Need to deploy Trivy operator in OCI ( OKE ) ,

[santoshkarp3]

Need to deploy Trivy operator in OCI ( OKE ) ,

1. its air gapped environment ( created internal repo for triviydb )
2. with trivy we can able to scan the image
3. but when I use with helm its not working ( pod/scan-vulnerabilityreport pod not turn into running state )
4. Error - failed to load policies

Does any one have deployed , if yes pls share the staeps

or anyone can help with this error

[santoshkarp3]

Adding error ,
Only vulnerabilityreports.aquasecurity.github.io report generated but nt other report

error for policy
{"level":"error","ts":"2024-05-20T05:59:44Z","logger":"policyLoader.Get misconfig bundle policies","msg":"failed to load policies","error":"failed to donwload policies: failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* Get "https://ghcr.io/v2/\": dial tcp 140.82.121.33:443: connect: connection timed out\n\n","stacktrace":"github.com/aquasecurity/trivy-operator/pkg/policy.(*policyLoader).GetPolicies\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/policy/loader.go:59\ngithub.com/aquasecurity/trivy-operator/pkg/policy.(*Policies).loadPolicies\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/policy/policy.go:144\ngithub.com/aquasecurity/trivy-operator/pkg/policy.(*Policies).Hash\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/policy/policy.go:114\ngithub.com/aquasecurity/trivy-operator/pkg/configauditreport/controller.(*PolicyConfigController).SetupWithManager.(*PolicyConfigController).reconcileConfig.func5\n\t/home/runner/work/trivy-operator/trivy-operator/pkg/configauditreport/controller/policyconfig.go:129\nsigs.k8s.io/controller-runtime/pkg/reconcile.Func.Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/reconcile/reconcile.go:113\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.3/pkg/internal/controller/controller.go:227"}

[chen-keinan]

@santoshkarp3 is it air gapped env ?

[santoshkarp3]

@chen-keinan yes

[chen-keinan]

I have added support in latest trivy-operator to fallback to embedded policies see this config or you can configure to download the policies package from private registry

[santoshkarp3]

@chen-keinan
Thanks a lot for reply ..

I am testing the above option

One querry ..
I have put the below 2 files in private db repo , do I have to add any other file ?

• ghcr.io/aquasecurity/trivy-db:2
• ghcr.io/aquasecurity/trivy-java-db:1

[santoshkarp3]

@chen-keinan
I have edited cm manually and I can see few reports generated via CLI.

BIG Thank you @chen-keinan

[santoshkarp3]

@chen-keinan
clusterconfigauditreports and infraassessmentreports are not genrated , can you please advice ?

[santoshkarp3]

hello @chen-keinan
I am passing this with helm command, but its getting ignored

--set="trivy.useBuiltinRegoPolicies=false"
--set="trivy.useEmbeddedRegoPolicies=true" \

[chen-keinan]

I'll check and update you

[chen-keinan]

@santoshkarp3 thanks for the feedback, I see where the issue now.
converting this discussion to issue #2113