alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Enhance Trivy integration: update email dispatch logic, add LLM prompt generation, and improve security context in deployments

Browse Source
This commit is contained in:
Alexandre Pires
2025-09-21 23:55:53 +02:00
parent aee57a8b89
commit 1e8526f442
9 changed files with 441 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/modules/utils/trivy/main.tf
+39 -5
View File
@@ -99,7 +99,24 @@ resource "kubernetes_cron_job_v1" "trivy" {
container {
image = "aquasec/trivy:${var.tag}"
name = "trivy"
args = ["k8s", "--report=${var.report_type}", "--exit-code=0", "--severity=${var.levels}", "--cache-dir=/cache", "-o", "/reports/trivy.txt", "--disable-node-collector"]
args = [
"k8s",
"--report=${var.report_type}",
"--exit-code=0",
"--severity=${var.levels}",
"--cache-dir=/cache",
"-o", "/reports/trivy.json",
"--format", "json",
"--disable-node-collector",
"--parallel", "1"
]
security_context {
run_as_non_root = true
run_as_user = 1000
run_as_group = 1000
allow_privilege_escalation = false
read_only_root_filesystem = true
}
volume_mount {
name = "trivy-reports"
mount_path = "/reports"
@@ -108,6 +125,10 @@ resource "kubernetes_cron_job_v1" "trivy" {
name = "trivy-cache"
mount_path = "/cache"
}
volume_mount {
name = "tmp"
mount_path = "/tmp"
}
}
container {
name = "send-report"
@@ -115,7 +136,7 @@ resource "kubernetes_cron_job_v1" "trivy" {
args = ["/scripts/send_report.py"]
env {
name = "REPORT_PATH"
value = "/reports/trivy.txt"
value = "/reports/trivy.json"
}
env {
name = "SMTP_HOST"
@@ -151,6 +172,13 @@ resource "kubernetes_cron_job_v1" "trivy" {
name = "EMAIL_TO"
value = var.to_email
}
security_context {
run_as_non_root = true
run_as_user = 1000
run_as_group = 1000
allow_privilege_escalation = false
read_only_root_filesystem = true
}
volume_mount {
name = "trivy-reports"
mount_path = "/reports"
@@ -159,6 +187,10 @@ resource "kubernetes_cron_job_v1" "trivy" {
name = "trivy-scripts"
mount_path = "/scripts"
}
volume_mount {
name = "tmp"
mount_path = "/tmp"
}
}
volume {
name = "trivy-reports"
@@ -166,9 +198,7 @@ resource "kubernetes_cron_job_v1" "trivy" {
}
volume {
name = "trivy-cache"
host_path {
path = local.cache_path
}
empty_dir {}
}
volume {
name = "trivy-scripts"
@@ -178,6 +208,10 @@ resource "kubernetes_cron_job_v1" "trivy" {
}
}
volume {
name = "tmp"
empty_dir {}
}
}
}
}