Trivy-operator: prevent scanning of the same images

Photo by Randall Ruiz on Unsplash

Trivy-operator raises a new single pod every time it wants to scan a new image. Due to this, consumption of resources kubernetes cluster can be increased significantly. In this I would like to explain how to avoid this situation.

How trivy scanner works?

Trivy scanner at first extracts all the packages / dependencies (SBOM) that are used in the image and then checks them within trivy-server to get the list of only vulnerable packages / dependencies. After the the trivy scanner finished its’ job — there will be created 2 reports for the image: SBOM report and Vulnerability report.

Get janloo-security’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In the configuration of trivy-operator it’s possible to specify the TTL for these reports and the option to store / not to store SBOM report (SBOM report is called as cache in configuration):

trivy-operator:
  operator:
    clusterSbomCacheEnabled: true  #  flag to store / not store sbom report, by default false
    cacheReportTTL: "120h"         #  flag to set TTL for sbom report, by default 120h
    scannerReportTTL: "24h"        #  flag to set TTL for vulnerability report, 

How trivy-operator works with the cache?

Let’s say that trivy-operator has detected a new deployment in cluster, so what happens next?

1. Trivy-operator checks if the SBOM report (cache) already exists for the same image.
2. If SBOM report (cache) already exists — trivy-operator sends this old report to the webhook.
3. SBOM report (cache) does not exist — trivy-operator raises new pod to scan the image and after send a fresh report to webhook.

Solution

To prevent scanning of the same images you need to activate SBOM cache:

trivy-operator:
  operator:
    clusterSbomCacheEnabled: true

Summary

The information, I’ve gathered in this article was really useful for me. I hope, it will be useful for someone else. If you have any recommendations, remarks or thoughts regarding the theme, do not hesitate to leave a comment.