aquasecurity/trivy

Support for CRI-O

Open

#3,004 opened on Oct 9, 2022

View on GitHub
 (3 comments) (0 reactions) (0 assignees)Go (35,000 stars) (371 forks)batch import
help wantedkind/featurepriority/backlog

Description

We are building an image-scanner K8s-operator, and all our clusters runs Openshift. Inspired by trivy-operator, which we cannot use for various reasons, we schedule scan jobs to scan container images currently in use by workloads in the cluster.

While the operator works, it could be optimized if trivy supported CRI-O, which is the CRI implementation that Openshift uses. This would allow us to scan the image pulled from the nodes image registry, by scheduling the scan job on the node that runs the pod in question.

Related issues: https://github.com/aquasecurity/trivy/issues/1282, https://github.com/aquasecurity/trivy/issues/851, https://github.com/aquasecurity/trivy-operator/issues/101

Contributor guide

Tech stack
godockerkubernetes
Domain
backendinfrastructuresecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Go programmingknowledge of container runtimesfamiliarity with Kubernetes
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Investigate how trivy currently interacts with container runtimes (e.g., Docker) and extend support to CRI O. Review related issues #1282 and #851 for previous discussions. Key files to modify may include image pulling and scanning logic in the Go codebase. The maintainer has not provided specific implementation guidance, so the contributor should explore the existing architecture and propose a design.
Support for CRI-O · aquasecurity/trivy#3004 | Good First Issue