When Security Scans Break the Brain: Solving Trivy’s etcd Exhaustion Problem

This article explains how Trivy Operator vulnerability reports stored as Kubernetes CRDs can produce excessive etcd MVCC churn and large objects (hitting the 1.5 MiB API limit), which may exhaust etcd storage and render the API server read-only. It outlines mitigations including moving reports off-etcd to a PVC, configuring report TTLs, running regular etcd compaction and defragmentation, switching to Client-Server mode to reduce scanner overhead, and filtering by severity to limit stored data.