Demo Trivy Kubernetes

This guide shows how to integrate Trivy image vulnerability scanning into a Jenkins pipeline that:

Builds a Docker image,
Pushes it to Docker Hub,
Runs multiple Kubernetes security checks (OPA, Kubesec) in parallel with Trivy,
Deploys the image to a Kubernetes cluster only if scan thresholds pass.

The same approach works for scanning images pulled from registries prior to deployment.

Quick overview

Build and push Docker image.
Run parallel security scans:
- OPA (conftest)
- Kubesec
- Trivy (image vulnerability scanner)
Fail the pipeline if configured thresholds (e.g., CRITICAL) are met; otherwise continue to deployment.

Pipeline snippet — where Trivy fits

Below is the relevant part of the Jenkinsfile. The Trivy scan stage runs in parallel with other Kubernetes checks and is placed after Docker build/push and before Kubernetes deployment.

stage('Docker Build and Push') {
    steps {
        withDockerRegistry([credentialsId: "docker-hub", url: ""]) {
            sh 'printenv'
            sh 'sudo docker build -t siddharth67/numeric-app:"$GIT_COMMIT" .'
            sh 'docker push siddharth67/numeric-app:"$GIT_COMMIT"'
        }
    }
}

stage('Vulnerability Scan - Kubernetes') {
    steps {
        parallel(
            "OPA Scan": {
                sh 'docker run --rm -v $(pwd):/project openpolicyagent/conftest test --policy opa-k8s-security.rego k8s_deployment_service.yaml'
            },
            "Kubesc Scan": {
                sh "bash kubesec-scan.sh"
            },
            "Trivy Scan": {
                sh "bash trivy-k8s-scan.sh"
            }
        )
    }
}

stage('K8S Deployment - DEV') {
    steps {
        parallel(
            "Deployment": {
                withKubeConfig([credentialsId: 'kubeconfig']) {
                    sh "bash k8s-deployment.sh"
                }
            },
            "Rollout Status": {
                withKubeConfig([credentialsId: 'kubeconfig']) {
                    sh "bash k8s-deployment-rollout-status.sh"
                }
            }
        )
    }
}

Recommended pipeline stage mapping

Stage	Purpose	Example command
Build & Push	Build Docker image and push to registry	`docker build -t <image>:${GIT_COMMIT} . && docker push <image>:${GIT_COMMIT}`
Vulnerability Scan (parallel)	Run static/registry scans (OPA, Kubesec, Trivy)	`bash trivy-k8s-scan.sh`
K8s Deployment	Deploy to cluster and check rollout	`kubectl apply -f ...` / `kubectl rollout status ...`

Trivy wrapper script (trivy-k8s-scan.sh)

Create a single script in your repository so Jenkins can call it as part of the pipeline. The example below:

Uses Trivy inside Docker (no local install required).
Runs two scans:
- A non-failing scan for LOW/MEDIUM/HIGH (exit code 0).
- A failing scan for CRITICAL (exit code 1) so the pipeline fails when criticals exist.
Mounts $WORKSPACE as the Trivy cache to speed up subsequent scans.

#!/bin/bash
# Image name should be provided through the environment (e.g. imageName="siddharth67/numeric-app:${GIT_COMMIT}")
echo "$imageName"

# Use the workspace as Trivy cache to speed up scans on successive runs
docker run --rm -v "$WORKSPACE":/root/.cache/trivy aquasec/trivy:0.17.2 -q image --exit-code 0 --severity LOW,MEDIUM,HIGH --light "$imageName"
docker run --rm -v "$WORKSPACE":/root/.cache/trivy aquasec/trivy:0.17.2 -q image --exit-code 1 --severity CRITICAL --light "$imageName"

# Trivy scan result processing
exit_code=$?
echo "Exit Code : $exit_code"

# Check scan results
if [[ ${exit_code} == 1 ]]; then
    echo "Image scanning failed. Critical vulnerabilities found"
    exit 1
else
    echo "Image scanning passed. No critical vulnerabilities found"
fi

Make sure imageName is exported in the pipeline environment and that the Jenkins agent has permissions to run Docker commands. The second Trivy run intentionally returns exit code 1 when CRITICAL vulnerabilities are found to stop the pipeline.

