Skip to content

Trivy (Container Scanning)

Enable container image vulnerability scanning and workload misconfiguration detection. You can bring your own Trivy scanner or let KubeManta run scans on demand.

What it gives you

  • CVE detection — container image vulnerabilities with CVSS scores and fix availability
  • Misconfiguration detection — workload security misconfigs (e.g., insecure capabilities, root containers)
  • Posture score — A–F grade + trend over time
  • Findings export — CSV / JSON export for compliance reporting
  • Risk acceptance — suppress known/accepted findings (Pro)

Tier: Free (read reports); Pro (self-scan trigger + risk acceptance)

Prerequisites

Choose one scan source:

Option A: Bring your own scanner (trivy-operator)

If you already run trivy-operator in your cluster:

  1. trivy-operator installed — the operator creates VulnerabilityReport and ConfigAuditReport custom resources as it scans your images.
  2. Nothing else to do — KubeManta auto-detects the operator and reads its reports. You're set.

This is the Free, recommended path if you already have the operator.

Option B: KubeManta self-scan (built-in Trivy Job)

If you don't have trivy-operator and want KubeManta to scan on demand:

  1. Pro license — required to trigger scans (viewing reports is Free).
  2. Expert mode enabled — the Helm value expertMode.enabled=true allows KubeManta to create privileged scan Jobs.
  3. Network path — the scan Job downloads the Trivy database (from Docker Hub / ghcr.io by default). Ensure your cluster nodes can reach those registries. On a sealed network, mirror the DB instead — see the air-gap section of Install.

There is no Trivy-server option

trivy k8s has no client/server mode — only trivy image does — so there is nothing for KubeManta to point at. If you want KubeManta to deploy no scanner of its own, use Option A (trivy-operator), which is the supported bring-your-own path.

Configure in KubeManta

For trivy-operator (auto-detected)

No configuration needed. If the operator is installed and discoverable, KubeManta reads its reports automatically.

Verify: 1. In the sidebar, click Security (shield icon). 2. Open the Scanner sub-tab. 3. You should see Source: Operator and a count of deployed scan resources.

If you want to switch to self-scan later, see below.

For self-scan

  1. Enable Expert Mode (only needed once, at install or upgrade). Scanning itself is on by default, so no flag is required to read reports or trigger a scan — but the built-in self-scan runs through the privileged expert-exec path, so it additionally needs Expert Mode (and a Pro license):
helm upgrade kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
  --version CHART_VERSION \
  -n kubemanta-system --reset-then-reuse-values \
  --set expertMode.enabled=true

  1. In KubeManta, navigate to Vulnerability Scanner → Scanner.

  2. Under Scan source, pick one:

  3. Use KubeManta self-scan — KubeManta spawns a Trivy Job per scan. Requires Pro + expert mode.

  4. Use my trivy-operator — KubeManta reads the operator's reports (Free, no Pro needed).

  5. Click Save if you changed the source.

Verify

Check that scanning is enabled

  1. Click Security in the sidebar (shield icon).
  2. Open the Scanner sub-tab.
  3. You should see:
  4. Source: one of Operator, Self-scan, or None
  5. Status: green "ready" or orange "not configured yet"

Trigger a scan (self-scan only)

If you chose self-scan:

  1. In the Scanner tab, click the Scan now button (appears only for admins).
  2. A scan Job is created. You'll see Status: Running.
  3. Wait for it to complete (usually 30–60 seconds, visible in real time).
  4. Once done, check the Findings sub-tab to see CVEs and misconfigs.

Expected states

State Meaning Next step
Source: None No scanner detected — trivy-operator isn't installed and self-scan isn't configured (or scanning was turned off) Install trivy-operator, or configure self-scan (Pro + Expert Mode), then pick a source
Source: Operator trivy-operator is installed and KubeManta is reading its reports No action needed; wait for a scan to run
Source: Self-scan, Status: Ready Configured and ready. Scan on demand. Click "Scan now" to trigger a scan (or wait for scheduled scans if configured elsewhere)
Findings tab shows CVEs/misconfigs Success! Review findings, optionally suppress accepted ones (Pro)

Troubleshooting

"Source: None" in the Scanner tab

Has scanning been turned off? It's on by default, so this only applies if someone set security.scanning.enabled=false:

!!! tip "Which version?"

    Replace `CHART_VERSION` with the release you are installing. The newest is at
    the top of the [Changelog](../releases/CHANGELOG.md), or read it from the
    registry once you are logged in:

    ```bash
    helm show chart oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta | grep '^version:'
    ```

    Always pin it. An unpinned install resolves to whatever `stable` points at
    today, which is not necessarily the release you tested against.
kubectl get deploy -n kubemanta-system kubemanta-agent -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name=="SECURITY_SCANNING_ENABLED")].value}'

If that prints false, drop the --set security.scanning.enabled=false from your install (or set it back to true) and re-run the Helm upgrade.

Is trivy-operator installed? Check if the CRD exists:

kubectl get crd | grep vulnerabilityreports
# or
kubectl api-resources | grep VulnerabilityReport

If not, KubeManta falls back to self-scan mode (if Pro licensed).

Scan is stuck in "Running"

Is the scan Job still there? Check:

kubectl get jobs -n kubemanta-system -l app.kubernetes.io/managed-by=kubemanta

If a job is running and taking >60 seconds, it's still downloading the Trivy database or scanning your images. This is normal for large clusters on first run.

Is the scan Job failing? Check logs:

kubectl logs -n kubemanta-system -l app.kubernetes.io/managed-by=kubemanta --tail=50

If the Job pod has ImagePullBackOff, KubeManta couldn't pull the Trivy image. Check your image pull secrets and network egress to the registry.

"Scan now" button is disabled or shows "Admin only"

Are you an admin? Only admins can trigger scans. If you're a viewer, ask an admin to trigger the scan.

Do you have a Pro license? Self-scan requires Pro. If you're on Free, switch to operator source or upgrade.

Is expertMode.enabled=true? Self-scan needs expert mode. Check:

kubectl get deploy -n kubemanta-system kubemanta-agent -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name=="EXPERT_MODE_ENABLED")].value}'

If not set, the "Scan now" button is disabled (read-only mode is the default for safety).

Findings are empty or "not found"

Did a scan actually run? Check the History sub-tab — if there are no scan runs, no scans have completed yet. Trigger one with "Scan now" and wait.

Is trivy-operator configured correctly? Verify the operator's reports exist:

kubectl get vulnerabilityreports -A | head

If nothing appears, the operator may not have scanned any images yet (can take a few minutes after install).