The Security Center shows the reports of Trivy Operator across your cluster. It appears as Security in the sidebar, under Alerts, when the cluster serves Trivy Operator's report kinds. You can also open it with Security: Open Security Center.
The three views
| Key | View | Shows |
|---|---|---|
1 | Images | Vulnerabilities per container image, with the workloads that run it. An image used by several workloads is one row. Counts are the larger of the image's reports. |
2 | Resources | Misconfigurations (config audit) and exposed secrets per resource. Trivy Operator scans ReplicaSets and Pods, so the list shows ReplicaSets. |
3 | Roles | RBAC findings for Roles and ClusterRoles. |
Severity chips at the top (Critical, High, Medium, Low, Unknown) show totals and filter the table when you click them. There is a namespace menu and a filter box (/). Select a row to open a details panel with the findings of that report.
Details
- Vulnerabilities, worst first, with links to advisories (only
httpandhttpslinks). - Failed checks. Trivy Operator stores only failed checks.
- Exposed secrets: the rule and location. Kubyl never reads the matched value.
- The panel lists at most 300 findings. The CSV button exports all of them.
| Keys | Action |
|---|---|
| 1or2or3 | Images / Resources / Roles |
| / | Focus the filter |
Badge and overview
The sidebar row shows a red badge with the number of critical findings of all three views together. It is read once a minute for each cluster that serves Trivy, so it can lag a tab you have open, which is live. Clusters without Trivy Operator show nothing. The cluster and namespace overviews get a Security card with totals per severity and a line per view.
Export
Security: Export CSV exports the table, and the details panel can export a report's findings. Both follow the rules in Export a table as CSV.
When Trivy Operator is not installed
The view shows an empty state. It can install the trivy-operator chart into the trivy-system namespace through the Helm install flow, without adding a repository first, or copy the equivalent command:
$ helm repo add aqua <chart repository>$ helm repo update$ helm install trivy-operator aqua/trivy-operator \$ --namespace trivy-system --create-namespaceOn read-only clusters the install button is hidden and only the command is offered. On production clusters the Helm dialog asks you to type the cluster's name.
Performance and permissions
Lists are metadata-only watches plus the API server's table output, so thousands of reports cost a table, not their vulnerability arrays. A report's findings are fetched by name when you select its row. If a list is refused, the message names the verb and resource you need.