# macOS
brew install trivy

# Linux (Debian/Ubuntu)
sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy

# Version prüfen
trivy version

# Einfacher Image-Scan
trivy image nginx:1.27

# Nur kritische und hohe Schwachstellen anzeigen
trivy image --severity HIGH,CRITICAL python:3.12-slim

# Scan mit Exit-Code 1 bei kritischen Findings (für CI/CD)
trivy image --exit-code 1 --severity CRITICAL myapp:latest

# Lokales Image scannen (ohne Pull)
trivy image --input ./myapp-image.tar

# Lokales Projektverzeichnis scannen (Dockerfile, package.json, go.sum etc.)
trivy fs .

# Git-Repository direkt scannen
trivy repo https://github.com/mein-org/meine-app

# Kubernetes-Manifeste auf Fehlkonfigurationen prüfen
trivy config ./k8s-manifests/

# .github/workflows/trivy-scan.yml
name: Trivy Container Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy Vulnerability Scan
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'
          ignore-unfixed: true

      - name: Trivy SARIF Upload (optional)
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

# Helm-Repo hinzufügen
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm repo update

# Trivy Operator installieren
helm install trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --create-namespace \
  --set trivy.ignoreUnfixed=true

# Alle Reports auflisten
kubectl get vulnerabilityreports -A

# Details für ein bestimmtes Workload
kubectl get vulnerabilityreports -n production -l trivy-operator.resource.name=frontend -o yaml

# Nur kritische Findings filtern
kubectl get vulnerabilityreports -A -o json | \
  jq '.items[] | select(.report.summary.criticalCount > 0) | {namespace: .metadata.namespace, name: .metadata.labels["trivy-operator.resource.name"], critical: .report.summary.criticalCount}'

#!/bin/bash
# critical-vuln-alert.sh — als CronJob im Cluster deployen
CRITICAL=$(kubectl get vulnerabilityreports -A -o json | \
  jq '[.items[] | .report.summary.criticalCount] | add')

if [ "$CRITICAL" -gt 0 ]; then
  curl -X POST "$SLACK_WEBHOOK" \
    -H 'Content-Type: application/json' \
    -d "{\"text\": \"⚠️ $CRITICAL kritische Schwachstellen im Cluster gefunden\"}"
fi

# .trivyignore — bekannte False Positives ausschließen
# CVE-2024-1234  # Erklärung warum ignoriert
# CVE-2024-5678  # Nicht relevant für unseren Use-Case

# Trivy mit Cache für schnellere Scans (CI/CD)
trivy image --cache-dir /tmp/trivy-cache --severity HIGH,CRITICAL myapp:latest

helm upgrade trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --set operator.scanJobsConcurrentLimit=3 \
  --set operator.scanJobsRetryDelay=30s \
  --set trivyOperator.scanJobPodTemplateLabels="app=trivy-scan"