secureCodeBox · Ilyesbdlala · Jul 25, 2023 · Feb 28, 2023 · Jul 25, 2023
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
@@ -50,3 +50,4 @@ Committing with `git commit -s` will add the sign-off at the end of the commit m
 - Vanessa Hermann <vanessa.hermann@iteratec.com>
 - Lukas Fischer <lukas.fischer@iteratec.com>
 - Heiko Kiesel <heiko.kiesel@iteratec.com>
+- Frank Belter <frank.belter@iteratec.com>
diff --git a/scanners/trivy/.helm-docs.gotmpl b/scanners/trivy/.helm-docs.gotmpl
@@ -39,13 +39,15 @@ The following security scan configuration example are based on the [Trivy Docume
 
 ### Trivy Container Image Scan
 
-Currently we support the follwing 3 scanTypes, corresponding to the trivy scanning modes:
+Currently we support the follwing 4 scanTypes, corresponding to the trivy scanning modes:
 - scanType: "trivy-image"
    - parameters: `[YOUR_IMAGE_NAME]`
 - scanType: "trivy-filesystem"
    - parameters: `[YOUR_PATH_TO_FILES]`
 - scanType: "trivy-repo"
    - parameters: `[YOUR_GITHUB_REPO]`
+- scanType: "trivy-k8s"
+   - parameters: `[KUBERNETES_RESOURCE]`
 
 A complete example of each scanType are listed below in our [example docs section](https://www.securecodebox.io/docs/scanners/trivy/#examples).
 

diff --git a/scanners/trivy/examples/k8s/README.md b/scanners/trivy/examples/k8s/README.md
@@ -0,0 +1,7 @@
+<!--
+SPDX-FileCopyrightText: the secureCodeBox authors
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+This example shows how to use the `trivy k8s` scan with the secureCodeBox.
diff --git a/scanners/trivy/examples/k8s/scan.yaml b/scanners/trivy/examples/k8s/scan.yaml
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: the secureCodeBox authors
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: "execution.securecodebox.io/v1"
+kind: Scan
+metadata:
+  name: "trivy-k8s"
+spec:  
+  scanType: "trivy-k8s"
+  parameters:
+    - "cluster"
diff --git a/scanners/trivy/integration-tests/trivy.test.js b/scanners/trivy/integration-tests/trivy.test.js
@@ -98,3 +98,30 @@ test(
   },
   3 * 60 * 1000
 );
+
+test(
+  "trivy k8s scan should not fail",
+  async () => {
+    const { categories, severities, count } = await scan(
+      "trivy-k8s-test",
+      "trivy-k8s",
+      ["cluster"],
+      10 * 60 * 1000
+    );
+
+    // since the state of the k8s cluster in the test environment cannot be predicted, only the structure of the result is assured here
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    const categoryNames = Object.keys(categories);
+    expect(categoryNames).toHaveLength(2);
+    expect(categoryNames.includes("Misconfiguration")).toBeTruthy();
+    expect(categoryNames.includes("Vulnerability")).toBeTruthy();
+
+    const severityNames = Object.keys(severities);
+    expect(severityNames).toHaveLength(3);
+    expect(severityNames.includes("high")).toBeTruthy();
+    expect(severityNames.includes("low")).toBeTruthy();
+    expect(severityNames.includes("medium")).toBeTruthy();
+  },
+  10 * 60 * 1000
+);