Error running vulnerabilityreports

[PatrickSplice]

This one is a little odd. Trying to run a "scan vulnerabilityreports" against a deployment and it errors out before even generating a job or pod.

kubectl starboard scan vulnerabilityreports deployment/collector-workers error: VulnerabilityReport.aquasecurity.github.io "deployment-collector-workers-collector-workers" is invalid: [report.updateTimestamp: Invalid value: "null": report.updateTimestamp in body must be of type string: "null", report.vulnerabilities: Invalid value: "null": report.vulnerabilities in body must be of type array: "null"]

It seems like it is having trouble generating this field in the report: report.updateTimestamp. I've run the same scan against many other deployments on this cluster without an issue. I've looked at the deployments that were successful and the ones that fail and do not see anything that stands out that might cause this error.

[danielpacak]

Would you provide more details, e.g. which version of Starboard CLI is it? Did you init it with the latest vulnerabilities CRD? Are you running the Operator in the same cluster by any chance? If yes, which version? The updateTimestamp filed was not there since the beginning so maybe it's related to versioning.

[PatrickSplice]

Starboard Version: {Version:0.7.1 Commit:3c4342d2f344dd3aeea3fb1083c9d7a499bbcf2f Date:2020-12-05T18:05:28Z}

Not running the operator in the cluster.

When I did the init, I just ran:
kubectl starboard init -v=3

[PatrickSplice]

I upgraded to 0.8.0:
kubectl krew upgrade starboard
kubectl starboard cleanup
kubectl starboard init -v=3

Still returning the same error:
error: VulnerabilityReport.aquasecurity.github.io "deployment-collector-workers-collector-workers" is invalid: [report.updateTimestamp: Invalid value: "null": report.updateTimestamp in body must be of type string: "null", report.vulnerabilities: Invalid value: "null": report.vulnerabilities in body must be of type array: "null"]

[danielpacak]

And when you run init, do you see that it's creating or updating the vulnerabilityreports CRD?

I0108 22:20:02.390034    9017 cr_manager.go:306] Updating CRD "vulnerabilityreports.aquasecurity.github.io"

Could you send over the definition stored in your cluster? k get crd vulnerabilityreports -o yaml?

[PatrickSplice]

Yes, I saw the CRDs being added. Here is the init output:

I0108 16:29:55.099269   83225 cr_manager.go:312] Creating CRD "vulnerabilityreports.aquasecurity.github.io"
I0108 16:29:55.262714   83225 cr_manager.go:312] Creating CRD "ciskubebenchreports.aquasecurity.github.io"
I0108 16:29:55.377811   83225 cr_manager.go:312] Creating CRD "kubehunterreports.aquasecurity.github.io"
I0108 16:29:55.500846   83225 cr_manager.go:312] Creating CRD "configauditreports.aquasecurity.github.io"
I0108 16:29:55.599674   83225 cr_manager.go:244] Creating Namespace "starboard"
I0108 16:29:55.896740   83225 cr_manager.go:259] Creating ServiceAccount "starboard/starboard"
I0108 16:29:56.045414   83225 cr_manager.go:276] Creating ClusterRole "starboard"
I0108 16:29:56.253667   83225 cr_manager.go:294] Creating ClusterRoleBinding "starboard"

Here is the CRD:

