Can I use trivy client --remote on trivy deployed in harbor? about harbor-scanner-trivy HOT 5 CLOSED

@vzanlnx Currently we do not support K8S deployment descriptor for Trivy server, but I believe that you can create one relatively easy with our official docker.io/aquasec/trivy:0.4.4 Docker image. Just run a Pod with the server command and args. If you expose it with K8S Service you should be able to connect to it with Trivy client from outside of the cluster.

We've created a follow up issue #77 to consider whether harbor-scanner-trivy should expose twirp endpoint and serve both Harbor and Trivy clients. Feel free to vote on that one and provide more details about your use case there.

from harbor-scanner-trivy.

Hi @vzanlnx ! Thank you for the question. It's a good one.

Trivy client/server mode and Harbor scanner adapter for Trivy are two different things.

To some extent they are similar, but have different intended clients and communication protocols. harbor-scanner-trivy exposes the REST API which is consumed by Harbor core services, whereas Trivy server exposes gRPC endpoint consumable by Trivy client.

That said, the following command won't work:

$ trivy client --remote https://harbor-trivy.mydomain:8443 image:tag

I hope it's clear now. /cc @knqyf263

from harbor-scanner-trivy.

It's not gRPC, but twirp over ProtocolBuffer. Anyway, Trivy client is designed to send a request to Trivy server launched by $ trivy server exposing twirp endpoint. As @danielpacak said, harbor-scanner-trivy is intended to take a request from Harbor core services. They are different servers.

from harbor-scanner-trivy.

Thanks for your quick answer on this, much appreciated.

So, is there a supported way to deploy a trivy server on k8s in order to use this way I want?

So I may have two trivy deployments in my k8s cluster, one for harbor and another one for use with client --remote. Is there some doc on this? I didn`t find one.

let me know if my question is not clear.

thanks!

from harbor-scanner-trivy.

Closing this one as we've answered the original question. There's a follow up created #77

from harbor-scanner-trivy.