Example environment block in Jenkinsfile

Define imageName (and other deployment variables) so the scan script can access the built image reference:

pipeline {
    agent any

    environment {
        deploymentName = "devsecops"
        containerName = "devsecops-container"
        serviceName = "devsecops-svc"
        imageName = "siddharth67/numeric-app:${GIT_COMMIT}"
        applicationURL = "http://devsecops-demo.eastus.cloudapp.azure.com/"
        applicationURI = "/increment/99"
    }

    stages {
        stage('Build Artifact - Maven') {
            steps {
                sh "mvn clean package -DskipTests=true"
                archive 'target/*.jar'
            }
        }

        stage('Unit Tests - JUnit and JaCoCo') {
            steps {
                sh "mvn test"
            }
        }

        stage('Mutation Tests - PIT') {
            steps {
                sh "mvn org.pitest:pitest-maven:mutationCoverage"
            }
        }

        stage('SonarQube - SAST') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh "mvn sonar:sonar \
                        -Dsonar.projectKey=numeric-application \
                        -Dsonar.host.url=http://devsecops-demo.eastus.cloudapp.azure.com:9000"
                }
            }
        }

        // The Docker build, scan, and deploy stages follow here...
    }
}

Example Trivy output and what it shows

When Trivy finds vulnerabilities, it reports:

Affected file or component (e.g., app.jar),
Vulnerability ID (CVE),
Severity level,
Installed version and suggested fixed versions (when available).

Sample scan output (extracted from a CI run):

+ bash trivy-k8s-scan.sh
siddharth67/numeric-app:a48303b59baf8a0900cdba275f48396d47590a3

siddharth67/numeric-app:a48303b59baf8a0900cdba275f48396d47590a3 (alpine 3.13.5)
===========================================================
Total: 0 (LOW: 0, MEDIUM: 0, HIGH: 0)


home/k8s-pipeline/app.jar
=========================
Total: 5 (LOW: 0, MEDIUM: 2, HIGH: 3)

+-------------------------------+----------------------+----------+-------------------+-----------------------------+
| LIBRARY                       | VULNERABILITY ID     | SEVERITY | INSTALLED VERSION | FIXED VERSION               |
+-------------------------------+----------------------+----------+-------------------+-----------------------------+
| org.apache.tomcat.embed:tomcat-embed-core                                                   |
|                               | CVE-2020-17527       | HIGH     | 9.0.39            | 8.5.60, 9.0.40, 10.0.2      |
|                               | CVE-2021-25122       |          |                   | 8.5.63, 9.0.43, 10.0.2      |
|                               | CVE-2021-25329       |          |                   | 7.0.108, 8.5.61, 9.0.41,    |
|                               |                      |          |                   | 10.0.2                      |
|                               | CVE-2021-24122       | MEDIUM   |                   | 7.0.107, 8.5.60, 9.0.40,    |
|                               |                      |          |                   | 10.0.0-M10                  |
+-------------------------------+----------------------+----------+-------------------+-----------------------------+
| org.apache.tomcat.embed:tomcat-embed-websocket                                              |
|                               |                      |          | 10.0.0-M10, 9.0.40, 8.5.60 |                         |
|                               |                      |          | 7.0.107            |                             |
+-------------------------------+----------------------+----------+-------------------+-----------------------------+

siddharth67/numeric-app:a48303b59baf8a0900cdba275f48396d47590a3 (alpine 3.13.5)
===========================================================
Total: 0 (CRITICAL: 0)

Exit Code : 0
Image scanning passed. No vulnerabilities found

A Jenkins Dependency-Check Results screen showing a severity distribution bar and a table listing vulnerable JAR files with CVE IDs and severity levels. The left sidebar shows Jenkins project navigation and a small user webcam thumbnail appears in the top-right.