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  creationTimestamp: "2021-01-08T19:55:57Z"
  generation: 1
  labels:
    app.kubernetes.io/managed-by: starboard
  name: vulnerabilityreports.aquasecurity.github.io
  resourceVersion: "193310742"
  selfLink: /apis/apiextensions.k8s.io/v1/customresourcedefinitions/vulnerabilityreports.aquasecurity.github.io
  uid: e4ea03d5-c99d-420d-9daf-953a4d87591b
spec:
  conversion:
    strategy: None
  group: aquasecurity.github.io
  names:
    categories:
    - all
    kind: VulnerabilityReport
    listKind: VulnerabilityReportList
    plural: vulnerabilityreports
    shortNames:
    - vulns
    - vuln
    singular: vulnerabilityreport
  preserveUnknownFields: true
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .report.artifact.repository
      name: Repository
      type: string
    - jsonPath: .report.artifact.tag
      name: Tag
      type: string
    - jsonPath: .report.scanner.name
      name: Scanner
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - jsonPath: .report.summary.criticalCount
      name: Critical
      priority: 1
      type: integer
    - jsonPath: .report.summary.highCount
      name: High
      priority: 1
      type: integer
    - jsonPath: .report.summary.mediumCount
      name: Medium
      priority: 1
      type: integer
    - jsonPath: .report.summary.lowCount
      name: Low
      priority: 1
      type: integer
    - jsonPath: .report.summary.unknownCount
      name: Unknown
      priority: 1
      type: integer
    name: v1alpha1
    schema:
      openAPIV3Schema:
        properties:
          apiVersion:
            type: string
          kind:
            type: string
          metadata:
            type: object
          report:
            properties:
              artifact:
                properties:
                  digest:
                    type: string
                  mimeType:
                    type: string
                  repository:
                    type: string
                  tag:
                    type: string
                type: object
              registry:
                properties:
                  server:
                    type: string
                type: object
              scanner:
                properties:
                  name:
                    type: string
                  vendor:
                    type: string
                  version:
                    type: string
                required:
                - name
                - vendor
                - version
                type: object
              summary:
                properties:
                  criticalCount:
                    minimum: 0
                    type: integer
                  highCount:
                    minimum: 0
                    type: integer
                  lowCount:
                    minimum: 0
                    type: integer
                  mediumCount:
                    minimum: 0
                    type: integer
                  unknownCount:
                    minimum: 0
                    type: integer
                required:
                - criticalCount
                - highCount
                - mediumCount
                - lowCount
                - unknownCount
                type: object
              updateTimestamp:
                format: date-time
                type: string
              vulnerabilities:
                items:
                  properties:
                    description:
                      type: string
                    fixedVersion:
                      type: string
                    installedVersion:
                      type: string
                    links:
                      items:
                        type: string
                      type: array
                    primaryLink:
                      type: string
                    resource:
                      type: string
                    severity:
                      enum:
                      - CRITICAL
                      - HIGH
                      - MEDIUM
                      - LOW
                      - UNKNOWN
                      type: string
                    title:
                      type: string
                    vulnerabilityID:
                      type: string
                  required:
                  - vulnerabilityID
                  - resource
                  - installedVersion
                  - fixedVersion
                  - severity
                  - title
                  type: object
                type: array
            required:
            - scanner
            - artifact
            - vulnerabilities
            type: object
        required:
        - apiVersion
        - kind
        - metadata
        - report
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    categories:
    - all
    kind: VulnerabilityReport
    listKind: VulnerabilityReportList
    plural: vulnerabilityreports
    shortNames:
    - vulns
    - vuln
    singular: vulnerabilityreport
  conditions:
  - lastTransitionTime: "2021-01-08T19:55:57Z"
    message: no conflicts found
    reason: NoConflicts
    status: "True"
    type: NamesAccepted
  - lastTransitionTime: "2021-01-08T19:55:57Z"
    message: the initial names have been accepted
    reason: InitialNamesAccepted
    status: "True"
    type: Established
  storedVersions:
  - v1alpha1

[danielpacak]

The CRD looks good. Is there anything special about the deployment/collector-workers? How many container are there? Are you able to share the Deployment config? Do they refer to private container registries and use image pull secrets or service account's secrets to pull images?

[PatrickSplice]

Yes, it is a private repository, but all of my scans are from the same private repo and my workload identity config is working for the other deployments that I scan.

[PatrickSplice]

I've also been having issues with the starboard plugin trying to get its configuration data from a secret called starboard instead of the configmap? I have to do a cleanup and init again to fix it. Also, it is ignoring my trivy.githubToken in the configmap.

[danielpacak]

Yup, sorry for that inconvenience. In the latest version of Starboard there are two configuration object, i.e. the starboard ConfigMap and the starboard secret in the starboard namespace. You're supposed to add trivy.githubToken to the secret instead of ConfigMap. See https://aquasecurity.github.io/starboard/settings/ for more details.

[PatrickSplice]

Ah, thanks. I guess I did not look at the docs after upgrading.

[danielpacak]

@PatrickSplice Are having those issues with the latest version of Starboard v0.10? I'm wondering if there's something else we can help with before I mark this thread as answered.

[PatrickSplice]

You can mark it as answered. Thanks.

…

On Tue, Apr 27, 2021 at 10:46 AM Daniel Pacak ***@***.***> wrote: @PatrickSplice <https://github.com/PatrickSplice> Are having those issues with the latest version of Starboard v0.10? I'm wondering if there's something else we can help with before I mark this thread as answered. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#320 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AL2GBN6WYSPHGBXQ3M5U6M3TK3L5BANCNFSM4V2V3FNA> .