Skip to content

Trivy (Container Scanning)

Enable container image vulnerability scanning and workload misconfiguration detection. You can bring your own Trivy scanner or let KubeManta run scans on demand.

What it gives you

  • CVE detection — container image vulnerabilities with CVSS scores and fix availability
  • Misconfiguration detection — workload security misconfigs (e.g., insecure capabilities, root containers)
  • Posture score — A–F grade + trend over time
  • Findings export — CSV / JSON export for compliance reporting
  • Risk acceptance — suppress known/accepted findings (Pro)

Tier: Free (read reports); Pro (self-scan trigger + risk acceptance)

Prerequisites

Choose one scan source:

Option A: Bring your own scanner (trivy-operator)

If you already run trivy-operator in your cluster:

  1. trivy-operator installed — the operator creates VulnerabilityReport and ConfigAuditReport custom resources as it scans your images.
  2. Nothing else to do — KubeManta auto-detects the operator and reads its reports. You're set.

This is the Free, recommended path if you already have the operator.

Option B: KubeManta self-scan (built-in Trivy Job)

If you don't have trivy-operator and want KubeManta to scan on demand:

  1. Pro license — required to trigger scans (viewing reports is Free).
  2. Expert mode enabled — the Helm value expertMode.enabled=true allows KubeManta to create privileged scan Jobs.
  3. Network path — the scan Job downloads the Trivy database (from Docker Hub / ghcr.io by default). Ensure your cluster nodes can reach those registries. Alternatively, use a local Trivy server (see below).

Option C: Trivy Server (EXPERIMENTAL)

If you run a self-hosted or managed Trivy server (e.g., Trivy-DB server):

  1. Trivy server URL — e.g., http://trivy-server:8080
  2. Expert mode enabled — same as Option B
  3. KubeManta will spawn scan Jobs that run trivy k8s --server <url> instead of downloading a local CVE-DB

Configure in KubeManta

For trivy-operator (auto-detected)

No configuration needed. If the operator is installed and discoverable, KubeManta reads its reports automatically.

Verify: 1. In the sidebar, click Security (shield icon). 2. Open the Scanner sub-tab. 3. You should see Source: Operator and a count of deployed scan resources.

If you want to switch to self-scan later, see below.

For self-scan or Trivy server

  1. Enable scanning in Helm (only needed once, at install or upgrade):
helm upgrade kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
  --version 1.0.0 \
  -n kubemanta-system --reset-then-reuse-values \
  --set security.scanning.enabled=true

This grants KubeManta the minimal RBAC to create scan Jobs and read their logs.

  1. In KubeManta, navigate to Vulnerability Scanner → Scanner.

  2. Under Scan source, pick one:

  3. Use KubeManta self-scan — KubeManta spawns a Trivy Job per scan. Requires Pro + expert mode.

  4. Trivy Server — point to your own Trivy server. Enter the URL (e.g., http://trivy-server:8080) and click Save.

  5. Use my trivy-operator — KubeManta reads the operator's reports (Free, no Pro needed).

  6. Click Save if you changed the source.

Verify

Check that scanning is enabled

  1. Click Security in the sidebar (shield icon).
  2. Open the Scanner sub-tab.
  3. You should see:
  4. Source: one of Operator, Self-scan, or Trivy Server
  5. Status: green "ready" or orange "not configured yet"

Trigger a scan (self-scan only)

If you chose self-scan:

  1. In the Scanner tab, click the Scan now button (appears only for admins).
  2. A scan Job is created. You'll see Status: Running.
  3. Wait for it to complete (usually 30–60 seconds, visible in real time).
  4. Once done, check the Findings sub-tab to see CVEs and misconfigs.

Expected states

State Meaning Next step
Source: None Scanning isn't enabled or no scanner is detected Enable scanning in Helm and pick a source
Source: Operator trivy-operator is installed and KubeManta is reading its reports No action needed; wait for a scan to run
Source: Self-scan or Trivy Server, Status: Ready Configured and ready. Scan on demand. Click "Scan now" to trigger a scan (or wait for scheduled scans if configured elsewhere)
Findings tab shows CVEs/misconfigs Success! Review findings, optionally suppress accepted ones (Pro)

Troubleshooting

"Source: None" in the Scanner tab

Is security.scanning.enabled=true set in Helm?

kubectl get deploy -n kubemanta-system kubemanta-agent -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name=="SECURITY_SCANNING_ENABLED")].value}'

If it's not set or is false, run the Helm upgrade from "Configure" above.

Is trivy-operator installed? Check if the CRD exists:

kubectl get crd | grep vulnerabilityreports
# or
kubectl api-resources | grep VulnerabilityReport

If not, KubeManta falls back to self-scan mode (if Pro licensed).

Scan is stuck in "Running"

Is the scan Job still there? Check:

kubectl get jobs -n kubemanta-system -l app.kubernetes.io/managed-by=kubemanta

If a job is running and taking >60 seconds, it's still downloading the Trivy database or scanning your images. This is normal for large clusters on first run.

Is the scan Job failing? Check logs:

kubectl logs -n kubemanta-system -l app.kubernetes.io/managed-by=kubemanta --tail=50

If the Job pod has ImagePullBackOff, KubeManta couldn't pull the Trivy image. Check your image pull secrets and network egress to the registry.

"Scan now" button is disabled or shows "Admin only"

Are you an admin? Only admins can trigger scans. If you're a viewer, ask an admin to trigger the scan.

Do you have a Pro license? Self-scan requires Pro. If you're on Free, switch to operator source or upgrade.

Is expertMode.enabled=true? Self-scan needs expert mode. Check:

kubectl get deploy -n kubemanta-system kubemanta-agent -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name=="EXPERT_MODE_ENABLED")].value}'

If not set, the "Scan now" button is disabled (read-only mode is the default for safety).

Findings are empty or "not found"

Did a scan actually run? Check the History sub-tab — if there are no scan runs, no scans have completed yet. Trigger one with "Scan now" and wait.

Is trivy-operator configured correctly? Verify the operator's reports exist:

kubectl get vulnerabilityreports -A | head

If nothing appears, the operator may not have scanned any images yet (can take a few minutes after install).

"Trivy Server connection failed"

Check the URL: - ✅ Correct: http://trivy-server:8080 (in-cluster service DNS) - ✅ Correct: https://trivy.example.com (managed Trivy server) - ❌ Wrong: trivy-server:8080 (missing protocol)

Is the server running?

curl http://trivy-server:8080/version
# should return Trivy version info

Network path: from the scan Job's perspective (usually in kubemanta-system), can it reach the Trivy server namespace?