137 lines
3.2 KiB
Bash
Executable File
137 lines
3.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Trivy Operator 部署脚本（适配国内网络环境）
|
|
|
|
set -e
|
|
|
|
echo "=== 🚀 部署 Trivy Operator（国内网络优化）==="
|
|
|
|
# 检查 Helm
|
|
if ! command -v helm &> /dev/null; then
|
|
echo "❌ 未安装 Helm"
|
|
exit 1
|
|
fi
|
|
|
|
# 添加 Aqua Security Helm repo
|
|
echo "📦 添加 Helm 仓库..."
|
|
helm repo add aqua https://aquasecurity.github.io/helm-charts/ 2>/dev/null || true
|
|
helm repo update
|
|
|
|
# 创建命名空间
|
|
echo "📂 创建命名空间..."
|
|
kubectl create namespace trivy-system --dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
# 方案 1: 尝试使用阿里云镜像（最快）
|
|
echo ""
|
|
echo "=== 方案 1: 尝试使用阿里云镜像加速 ==="
|
|
|
|
# 创建自定义 values 文件
|
|
cat > /tmp/trivy-operator-values.yaml << 'EOF'
|
|
# 使用阿里云镜像加速
|
|
image:
|
|
registry: registry.cn-hangzhou.aliyuncs.com
|
|
repository: google_containers/trivy-operator
|
|
tag: "0.29.0"
|
|
|
|
trivy:
|
|
image:
|
|
registry: registry.cn-hangzhou.aliyuncs.com
|
|
repository: google_containers/trivy
|
|
tag: "0.50.0"
|
|
|
|
ignoreUnfixed: true
|
|
severity: "CRITICAL,HIGH,MEDIUM"
|
|
|
|
operator:
|
|
scanJobsConcurrentLimit: 3
|
|
scanJobTimeout: 10m
|
|
metricsBindAddress: ":8080"
|
|
|
|
serviceMonitor:
|
|
enabled: false
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 1
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
EOF
|
|
|
|
echo "⏳ 安装 Trivy Operator（使用阿里云镜像）..."
|
|
if helm install trivy-operator aqua/trivy-operator \
|
|
--namespace trivy-system \
|
|
--values /tmp/trivy-operator-values.yaml \
|
|
--timeout 3m \
|
|
--wait 2>/dev/null; then
|
|
|
|
echo ""
|
|
echo "✅ 方案 1 成功！使用阿里云镜像部署完成"
|
|
|
|
else
|
|
echo ""
|
|
echo "⚠️ 方案 1 失败，尝试方案 2..."
|
|
|
|
# 清理失败的部署
|
|
helm uninstall trivy-operator -n trivy-system 2>/dev/null || true
|
|
sleep 5
|
|
|
|
# 方案 2: 使用默认镜像源（Docker Hub 可能很慢）
|
|
echo ""
|
|
echo "=== 方案 2: 使用默认镜像源（可能较慢）==="
|
|
|
|
# 使用默认配置
|
|
cat > /tmp/trivy-operator-values-default.yaml << 'EOF'
|
|
trivy:
|
|
ignoreUnfixed: true
|
|
severity: "CRITICAL,HIGH,MEDIUM"
|
|
|
|
operator:
|
|
scanJobsConcurrentLimit: 3
|
|
scanJobTimeout: 10m
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 1
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
EOF
|
|
|
|
echo "⏳ 安装 Trivy Operator（使用默认镜像源，可能需要较长时间）..."
|
|
if helm install trivy-operator aqua/trivy-operator \
|
|
--namespace trivy-system \
|
|
--values /tmp/trivy-operator-values-default.yaml \
|
|
--timeout 10m \
|
|
--wait; then
|
|
|
|
echo ""
|
|
echo "✅ 方案 2 成功！使用默认镜像部署完成"
|
|
|
|
else
|
|
echo ""
|
|
echo "❌ 方案 2 也失败了"
|
|
echo ""
|
|
echo "建议："
|
|
echo "1. 检查网络连接"
|
|
echo "2. 手动从 EU Harbor 服务器下载镜像"
|
|
echo "3. 或者跳过 Trivy Operator，使用其他安全扫描工具"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# 验证部署
|
|
echo ""
|
|
echo "=== 🔍 验证部署 ==="
|
|
kubectl get pods -n trivy-system
|
|
kubectl get deployment -n trivy-system
|
|
|
|
echo ""
|
|
echo "✅ Trivy Operator 部署完成！"
|
|
echo ""
|
|
echo "下一步："
|
|
echo "1. 等待扫描完成（约 5-10 分钟）"
|
|
echo "2. 查看漏洞报告: kubectl get vulnerabilityreports -A"
|
|
echo "3. 查看配置审计: kubectl get configauditreports -A"
|