Remediation example — update Tomcat in Spring Boot POM

If Trivy points to Tomcat vulnerabilities originating from a Spring Boot-managed dependency, update the Tomcat version in your pom.xml properties (or upgrade the Spring Boot parent). Example:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.3.5.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
  </parent>

  <groupId>com.devsecops</groupId>
  <artifactId>numeric</artifactId>
  <version>0.0.1</version>
  <name>numeric</name>
  <description>Demo for DevSecOps</description>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <java.version>1.8</java.version>
    <!-- Update tomcat.version to a fixed version suggested by Trivy -->
    <tomcat.version>9.0.43</tomcat.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <!-- other dependencies -->
  </dependencies>
</project>

When updating dependency versions, always run your unit/integration tests and validate application behavior. Some upgrades may require code changes—verify in a non-production environment first.

After committing the POM change and rerunning the pipeline, Trivy output should reflect the updated artifact and (when compatible) show vulnerabilities resolved.

A Jenkins Blue Ocean pipeline activity page for "devsecops-numeric-application" showing a list of recent build runs with status icons, run numbers, commit messages and durations. The screenshot also shows the browser tabs/bookmarks bar and a circular user photo overlay in the top-right.

Successful re-scan example (no vulnerabilities):

+ bash trivy-k8s-scan.sh
siddharth67/numeric-app:68e6b5f456a288d356ea1406c1b959f36c334cf6

siddharth67/numeric-app:68e6b5f456a288d356ea1406c1b959f36c334cf6 (alpine 3.13.5)
===========================================================================
Total: 0 (LOW: 0, MEDIUM: 0, HIGH: 0)


siddharth67/numeric-app:68e6b5f456a288d356ea1406c1b959f36c334cf6 (alpine 3.13.5)
===========================================================================
Total: 0 (CRITICAL: 0)

Exit Code : 0
Image scanning passed. No vulnerabilities found

Best practices and final notes

Different scanners (Trivy, Dependency-Check, etc.) may return different results due to varying vulnerability databases and heuristics. Treat each finding as an investigation item.
Tune severity thresholds for Trivy to match your risk policy. Use exit codes to enforce fail/allow rules.
Use the workspace cache (-v "$WORKSPACE":/root/.cache/trivy) to speed repeated scans.
Consider scanning both the base image and application artifacts (JAR/WAR) included in the image to get a full picture.
Store credentials (Docker Hub, kubeconfig) securely in Jenkins Credentials and reference them in the pipeline with the proper wrappers.

Links and references

Trivy: https://github.com/aquasecurity/trivy
Jenkins Blue Ocean: https://www.jenkins.io/projects/blueocean/
Open Policy Agent (conftest): https://www.conftest.dev/
Kubesec: https://kubesec.io/

That’s it — integrate Trivy into your Jenkins pipeline to block risky deployments and make vulnerability remediation actionable in CI.

Introduction

DevSecOps Pipeline

Kubernetes Operations and Security

HashiCorp Vault + Kubernetes

Additional Topics

DevOps Pipeline

Demo Trivy Kubernetes

Quick overview

Pipeline snippet — where Trivy fits

Recommended pipeline stage mapping

Trivy wrapper script (trivy-k8s-scan.sh)

Example environment block in Jenkinsfile

Example Trivy output and what it shows

Remediation example — update Tomcat in Spring Boot POM

Best practices and final notes

Links and references

Watch Video

Practice Lab

​Quick overview

​Pipeline snippet — where Trivy fits

​Recommended pipeline stage mapping

​Trivy wrapper script (trivy-k8s-scan.sh)

​Example environment block in Jenkinsfile

​Example Trivy output and what it shows

​Remediation example — update Tomcat in Spring Boot POM

​Best practices and final notes

​Links and references

Watch Video

Practice Lab

Quick overview

Pipeline snippet — where Trivy fits

Recommended pipeline stage mapping

Trivy wrapper script (trivy-k8s-scan.sh)

Example environment block in Jenkinsfile

Example Trivy output and what it shows

Remediation example — update Tomcat in Spring Boot POM

Best practices and final notes

Links and references