Trivy Operator

Spec sheet

What it does

Trivy Operator continuously watches Kubernetes state, launches Trivy scans after workload changes, and stores findings as Kubernetes Custom Resources accessible through the Kubernetes API.Read 15 Oct 2026 · aquasecurity.github.io

Purpose

Trivy Operator continuously scans Kubernetes clusters for security issues and makes reports accessible through the Kubernetes API.Read 2 Oct 2026 · aquasecurity.github.io

Integrations

Official documentation describes metrics, Lens extension, webhook, and Policy Reporter integrations.Read 2 Oct 2026 · aquasecurity.github.io

Compliance

It produces compliance reports for Kubernetes hardening guidance, the CIS Kubernetes Benchmark, and Pod Security Standards profiles.Read 2 Oct 2026 · aquasecurity.github.io

License

The repository is licensed under Apache-2.0.Read 15 Oct 2026 · github.com

Automatic scans

It watches Kubernetes state changes and triggers scans when resources change, such as when a Pod is created.Read 2 Oct 2026 · aquasecurity.github.io

Company ownership status

Crunchbase describes Aqua Security as a private Series E company headquartered in Ramat Gan, Tel Aviv, Israel, with a 251–500 employee range.Read 15 Oct 2026 · crunchbase.com

Compliance reports

Built-in compliance outputs cover NSA/CISA Kubernetes hardening guidance, CIS Kubernetes Benchmark 1.23, and Kubernetes Pod Security Standards baseline and restricted profiles.Read 15 Oct 2026 · github.com

Configuration auditing

It audits Kubernetes resources with predefined rules or custom Open Policy Agent policies.Read 15 Oct 2026 · github.com

Configuration audits

It audits Kubernetes resource configuration using predefined rules or custom Open Policy Agent policies.Read 2 Oct 2026 · aquasecurity.github.io

Configuration limits

Documented defaults include a five-minute scan-job timeout, a maximum of 10 concurrent scan jobs, one concurrent node-collector job, and 30-second retry delay.Read 15 Oct 2026 · aquasecurity.github.io

Custom resources

The project defines namespaced VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport and SbomReport resource types plus cluster-level report types.Read 15 Oct 2026 · aquasecurity.github.io

Documentation depth

Official documentation includes installation, configuration, troubleshooting, quick starts, tutorials, integrations, scanner settings, private registries, compliance, CRD schemas, and FAQ material.Read 15 Oct 2026 · aquasecurity.github.io

Exposed secrets

It creates reports identifying exposed secrets and their locations in cluster workloads.Read 15 Oct 2026 · github.com

Helm installation

The Helm instructions add Aqua's chart repository and install into a trivy-system namespace.Read 15 Oct 2026 · aquasecurity.github.io

Independent field benchmark

Safeguard reported a 31-minute first full-coverage time for 1,400 pods and a 14-second median scan for an 800 MB image in its v0.30/v0.70 test.Read 15 Oct 2026 · safeguard.sh

Infrastructure assessment

It assesses configuration of Kubernetes core components such as etcd, the API server, scheduler, and controller manager.Read 15 Oct 2026 · github.com

Installation

It can be installed through Helm, kubectl manifests, or Operator Lifecycle Manager; Helm is recommended for tracking custom configuration.Read 2 Oct 2026 · aquasecurity.github.io

Installation methods

Installation is documented through static YAML manifests, Helm, and Operator Lifecycle Manager.Read 15 Oct 2026 · aquasecurity.github.io

Kubernetes API

Security reports are Kubernetes Custom Resource Definitions and are readable through normal Kubernetes API mechanisms.Read 15 Oct 2026 · aquasecurity.github.io

KubeVela integration

KubeVela documents a Trivy Operator add-on with a metrics service reachable on port 9115.Read 15 Oct 2026 · kubevela.io

Lens extension

A separate Aqua Lens extension displays vulnerability, misconfiguration, exposed-secret, RBAC, and Kubernetes infrastructure reports; its documented prerequisite is Lens 4.0 or newer.Read 15 Oct 2026 · github.com

Limit: multi-cluster operations

Safeguard's comparison says Trivy Operator has no built-in multi-cluster console and requires external aggregation for large estates.Read 15 Oct 2026 · safeguard.sh

Limit: native UI

Safeguard says the operator produces CRDs but has no native dashboard, so users commonly add DefectDojo, Dependency-Track, or vendor consoles.Read 15 Oct 2026 · safeguard.sh

