Automation in the sense of cloud native, CRDs to define actions upon scan results / reports

[sspreitzer]

The offerings of cloud native (Open Source, Open Interoperability) Kubernetes workload security is scarce. So I am very thankful that Trivy is targeting this area.

When we look at «Cloud Native» we often find the following principles: self-service, automation, (auto-)scaling, stateless or state-handling, etc..

Applying these principles on the Trivy Kubernetes operator, wouldn’t it be useful to have definitions / actions that the operator could follow in the form of CRDs, per cluster and/or per namespace? Eg.:

• Send report immediately to webhook (prometheus?, alertmanager?) when severity is «High» or «Critical»
• Send report immediately via email when severity is «High» or «Critical»
• Execute a command
• Disable Kubernetes Services pointing to workload after a grace period (eg. 24h) or immediately
• Scale Down deployments, statefulsets and others after a grace period (eg. 24h) or immediately
• Block Pods from starting

[chen-keinan]

@sspreitzer thank you for sharing you thoughts.
Are you referring on building policies with actions on top existing functionality ?

[sspreitzer]

@sspreitzer thank you for sharing you thoughts.
Are you referring on building policies with actions on top existing functionality ?

Yes, something in that direction.