DevOps Automation

Introduction

DevSecOps ensures the security by doing Vulnerability scanning on the container images. There are several tools available for image scanning.

Trivy is a Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI.

The more information on Trivy is available in https://github.com/aquasecurity/trivy

In this article, we will see, how to implement trivy in Jenkins and Tekton pipelines.

Integrating Trivy in jenkins

The CICD process contains several steps. There could be a step called Build Image that will build a image and Push the image to the image registry.

Need to split the step into 3 steps.

Build Image
Trivy Scan
Push Image

Here is the modified pipeline.

You can see more information in

https://github.com/GandhiCloudLab/devsecops-with-trivy/#1-Integrating-Trivy-in-Jenkins

Integrating Trivy in Tekton

The CICD process contains several steps. There could be a step called Build that will build a image and Push the image to the image registry.

Need to split the step into 3 steps.

build
image-scan
push

Here is the modified pipeline.

You can see more information in

https://github.com/GandhiCloudLab/devsecops-with-trivy/#2-Integrating-Trivy-in-Tekton