How to enable ClusterVulnerabilityReports?

[sudoleg]

Hello folks, I've deployed and configured the operator via Helm. It successfully generates Vulnerability-, ConfigAudit and InfraAssessment Reports, but I am missing the ClusterVulnerabilityReports. The ClusterVulnerability CRD is installed, but there are no resources based on it. I also can't find a corresponding 'enabling' option in the values... How can I enable this kind of report when deploying the operator via Helm?

Thanks in advance :)

[chen-keinan]

@sudoleg are you using native k8s or cloud ? currently only native or RKe2 clusters are supported

[sudoleg]

I am using a native k8s cluster

[chen-keinan]

which installation (vendor) are you using ?

[sudoleg]

we are using a completely self-provisioned cluster, basically "vanilla Kubernetes"

[chen-keinan]

@sudoleg do you mind sharing your configurations ?

[sudoleg]

No problem. FYI, we deploy the operator and the standalone trivy (server) in the namespace called trivy-system. I attached the contents of the configmaps for the operator and the server. I suppose all the values that aren't displayed in the configmaps are defaullts.

trivy-operator-trivy-config.json
trivy-operator-trivy-server.json

Hope those configs are the ones you requested

[chen-keinan]

@sudoleg I'm looking specific to see if the following two envvar are set:

OPERATOR_SBOM_GENERATION_ENABLED: true
OPERATOR_VULNERABILITY_SCANNER_ENABLED: true

[sudoleg]

The SBOM Generation is disabled. Do wen need this to enable ClusterVulnerability Reports?

[chen-keinan]

yes it is required.

[sudoleg]

I've enabled SBOM generation and now there is a ClusterVulnerability report, but it's empty for some reason (the vulnerabilities list is empty). I can't figure out why... Do you have an idea? @chen-keinan

[chen-keinan]

maybe your cluster do not have vulnerabilities , its only check vulnerabilites on core components (api-server , kubelet, controller-manager and etc)
see vulndb for k8s here

[sudoleg]

Hmmm ok... didn't expect that a cluster with 7 nodes based on Ubuntu 20.04 has no vulnerabilities (at least not listed in the repo you provided) but it seems like that 🤷‍♂️

Thank you for the quick respose! 👍

I think, it's not quite obvious from the docs/description that you have to enable SBOMs to activate ClusterVulnerabilityReports... May I submit a PR to adjust this Part of the documentation?