Cannot authenticate to Azure Container Registry

[imbelchev]

Hello,

I have trivy operator deployed into an Azure Kubernetes cluster
I want to scan the images of all running services inside of the cluster.
The images are stored in Azure Container Registry. The registry is configured with username ad password for access.

For the purpose I have selected this option for accessing private registries - "Using an ImagePullSecret to access containers from the Private Registry"

I have prepared everything needed as per the docs, however in the end I always receive Unauthorized error messages. The only scan results that are being collected are for calico-system, kube-system, tigera-operator. Nothing from my private repo is being scanned.

Please advise what I am doing wrong. Any help is appreciated.

Error message:

{
    "level": "error",
    "ts": "2023-06-02T06:34:41Z",
    "logger": "reconciler.scan job",
    "msg": "Scan job container",
    "job": "my-security-namespace/scan-vulnerabilityreport-6889c794b6",
    "container": "httpbin",
    "status.reason": "Error",
    "status.message": "2023-06-02T06:34:38.820Z\t\u001b[31mFATAL\u001b[0m\timage scan error: scan error: unable to initialize a scanner: unable to initialize a docker scanner: 4 errors occurred:\n\t* unable to inspect the image (myregistry.azurecr.io/myrepo/myimage:1.1.1): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?\n\t* unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory\n\t* containerd socket not found: /run/containerd/containerd.sock\n\t* GET https://myregistry.azurecr.io/oauth2/token?scope=repository%3Amyrepo%2Fmyimage%3Apull&service=myregistry.azurecr.io: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.\n\n\n",
    "stacktrace": "github.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport/controller.(*ScanJobController).processFailedScanJob\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/vulnerabilityreport/controller/scanjob.go:260\ngithub.com/aquasecurity/trivy-operator/pkg/vulnerabilityreport/controller.(*ScanJobController).reconcileJobs.func1\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/vulnerabilityreport/controller/scanjob.go:79\nsigs.k8s.io/controller-runtime/pkg/reconcile.Func.Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/reconcile/reconcile.go:102\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:122\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:323\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:235"
}

Here are all related files:
imagepullsecret.yaml - the docker config secret

apiVersion: v1
kind: Secret
type: kubernetes.io/dockerconfigjson
metadata:
  name: my-registry-secret
  namespace: my-security-namespace
data:
  .dockerconfigjson: {{ template "imagePullSecret" . }}

_imagepullsecret-helpers.tpl - here is how the docker config is being built

{{- define "imagePullSecret" }}

{{- $password := "" }}
{{- $existingSecret := (lookup "v1" "Secret" .Release.Namespace "my-registry-secret-auth") }}

{{- if $existingSecret }}
{{- $password = (index $existingSecret.data "my-registry-pwd") | b64dec }}
{{- end }}

{{- with .Values.myregistry }}
{{- printf "{\"auths\":{\"%s\":{\"auth\":\"%s\"}}}" .registry (printf "%s:%s" .username $password | b64enc) | b64enc }}
{{- end }}

{{- end }}

Values.yaml - showing just one part of how we use the dockerconfigjson

# code removed for clarity
trivy:
  # createConfig indicates whether to create config objects
  createConfig: true
  image:
    registry: myregistry.azurecr.io
    repository: myrepo/trivy
    tag: 0.41.0
    pullPolicy: IfNotPresent
    # imagePullSecret is the secret name to be used when pulling trivy image from private registries example : reg-secret
    # It is the user responsibility to create the secret for the private registry in `trivy-operator` namespace
    imagePullSecret:
      - name: my-registry-secret
# code removed for clarity

[imbelchev]

Use privateRegistryScanSecretsNames instead of imagePullSecret

[chen-keinan]

@imbelchev I'll be adding Azure workload identity support #1057 next week if that help