Make operational container scanning severity filter configurable

Proposal

Operational Container Scanning runs Container Scanning in the context of a Kubernetes Cluster. This gives customers insight into what's actually deployed and running in their environments. Much like container scanning, the option to have Trivy filter out findings beneath a severity threshold is possible. We should allow users to configure this behavior as well, so that they can tailor reported vulnerabilities to their specification.

Implementation

  • Add a --severity or --severity-threshold flag to the trivy-k8s-wrapper.
  • Update the gitlab-agent project's wrapper schema, so that it exposes this configuration value. You can use Support custom ocs trivy k8s wrapper image (gitlab-org/cluster-integration/gitlab-agent!1733 - merged) as a reference point on how to do this.
  • Update the configuration documentation

/cc @johncrowley @onaaman

Edited Sep 03, 2025 by Nick Ilieskou
Assignee Loading
Time tracking Loading