github.com/devseccon/trivy@v0.47.1-0.20231123133102-bd902a0bd996/docs/tutorials/kubernetes/gitops.md (about)

     1  # Installing the Trivy-Operator through GitOps
     2  
     3  This tutorial shows you how to install the Trivy Operator through GitOps platforms, namely ArgoCD and FluxCD.
     4  
     5  ## ArgoCD
     6  
     7  Make sure to have [ArgoCD installed](https://argo-cd.readthedocs.io/en/stable/getting_started/) and running in your Kubernetes cluster.
     8  
     9  You can either deploy the Trivy Operator through the argocd CLI or by applying a Kubernetes manifest.
    10  
    11  ArgoCD command:
    12  ```
    13  > kubectl create ns trivy-system
    14  > argocd app create trivy-operator --repo https://github.com/devseccon/trivy-operator --path deploy/helm --dest-server https://kubernetes.default.svc --dest-namespace trivy-system
    15  ```
    16  Note that this installation is directly related to our official Helm Chart. If you want to change any of the value, we'd suggest you to create a separate values.yaml file.
    17  
    18  Kubernetes manifest `trivy-operator.yaml`:
    19  ```
    20  apiVersion: argoproj.io/v1alpha1
    21  kind: Application
    22  metadata:
    23    name: trivy-operator
    24    namespace: argocd
    25  spec:
    26    project: default
    27    source:
    28      chart: trivy-operator
    29      repoURL: https://aquasecurity.github.io/helm-charts/
    30      targetRevision: 0.0.3
    31      helm:
    32        values: |
    33          trivy:
    34            ignoreUnfixed: true
    35    destination:
    36      server: https://kubernetes.default.svc
    37      namespace: trivy-system
    38    syncPolicy:
    39      automated:
    40        prune: true
    41        selfHeal: true
    42  ```
    43  
    44  To apply the Kubernetes manifest, if you have the manifest locally, you can use the following command through kubectl:
    45  ```
    46  > kubectl apply -f trivy-operator.yaml
    47  
    48  application.argoproj.io/trivy-operator created
    49  ```
    50  
    51  If you have the manifest in a Git repository, you can apply it to your cluster through the following command:
    52  ```
    53  > kubectl apply -n argocd -f https://raw.githubusercontent.com/AnaisUrlichs/argocd-starboard/main/starboard/argocd-starboard.yaml
    54  ```
    55  The latter command would allow you to make changes to the YAML manifest that ArgoCD would register automatically.
    56  
    57  Once deployed, you want to tell ArgoCD to sync the application from the actual state to the desired state:
    58  ```
    59  argocd app sync trivy-operator
    60  ```
    61  
    62  Now you can see the deployment in the ArgoCD UI. Have a look at the ArgoCD documentation to know how to access the UI.
    63  
    64  ![ArgoCD UI after deploying the Trivy Operator](../../imgs/argocd-ui.png)
    65  
    66  Note that ArgoCD is unable to show the Trivy CRDs as synced.
    67  
    68  
    69  ## FluxCD
    70  
    71  Make sure to have [FluxCD installed](https://fluxcd.io/docs/installation/#install-the-flux-cli) and running in your Kubernetes cluster.
    72  
    73  You can either deploy the Trivy Operator through the Flux CLI or by applying a Kubernetes manifest.
    74  
    75  Flux command:
    76  ```
    77  > kubectl create ns trivy-system
    78  > flux create source helm trivy-operator --url https://aquasecurity.github.io/helm-charts --namespace trivy-system
    79  > flux create helmrelease trivy-operator --chart trivy-operator
    80    --source HelmRepository/trivy-operator
    81    --chart-version 0.0.3
    82    --namespace trivy-system
    83  ```
    84  
    85  Kubernetes manifest `trivy-operator.yaml`:
    86  ```
    87  apiVersion: source.toolkit.fluxcd.io/v1beta2
    88  kind: HelmRepository
    89  metadata:
    90    name: trivy-operator
    91    namespace: flux-system
    92  spec:
    93    interval: 60m
    94    url: https://aquasecurity.github.io/helm-charts/
    95  
    96  ---
    97  apiVersion: helm.toolkit.fluxcd.io/v2beta1
    98  kind: HelmRelease
    99  metadata:
   100    name: trivy-operator
   101    namespace: trivy-system
   102  spec:
   103    chart:
   104      spec:
   105        chart: trivy-operator
   106        sourceRef:
   107          kind: HelmRepository
   108          name: trivy-operator
   109          namespace: flux-system
   110        version: 0.10.1
   111    interval: 60m
   112    values:
   113      trivy:
   114        ignoreUnfixed: true
   115    install:
   116      crds: CreateReplace
   117      createNamespace: true
   118  ```
   119  
   120  You can then apply the file to your Kubernetes cluster:
   121  ```
   122  kubectl apply -f trivy-operator.yaml
   123  ```
   124  
   125  ## After the installation
   126  
   127  After the install, you want to check that the Trivy operator is running in the trivy-system namespace:
   128  ```
   129  kubectl get deployment -n trivy-system
   130  ```
   131