Limit: reporting and UI

PeerSpot reviewers repeatedly request better report interpretation, PDF/CSV outputs, and built-in report analysis or a user-friendly interface.Read 15 Oct 2026 · peerspot.com

Limit: runtime and malware coverage

PeerSpot reviewers say Trivy lacks dynamic runtime scanning and that malware or anomaly detection may require a separate tool such as ClamAV.Read 15 Oct 2026 · peerspot.com

Maker facts

LinkedIn lists Aqua Security as privately held, founded in 2015, headquartered in Burlington, Massachusetts, with an additional Ramat Gan, Israel location and a 501–1,000 employee size band.Read 15 Oct 2026 · linkedin.com

Maker legal name

The project documentation identifies the copyright holder as Aqua Security Software Ltd.Read 15 Oct 2026 · aquasecurity.github.io

Metrics

The operator exposes a /metrics endpoint by default with metrics for vulnerabilities, exposed secrets, RBAC assessments, and configuration audits.Read 2 Oct 2026 · aquasecurity.github.io

Metrics integration

A built-in /metrics endpoint exposes Prometheus-style metrics for vulnerabilities, secrets, RBAC assessments, configuration audits, infrastructure assessments, and compliance.Read 15 Oct 2026 · aquasecurity.github.io

OLM installation

The OLM guide installs Operator Lifecycle Manager, creates trivy-system, and subscribes to the trivy-operator package from OperatorHub.Read 15 Oct 2026 · aquasecurity.github.io

Other scans

It can generate reports for exposed secrets, RBAC assessments, Kubernetes infrastructure assessments, and deprecated API use.Read 2 Oct 2026 · aquasecurity.github.io

Policy Reporter integration

A community adapter converts Trivy Operator CRDs into PolicyReport resources for Policy Reporter dashboards, notifications, email, and metrics.Read 15 Oct 2026 · aquasecurity.github.io

Praise: integrations and openness

PeerSpot reviewers repeatedly praise open-source licensing, straightforward setup, broad scanning, and seamless CI/CD integration.Read 15 Oct 2026 · peerspot.com

Project status

The maintainers say backward compatibility is intended but describe the project as incubating, with APIs and CRDs subject to change.Read 15 Oct 2026 · github.com

Rating on PeerSpot

4.3 out of 5 from 12 reviewsRead 15 Oct 2026 · peerspot.com

RBAC assessment

It reports access rights and RBAC findings for installed Kubernetes resources.Read 15 Oct 2026 · github.com

Release news

Safeguard reports that Trivy Operator v0.30.1 was released on March 13, 2026.Read 15 Oct 2026 · safeguard.sh

Report lifecycle

It uses Kubernetes garbage collection to delete stale reports, and deleting an owned vulnerability report can trigger a rescan.Read 2 Oct 2026 · aquasecurity.github.io

SBOM

The operator generates software bills of materials for Kubernetes workloads.Read 15 Oct 2026 · github.com

Support and community

The project invites users to discuss matters in GitHub Discussions or Slack and links to contribution guidance.Read 2 Oct 2026 · aquasecurity.github.io

User complaint: configuration and deduplication

Reddit users report difficulty with Helm/image/CVE hierarchy and deduplication when combining Trivy Operator with DefectDojo.Read 15 Oct 2026 · reddit.com

User complaint: dashboard gaps

Reddit users describe Grafana dashboards as insufficient and say raw Trivy output is difficult to parse without a separate dashboard.Read 15 Oct 2026 · reddit.com

User complaint: missed scans

A GitHub discussion describes a Rancher cluster where scan jobs were created but images in system namespaces were not scanned and VulnerabilityReports were not generated.Read 15 Oct 2026 · github.com

User interface

The Helm chart documentation states that Trivy Operator does not have a user interface and exposes a metrics endpoint for Prometheus to scrape.Read 2 Oct 2026 · github.com

Vulnerability scanning

It scans Kubernetes workloads, control-plane components, and node components for vulnerabilities.Read 15 Oct 2026 · github.com

Webhook integration

Reports can be broadcast to an external webhook, including vulnerability, secret, configuration, infrastructure, RBAC, compliance, and SBOM report types.Read 15 Oct 2026 · aquasecurity.github.io

Plans and prices

Every Trivy Operator plan and price →

Where Specifiction places it

• Kubernetes Security Software#9 of 278.0