Trivy Kubernetes Scan Error #5639
-
QuestionHi there, I am doing trivy compliance scan in an EKS cluster. I am getting the following error for multiple times. I was trying same things in another account's EKS cluster, but get same errors. TargetNone ScannerNone Output FormatNone ModeNone Operating SystemUbuntu VersionVersion: 0.45.0 |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 48 replies
-
|
@Susanta2000 can you delete |
Beta Was this translation helpful? Give feedback.
-
|
I have the same problem but i cannot understand what i have to use to work. What did you use? |
Beta Was this translation helpful? Give feedback.
-
|
@Sk3pper can you comment to the original message and provide the reproduction steps and debug output? |
Beta Was this translation helpful? Give feedback.
-
|
No namespace, no job. |
Beta Was this translation helpful? Give feedback.
-
|
@holgerson97 thanks for the report. $ trivy k8s --report all --timeout 1h -d --skip-images
2024-08-07T18:42:30+06:00 DEBUG Parsed severities severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-08-07T18:42:30+06:00 DEBUG Ignore statuses statuses=[]
^C
$ trivy k8s --report all --timeout 1h -d --skip-images
2024-08-07T18:42:40+06:00 DEBUG Parsed severities severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-08-07T18:42:40+06:00 DEBUG Ignore statuses statuses=[]
2024-08-07T18:42:43+06:00 FATAL Fatal error
- get k8s artifacts with node info error:
github.com/aquasecurity/trivy/pkg/k8s/commands.clusterRun
/home/runner/work/trivy/trivy/pkg/k8s/commands/cluster.go:42
- running node-collector job: jobs.batch "node-collector-7868567fb6" already exists |
Beta Was this translation helpful? Give feedback.
-
but I can see a job: $ kubectl get jobs --all-namespaces
NAMESPACE NAME COMPLETIONS DURATION AGE
trivy-temp node-collector-7868567fb6 1/1 13s 14s
|
Beta Was this translation helpful? Give feedback.
-
|
I'm experiencing the same problem: ❯ trivy k8s --report --debug summary oidc@k8s-235-1
[... 5 minutes go by ...]
2024-09-23T17:26:23-04:00 FATAL Fatal error flag error: report flag error: unable to parse flag: invalid argument "--debug" for "--report" flag: must be one of ["all" "summary"]Using the suggested: Both times I see this job created: @Zecora:~/s/i/k/a/w/o/prod (master) [$!?⇡] ❯ kubectl get job -n trivy-temp
NAME STATUS COMPLETIONS DURATION AGE
node-collector-7c5b64fc7f Running 0/1 11s 11s
@Zecora:~/s/i/k/a/w/o/prod (master) [$!?⇡] ❯ kubectl get job -n trivy-temp
NAME STATUS COMPLETIONS DURATION AGE
node-collector-7c5b64fc7f Running 0/1 15s 15s
@Zecora:~/s/i/k/a/w/o/prod (master) [$!?⇡] ❯ kubectl get job -n trivy-temp
@Zecora:~/s/i/k/a/w/o/prod (master) [$!?⇡] ❯ kubectl logs -n trivy-temp job/node-collector-7c5b64fc7f
{"apiVersion":"v1","kind":"NodeInfo","metadata":{"creationTimestamp":"2024-09-23T21:37:42Z"},"type":"worker","info":{"certificateAuthoritiesFileOwnership":{"values":[]},"certificateAuthoritiesFilePermissions":{"values":[]},"kubeconfigFileExistsOwnership":{"values":[]},"kubeconfigFileExistsPermissions":{"values":[]},"kubeletAnonymousAuthArgumentSet":{"values":[]},"kubeletAuthorizationModeArgumentSet":{"values":[]},"kubeletClientCaFileArgumentSet":{"values":[]},"kubeletConfFileOwnership":{"values":[]},"kubeletConfFilePermissions":{"values":[]},"kubeletConfigYamlConfigurationFileOwnership":{"values":[]},"kubeletConfigYamlConfigurationFilePermission":{"values":[]},"kubeletEventQpsArgumentSet":{"values":[]},"kubeletHostnameOverrideArgumentSet":{"values":["sassaflash.235.tdude.co"]},"kubeletMakeIptablesUtilChainsArgumentSet":{"values":[]},"kubeletOnlyUseStrongCryptographic":{"values":[]},"kubeletProtectKernelDefaultsArgumentSet":{"values":[]},"kubeletReadOnlyPortArgumentSet":{"values":[]},"kubeletRotateCertificatesArgumentSet":{"values":[]},"kubeletRotateKubeletServerCertificateArgumentSet":{"values":[]},"kubeletServiceFileOwnership":{"values":[]},"kubeletServiceFilePermissions":{"values":[]},"kubeletStreamingConnectionIdleTimeoutArgumentSet":{"values":[]},"kubeletTlsCertFileTlsArgumentSet":{"values":[]},"kubeletTlsPrivateKeyFileArgumentSet":{"values":[]}}}% @Zecora:~/s/i/k/a/w/o/prod (master) [$!?⇡] ❯ kubectl get job -n trivy-temp
NAME STATUS COMPLETIONS DURATION AGE
node-collector-7c5b64fc7f Complete 1/1 27s 28s |
Beta Was this translation helpful? Give feedback.
-
|
as said @chen-keinan you can try to delete $ kubectl delete namespace trivy-tempwhich version of Trivy do you use? |
Beta Was this translation helpful? Give feedback.
-
|
Same issue, can't get results... ❯ 2024-11-17T21:51:16+02:00 FATAL Fatal error get k8s artifacts with node info error: running node-collector job: jobs.batch "node-collector-774d8bccc9" already exists |
Beta Was this translation helpful? Give feedback.
-
|
thanks for the report! $ kubectl delete namespace trivy-temp |
Beta Was this translation helpful? Give feedback.
-
|
Same issue on a kind cluster. Intent is to first test this on a KinD cluster running k8s version 1.31.2 before attempting it on my production cluster: I'm running the following trivy version: And finally, I'm attempting to run trivy using the following command: Any suggestions? |
Beta Was this translation helpful? Give feedback.
-
Trivy v0.58.0 too. could you try to set up tolerations on your clusters? $ trivy k8s --report summary -d --tolerations node-role.kubernetes.io/control-plane="":NoSchedule |
Beta Was this translation helpful? Give feedback.
-
|
I've created a new issue to track it #8087 |
Beta Was this translation helpful? Give feedback.
-
|
Interestingly, on my PoC k8s cluster on AWS running k8s v1.30.4, the NoSchedule taint doesn't use However, even after changing the toleration, it still fails to complete a successful scan without |
Beta Was this translation helpful? Give feedback.
-
it's definitely another issue on your side. |
Beta Was this translation helpful? Give feedback.
-
|
Yep. Turned out to be latency related. Works as advertised after adding the necessary tolerations. That taints being Thanks for your patience. |
Beta Was this translation helpful? Give feedback.
-
|
I also ran into this issue due to a and adding the listed taints to the THe scan ran through successfully. |
Beta Was this translation helpful? Give feedback.
-
|
@john-funk thanks for the report |
Beta Was this translation helpful? Give feedback.
-
|
I've created an issue to track it #8087 |
Beta Was this translation helpful? Give feedback.
@Susanta2000 can you delete
trivy-tempnamespace and run againkubectl delete namespace trivy-temp