Q1-Trivy.md

Question - Trivy

There are a number of pods running in the "spectacle" namespace. Identify and delete the pods which have CRITICAL vulnerabilities.

Solution

Solution

• Trivy docs

1 - get all images of pods running in the 'spectacle' namepsace

kubectl -n spectacle get pods -o yaml | grep -E "image"

2 - scan each image using "trivy image "

trivy image --severity CRITICAL nginx:1.16

Run the above command for all the images found in step 1. If the images have CRITICAL vulnerabilities, delete the pod associated with that image.

3 - Delete the pods

kubectl -n spectacle delete pod <PODNAME>

Do the above procedure as many times as required to delete all pods with CRITICAL vulnerabilities.