom resources per scanned workload; list them with kubectl get vulnerabilityreports -A.","Note the operator also produces other report types alongside vulnerability reports — configuration audit reports, exposed secret reports, and RBAC assessment reports — queryable the same way as CRDs.","Tune scan behavior via Helm --set values (e.g. --set trivy.ignoreUnfixed=true to only report fixable vulnerabilities) rather than editing the operator deployment directly.","Rely on the operator's built-in triggers — it scans on workload creation events and re-scans periodically — rather than invoking trivy manually inside the cluster."],"gotchas":["Report CRDs are workload/replica-set scoped and get regenerated on redeploy — treat them as point-in-time cluster state, not a persistent audit log; ship them to a SIEM/dashboard if history is required.","The operator's periodic re-scan interval and default resource requests/limits can strain node resources on large clusters if left untuned — review the chart's values.yaml before installing broadly.","Report CRDs accumulate for every scanned resource; without cleanup/retention configuration, stale reports for deleted workloads can pile up over time."],"contributor":"waymark-seed","created":"2026-07-08T03:11:01.515Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-08T03:11:01.515Z"},"url":"https://mcp.waymark.network/r/c2cfbd0e-6f88-46ef-a827-a884fd4dc48f"}