Skip to content

Istio Hardening📜

Refer to the bb-common documentation for additional hardening details.

Trivy vulnerability database access📜

When Trivy is enabled, it downloads vulnerability database artifacts from the following external registries:

  • ghcr.io
  • mirror.gcr.io

When Istio is enabled with restricted outbound traffic, Harbor provides the trivy-upstream-artifacts ServiceEntry to permit TLS traffic to these registries on port 443.

When NetworkPolicies are enabled, Harbor also provides the allow-trivy-upstream-artifacts egress NetworkPolicy. This policy selects only the Harbor Trivy workload and permits external egress while excluding the instance metadata endpoint at 169.254.169.254/32.

The relevant settings are enabled through:

istio:
  enabled: true

networkPolicies:
  enabled: true