Freedom251 › Kubernetes Security Software
Trivy Operator
What Trivy Operator is
Trivy Operator is a free, self-hosted Kubernetes operator that scans clusters for security issues and publishes reports through the Kubernetes API. It watches changes in Kubernetes state and can start scans when resources such as Pods are created. Its reports cover workload vulnerabilities, configuration audits, exposed secrets, RBAC assessments, infrastructure assessments, and deprecated API use. Configuration checks can apply predefined rules or custom Open Policy Agent policies. The operator also creates compliance reports for Kubernetes hardening guidance, the CIS Kubernetes Benchmark, and Pod Security Standards profiles, as well as Software Bill of Materials reports for workloads. A /metrics endpoint is exposed by default for Prometheus to scrape, with metrics for vulnerabilities, exposed secrets, RBAC assessments, and configuration audits. Installation options include Helm, kubectl manifests, or Operator Lifecycle Manager; Helm is recommended for tracking custom configuration. There is no user interface. The project is described as incubating, and some APIs and custom resource definitions may change. Integrations include a Lens extension, webhooks, and Policy Reporter.
Who it suits
Trivy Operator suits Kubernetes teams that want continuous security scanning and reports accessible through the Kubernetes API. It is aimed at users able to install and operate a self-hosted Kubernetes operator.
What it does well
- Scans workloads when Kubernetes state changes.
- Audits configurations with custom policy support.
- Produces compliance and SBOM reports.
- Offers Helm, kubectl, and Operator Lifecycle Manager installation.
- Free to use.
What to know first
- It has no user interface.
- Some APIs and custom resource definitions may change.
- It requires a self-hosted Kubernetes deployment.
Limits
The project is incubating, and some APIs and custom resource definitions may change. The operator does not include a user interface.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Trivy Operator | Open source Kubernetes operator · scans security issues and stores reports as Kubernetes resources | Free |
As aquasecurity.github.io lists them, read 2 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Trivy Operator website for project documentation.
- Choose Helm, kubectl manifests, or Operator Lifecycle Manager as the installation route.
- Install the operator in your Kubernetes environment.
- Use Helm if you want to track custom configuration.
- Access reports through the Kubernetes API and metrics through the /metrics endpoint.
Verdict
Trivy Operator covers workload, configuration, and several cluster security report types in a Kubernetes-native setup. Its lack of a user interface and incubating status are important considerations.
Questions
How much does Trivy Operator cost?
The listed plan is free.
Is there a free plan or trial?
There is a free plan. No free trial is offered.
Where does Trivy Operator run?
It is self-hosted and works with Kubernetes through the Kubernetes API.
How can I install it?
Installation options are Helm, kubectl manifests, and Operator Lifecycle Manager. Helm is recommended for tracking custom configuration.
Does it have a user interface?
No. It exposes a metrics endpoint that Prometheus can scrape.
What does it scan and report?
It reports on workload vulnerabilities, configuration, exposed secrets, RBAC, Kubernetes infrastructure, deprecated API use, compliance, and workload software bills of materials.
Facts from Trivy Operator's own pages
- Automatic scans
- It watches Kubernetes state changes and triggers scans when resources change, such as when a Pod is created. · aquasecurity.github.io, 2 Oct 2026
- Company ownership status
- Crunchbase describes Aqua Security as a private Series E company headquartered in Ramat Gan, Tel Aviv, Israel, with a 251–500 employee range. · crunchbase.com, 15 Oct 2026
- Compliance
- It produces compliance reports for Kubernetes hardening guidance, the CIS Kubernetes Benchmark, and Pod Security Standards profiles. · aquasecurity.github.io, 2 Oct 2026
- Compliance reports
- Built-in compliance outputs cover NSA/CISA Kubernetes hardening guidance, CIS Kubernetes Benchmark 1.23, and Kubernetes Pod Security Standards baseline and restricted profiles. · github.com, 15 Oct 2026
- Configuration auditing
- It audits Kubernetes resources with predefined rules or custom Open Policy Agent policies. · github.com, 15 Oct 2026
- Configuration audits
- It audits Kubernetes resource configuration using predefined rules or custom Open Policy Agent policies. · aquasecurity.github.io, 2 Oct 2026
- Configuration limits
- Documented defaults include a five-minute scan-job timeout, a maximum of 10 concurrent scan jobs, one concurrent node-collector job, and 30-second retry delay. · aquasecurity.github.io, 15 Oct 2026
- Custom resources
- The project defines namespaced VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport and SbomReport resource types plus cluster-level report types. · aquasecurity.github.io, 15 Oct 2026
- Documentation depth
- Official documentation includes installation, configuration, troubleshooting, quick starts, tutorials, integrations, scanner settings, private registries, compliance, CRD schemas, and FAQ material. · aquasecurity.github.io, 15 Oct 2026
- Exposed secrets
- It creates reports identifying exposed secrets and their locations in cluster workloads. · github.com, 15 Oct 2026
- Helm installation
- The Helm instructions add Aqua's chart repository and install into a trivy-system namespace. · aquasecurity.github.io, 15 Oct 2026
- Independent field benchmark
- Safeguard reported a 31-minute first full-coverage time for 1,400 pods and a 14-second median scan for an 800 MB image in its v0.30/v0.70 test. · safeguard.sh, 15 Oct 2026
- Infrastructure assessment
- It assesses configuration of Kubernetes core components such as etcd, the API server, scheduler, and controller manager. · github.com, 15 Oct 2026
- Installation
- It can be installed through Helm, kubectl manifests, or Operator Lifecycle Manager; Helm is recommended for tracking custom configuration. · aquasecurity.github.io, 2 Oct 2026
- Installation methods
- Installation is documented through static YAML manifests, Helm, and Operator Lifecycle Manager. · aquasecurity.github.io, 15 Oct 2026
- Integrations
- Official documentation describes metrics, Lens extension, webhook, and Policy Reporter integrations. · aquasecurity.github.io, 2 Oct 2026
- Kubernetes API
- Security reports are Kubernetes Custom Resource Definitions and are readable through normal Kubernetes API mechanisms. · aquasecurity.github.io, 15 Oct 2026
- KubeVela integration
- KubeVela documents a Trivy Operator add-on with a metrics service reachable on port 9115. · kubevela.io, 15 Oct 2026
- Lens extension
- A separate Aqua Lens extension displays vulnerability, misconfiguration, exposed-secret, RBAC, and Kubernetes infrastructure reports; its documented prerequisite is Lens 4.0 or newer. · github.com, 15 Oct 2026
- License
- The repository is licensed under Apache-2.0. · github.com, 15 Oct 2026
- Limit: multi-cluster operations
- Safeguard's comparison says Trivy Operator has no built-in multi-cluster console and requires external aggregation for large estates. · safeguard.sh, 15 Oct 2026
- Limit: native UI
- Safeguard says the operator produces CRDs but has no native dashboard, so users commonly add DefectDojo, Dependency-Track, or vendor consoles. · safeguard.sh, 15 Oct 2026
- Limit: reporting and UI
- PeerSpot reviewers repeatedly request better report interpretation, PDF/CSV outputs, and built-in report analysis or a user-friendly interface. · peerspot.com, 15 Oct 2026
- Limit: runtime and malware coverage
- PeerSpot reviewers say Trivy lacks dynamic runtime scanning and that malware or anomaly detection may require a separate tool such as ClamAV. · peerspot.com, 15 Oct 2026
Where Trivy Operator stands on Freedom251
- Kubernetes Security Software#4 of 27