mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-12 15:50:15 -08:00
Deployed ed590966a to v0.39 with MkDocs 1.3.0 and mike 1.1.2
This commit is contained in:
@@ -3388,12 +3388,12 @@
|
||||
<h1 id="examples">Examples</h1>
|
||||
<h2 id="custom-policy">Custom Policy</h2>
|
||||
<h3 id="kubernetes">Kubernetes</h3>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-policy/kubernetes/">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-policy/kubernetes/">here</a>.</p>
|
||||
<p>The custom policy is defined in <code>user.kubernetes.ID001</code> package.
|
||||
You need to pass the package prefix you want to evaluate through <code>--namespaces</code> option.
|
||||
In this case, the package prefix should be <code>user</code>, <code>user.kubernetes</code>, or <code>user.kubernetes.ID001</code>.</p>
|
||||
<h3 id="dockerfile">Dockerfile</h3>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-policy/dockerfile/">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-policy/dockerfile/">here</a>.</p>
|
||||
<p>The input will be a dictionary of stages.</p>
|
||||
<h4 id="single-stage">Single Stage</h4>
|
||||
<details class="example">
|
||||
@@ -3617,17 +3617,17 @@ In this case, the package prefix should be <code>user</code>, <code>user.kuberne
|
||||
</code></pre></div></p>
|
||||
</details>
|
||||
<h3 id="docker-compose">Docker Compose</h3>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-policy/docker-compose/">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-policy/docker-compose/">here</a>.</p>
|
||||
<p>Docker Compose uses YAML format for configurations. You can apply your Rego policies to <code>docker-compose.yml</code>.</p>
|
||||
<h3 id="hcl">HCL</h3>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-policy/hcl/">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-policy/hcl/">here</a>.</p>
|
||||
<p>Trivy parses HCL files and converts into structured data.</p>
|
||||
<div class="admonition warning">
|
||||
<p class="admonition-title">Warning</p>
|
||||
<p>Terraform HCL files are not supported yet.</p>
|
||||
</div>
|
||||
<h3 id="terraform-plan">Terraform Plan</h3>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-policy/terraform-plan/">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-policy/terraform-plan/">here</a>.</p>
|
||||
<p>Use the command <a href="https://www.terraform.io/docs/cli/commands/show.html">terraform show</a> to convert the Terraform plan into JSON so that OPA can read the plan.</p>
|
||||
<div class="highlight"><pre><span></span><code>$ terraform init
|
||||
$ terraform plan --out tfplan.binary
|
||||
@@ -3635,14 +3635,14 @@ $ terraform show -json tfplan.binary > tfplan.json
|
||||
</code></pre></div>
|
||||
<p>For more details, see also <a href="https://www.openpolicyagent.org/docs/latest/terraform/">OPA document</a>.</p>
|
||||
<h3 id="serverless-framework">Serverless Framework</h3>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-policy/serverless/">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-policy/serverless/">here</a>.</p>
|
||||
<p>Server Framework uses YAML format for configurations. You can apply your Rego policies to <code>serverless.yaml</code>.</p>
|
||||
<h2 id="custom-data">Custom Data</h2>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/custom-data">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/custom-data">here</a>.</p>
|
||||
<h2 id="combined-input">Combined Input</h2>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/combine">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/combine">here</a>.</p>
|
||||
<h2 id="go-testing">Go Testing</h2>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/go-testing">here</a>.</p>
|
||||
<p>See <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/go-testing">here</a>.</p>
|
||||
|
||||
|
||||
</article>
|
||||
|
||||
@@ -3247,7 +3247,7 @@ exception[ns] {
|
||||
</code></pre></div>
|
||||
</div>
|
||||
<p>This example exempts all built-in policies for Kubernetes.</p>
|
||||
<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/namespace-exception">an example</a>.</p>
|
||||
<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/namespace-exception">an example</a>.</p>
|
||||
<h2 id="rule-based-exceptions">Rule-based exceptions</h2>
|
||||
<p>There are some cases where you need more flexibility and granularity in defining which cases to exempt.
|
||||
Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them.</p>
|
||||
@@ -3299,7 +3299,7 @@ exception[rules] {
|
||||
</div>
|
||||
<p>This exception is applied to <a href="https://github.com/aquasecurity/defsec/blob/master/internal/rules/kubernetes/policies/pss/restricted/3_runs_as_root.rego">KSV012</a> in defsec.
|
||||
You can get the package names in the <a href="https://github.com/aquasecurity/defsec/">defsec repository</a> or the JSON output from Trivy.</p>
|
||||
<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/rule-exception">an example</a>.</p>
|
||||
<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/rule-exception">an example</a>.</p>
|
||||
|
||||
|
||||
</article>
|
||||
|
||||
@@ -3305,7 +3305,7 @@ For example, it may be useful when your file name of Dockerfile doesn't match th
|
||||
<p>A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example:
|
||||
<div class="highlight"><pre><span></span><code>--file-patterns "dockerfile:.*.docker" --file-patterns "yaml:deployment" --file-patterns "pip:requirements-.*\.txt"
|
||||
</code></pre></div></p>
|
||||
<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/0c4cd955e3c0cd37ed1acff4b7ac44dbf6eddd92/examples/misconf/file-patterns">an example</a></p>
|
||||
<p>For more details, see <a href="https://github.com/aquasecurity/trivy/tree/ed590966a3efdaf6cbb48e34bfb36ea0884e45d8/examples/misconf/file-patterns">an example</a></p>
|
||||
<h2 id="exit-code">Exit Code</h2>
|
||||
<p>By default, <code>Trivy</code> exits with code 0 even when vulnerabilities are detected.
|
||||
Use the <code>--exit-code</code> option if you want to exit with a non-zero exit code.</p>
|
||||
|
||||
Binary file not shown.
Reference in New Issue
Block a user