Need to deploy Trivy operator in OCI ( OKE ) ,

[santoshkarp3]

Need to deploy Trivy operator in OCI ( OKE ) ,

1. its air gapped environment ( created internal repo for triviydb )
2. with trivy we can able to scan the image
3. but when I use with helm its not working ( pod/scan-vulnerabilityreport pod not turn into running state )
4. Error - failed to load policies

Does any one have deployed , if yes pls share the staeps

or anyone can help with this error

[santoshkarp3]

Adding error ,
Only vulnerabilityreports.aquasecurity.github.io report generated but nt other report

error for policy
{"level":"error","ts":"2024-05-20T05:59:44Z","logger":"policyLoader.Get misconfig bundle policies","msg":"failed to load policies","error":"failed to donwload policies: failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* Get "https://ghcr.io/v2/\": dial tcp 140.82.121.33:443: connect: connection timed out\n\n","stacktrace":"github.com/aquasecurity/trivy-operator/pkg/policy.(*policyLoader).GetPolicies\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/policy/loader.go:59\ngithub.com/aquasecurity/trivy-operator/pkg/policy.(*Policies).loadPolicies\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/policy/policy.go:144\ngithub.com/aquasecurity/trivy-operator/pkg/policy.(*Policies).Hash\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/policy/policy.go:114\ngithub.com/aquasecurity/trivy-operator/pkg/configauditreport/controller.(*PolicyConfigController).SetupWithManager.(*PolicyConfigController).reconcileConfig.func5\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/configauditreport/controller/policyconfig.go:129\nsigs.k8s.io/controller-runtime/pkg/reconcile.Func.Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/reconcile/reconcile.go:113\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:227"}

[chen-keinan]

@santoshkarp3 is it air gapped env ?

[santoshkarp3]

@chen-keinan yes

[chen-keinan]

I have added support in latest trivy-operator to fallback to embedded policies see this config or you can configure to download the policies package from private registry

[santoshkarp3]

@chen-keinan
Thanks a lot for reply ..

I am testing the above option

One querry ..
I have put the below 2 files in private db repo , do I have to add any other file ?

• ghcr.io/aquasecurity/trivy-db:2
• ghcr.io/aquasecurity/trivy-java-db:1

[santoshkarp3]

@chen-keinan

It seems config map is there and below are its values

[opc@sn-c1-10-114-14-0-26 trivy-operator-main]$ k -n trivy-system get cm trivy-operator-trivy-config -o yaml
apiVersion: v1
data:
trivy.additionalVulnerabilityReportFields: ""
trivy.command: image
trivy.dbRepository: registry-rat.prd.harbor.xxxxxxxx.com/vf-gks-trivy-artifacts/aquasecurity/trivy-db:2
trivy.dbRepositoryInsecure: "true"
trivy.filesystemScanCacheDir: /var/trivyoperator/trivy-db
trivy.ignoreUnfixed: "true"
trivy.imagePullPolicy: IfNotPresent
trivy.imageScanCacheDir: /tmp/trivy/.cache
trivy.includeDevDeps: "false"
trivy.insecureRegistry.internalRegistry: registy-rat.prd.harbor.xxxxxxxx.com
trivy.insecureRegistry.pocRegistry: registry-rat.prd.harbor.xxxxxxxx.com
trivy.javaDbRepository: ghcr.io/aquasecurity/trivy-java-db
trivy.mode: Standalone
trivy.nonSslRegistry.internalRegistry: registy-rat.prd.harbor.xxxxxxxx.com
trivy.nonSslRegistry.pocRegistry: registry-rat.prd.harbor.xxxxxxxx.com
trivy.offlineScan: "true"
trivy.repository: registry-rat.prd.harbor.xxxxxxxx.com/vf-gks-tkg-not-retained/aquasecurity/trivy
trivy.resources.limits.cpu: 500m
trivy.resources.limits.memory: 500M
trivy.resources.requests.cpu: 100m
trivy.resources.requests.memory: 100M
trivy.sbomSources: ""
trivy.severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
trivy.skipJavaDBUpdate: "false"
trivy.slow: "true"
trivy.supportedConfigAuditKinds: Workload,Service,Role,ClusterRole,NetworkPolicy,Ingress,LimitRange,ResourceQuota
trivy.tag: 0.51.2
trivy.timeout: 5m0s
trivy.useBuiltinRegoPolicies: "true"
kind: ConfigMap
metadata:
annotations:
meta.helm.sh/release-name: trivy-operator
meta.helm.sh/release-namespace: trivy-system
creationTimestamp: "2024-05-30T07:21:38Z"
labels:
app.kubernetes.io/instance: trivy-operator
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: trivy-operator
app.kubernetes.io/version: 0.21.1
helm.sh/chart: trivy-operator-0.23.1
name: trivy-operator-trivy-config
namespace: trivy-system
resourceVersion: "4424420"
uid: 6e77363d-fb77-41f2-91db-6526c77d4c16
[opc@sn-c1-10-114-14-0-26 trivy-operator-main]$

[chen-keinan]

@santoshkarp3 I see in your configmap that trivy.useBuiltinRegoPolicies: "true" where is should be false and useEmbeddedRegoPolicies is not present

[santoshkarp3]

@chen-keinan
I have edited cm manually and I can see few reports generated via CLI.

BIG Thank you @chen-keinan

[santoshkarp3]

@chen-keinan
clusterconfigauditreports and infraassessmentreports are not genrated , can you please advice ?

[santoshkarp3]

hello @chen-keinan
I am passing this with helm command, but its getting ignored

--set="trivy.useBuiltinRegoPolicies=false"
--set="trivy.useEmbeddedRegoPolicies=true" \