Security
Runtime security and vulnerability scanning: Falco, Kyverno, and Trivy.
Three layers, at three different moments:
| When it acts | What it does | |
|---|---|---|
| Kyverno | Admission | Rejects or mutates resources before they are created |
| Trivy | After admission, continuously | Scans running workloads for known CVEs |
| Falco | Runtime | Watches syscalls and alerts on suspicious behaviour |
Only Kyverno is preventive. Trivy reports on what is already running, and Falco detects behaviour after it happens.