-
Introduction
DevSecOps ensures the security by doing Vulnerability scanning on the container images. There are several tools available for image scanning.
Trivy is a Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI.
The more information on Trivy is available in https://github.com/aquasecurity/trivy
In this article, we will see, how to implement trivy in Jenkins and Tekton pipelines.
-
Integrating Trivy in jenkins
The CICD process contains several steps. There could be a step called Build Image that will build a image and Push the image to the image registry.
Need to split the step into 3 steps.
Build Image
Trivy Scan
Push Image
Here is the modified pipeline.
You can see more information in
https://github.com/GandhiCloudLab/devsecops-with-trivy/#1-Integrating-Trivy-in-Jenkins
-
Integrating Trivy in Tekton
The CICD process contains several steps. There could be a step called Build that will build a image and Push the image to the image registry.
Need to split the step into 3 steps.
build
image-scan
push
Here is the modified pipeline.
You can see more information in
https://github.com/GandhiCloudLab/devsecops-with-trivy/#2-Integrating-Trivy-in-Tekton