https://github.com/linuxacademy/content-cks-trivy-k8s-webhook
Will Boyd, Certified Kubernetes Security Specialist, 05.11.2021
https://github.com/linuxacademy/content-cks-trivy-k8s-webhook
Last synced: over 1 year ago
JSON representation
Will Boyd, Certified Kubernetes Security Specialist, 05.11.2021
- Host: GitHub
- URL: https://github.com/linuxacademy/content-cks-trivy-k8s-webhook
- Owner: linuxacademy
- Created: 2021-05-11T22:03:32.000Z (about 5 years ago)
- Default Branch: main
- Last Pushed: 2021-05-15T16:25:11.000Z (about 5 years ago)
- Last Synced: 2025-04-06T02:11:15.465Z (over 1 year ago)
- Language: Go
- Size: 56.6 KB
- Stars: 9
- Watchers: 6
- Forks: 12
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# trivy-k8s-webhook
**Note:** This project is **only** intended for learning purposes. It is designed to teach users how to interact with Kubernetes' ImagePolicyWebhook. Numerous decisions were made to make it as easy as possible for learners to quickly get hands-on with ImagePolicyWebhook at the expense of security and production-readiness.
This is a webhook application designed to work with the Kubernetes ImagePolicyWebhook admission controller. It scans the provided images with [Trivy](https://github.com/aquasecurity/trivy) and approves creation of the workload only if Trivy does not detect any HIGH- or CRITICAL-severity vulnerabilities.
The webhook application listens on port `8090`.
## Certificates
ImagePolicyWebhook requires https. As such, you must supply valid certificates in order to run this code. This application looks for the following certificate files:
- Server certificate - `certs/trivy-k8s-webhook.crt`
- Certificate key - `certs/trivy-k8s-webhook.key`