Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: sync stdout buffer to file #2191

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

daanschipper
Copy link

@daanschipper daanschipper commented Jul 19, 2024

Description

The trivy command is completed and as it is the main process the entire container is stopped before the stdout buffer is cleared, resulting in malformed output.

This patch has been running for over a month and I have not experienced any lingering scan vulnerability jobs which could not be removed by the operator anymore. Used kube_job_complete{namespace="trivy-system", condition="true", job_name=~"scan-vulnerabilityreport-[0-9a-f]+"} to alert for scan jobs with malformed output.

I did refactor the getCommandAndArgs function to deduplicate the logic for compressed and not compressed mode, it was essentially the same. Also ensured the options are in alphabetic order.

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed). Not applicable.
  • I've added usage information (if the PR introduces new options). Not applicable.
  • I've included a "before" and "after" example to the description (if the PR is a user interface change). Not applicable.

@CLAassistant
Copy link

CLAassistant commented Jul 19, 2024

CLA assistant check
All committers have signed the CLA.

@github-actions github-actions bot added the bug label Jul 19, 2024
@daanschipper daanschipper force-pushed the main branch 2 times, most recently from 8e71ce9 to f933450 Compare July 24, 2024 20:02
@daanschipper
Copy link
Author

Also updated the *-expected-scan.yaml files for the envtest.

@daanschipper
Copy link
Author

@chen-keinan could you trigger the workflow again? 🙏

@daanschipper
Copy link
Author

I'm running the failing integration test tests/e2e/config/fs-sbom.yaml locally on the latest origin/HEAD (18e40db), but the test is failing there as well. I'm observing the following

  • The scan-vulnerabilityreport Job gets created
  • The scan-vulnerabilityreport-xxxxxx Pod get created and completes successfully. The logs get outputted as expected
  • The trivy operator outputs the following logs and does not create a VulnerabiltyReport
2024-08-26T11:49:25Z    DEBUG    reconciler.scan job    Pod must have been deleted    {"job-results-processor": "trivy-system/scan-vulnerabilityreport-9845bdc5f"}                                                                                                                                                      2024-08-26T11:49:25Z    DEBUG    reconciler.scan job    Deleting complete scan job    {"job": "trivy-system/scan-vulnerabilityreport-9845bdc5f", "owner": {"apiVersion": "v1", "kind": "Pod", "namespace": "e2e-test", "name": "my-pod"}}                                                                               2024-08-26T11:49:25Z    DEBUG    reconciler.scan job    Ignoring cached job that must have been deleted    {"job": "trivy-system/scan-vulnerabilityreport-9845bdc5f"} 

I'm not sure how to continue from here. The failing integration test seems to test pkg/plugins/trivy/filesystem.go which I did not edit.

The trivy command is completed and as it is the main process the entire container is stopped before the stdout
buffer is cleared, resulting in malformed output.

Fixes aquasecurity#1792.
Copy link

This PR is stale because it has been labeled with inactivity.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. label Dec 11, 2024
@afdesk afdesk removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. label Dec 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unexpected EOF log and vulnerability report no data
3 participants