Is there a plan to provide option to specify the secret type?

[kmotojim]

I would like to use trivy operator for Openshift platform.
Openshift creates secret with format of kubernetes.io/dockercfg ,not kubernetes.io/dockerconfigjson, so following code cause error.
https://github.com/devopstales/trivy-operator/blob/main/trivy-operator.py#L239

[2023-01-30 14:22:48,527] kopf.objects         [ERROR   ] [my-namespace/trivy-operator-main-config] Handler 'create_fn' failed with an exception. Will retry.
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/kopf/_core/actions/execution.py", line 279, in execute_handler_once
    result = await invoke_handler(
  File "/usr/local/lib/python3.8/site-packages/kopf/_core/actions/execution.py", line 374, in invoke_handler
    result = await invocation.invoke(
  File "/usr/local/lib/python3.8/site-packages/kopf/_core/actions/invocation.py", line 116, in invoke
    result = await fn(**kwargs)  # type: ignore
  File "/trivy-operator.py", line 417, in create_fn
    pull_secret_decoder(tmp3, tagged_ns)
  File "/trivy-operator.py", line 239, in pull_secret_decoder
    secret_data = secret.data['.dockerconfigjson']
KeyError: '.dockerconfigjson'

Is it possible to provide an option to specify either kubernetes.io/dockercfg or kubernetes.io/dockerconfigjson?

[devopstales]

Hi @kmotojim

It looks easy to solve this issue. I added a test for the different formats: https://github.com/devopstales/trivy-operator/blob/main/trivy-operator.py#L239-L248

I didn't have a running OpenShift to test it but I created a a new image with a 2.5.1-devel tag. Please test it and if it is working I will rebuild the 2.5 image.

[kmotojim]

I am very sorry for the delay in response and checking the docker image you suggested.
Unfortunately, the results appear to be the same as before.

I got the following error.

2023-02-14 07:54:00,491] kopf.objects         [ERROR   ] [my-namespace/trivy-operator-main-config] Handler 'create_fn' failed with an exception. Will retry.
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/kopf/_core/actions/execution.py", line 279, in execute_handler_once
    result = await invoke_handler(
  File "/usr/local/lib/python3.8/site-packages/kopf/_core/actions/execution.py", line 374, in invoke_handler
    result = await invocation.invoke(
  File "/usr/local/lib/python3.8/site-packages/kopf/_core/actions/invocation.py", line 116, in invoke
    result = await fn(**kwargs)  # type: ignore
  File "/trivy-operator.py", line 423, in create_fn
    pull_secret_decoder(tmp3, tagged_ns)
  File "/trivy-operator.py", line 239, in pull_secret_decoder
    if secret.data['.dockerconfigjson']:
KeyError: '.dockerconfigjson'

I checked image in running trivy-operator pod, so docker image(2.5.1-devel) should be used.

oc get pods trivy-operator-88c6b649b-pqrlr -o jsonpath="{.spec.containers[*].image}"
devopstales/trivy-operator:2.5.1-devel

I used following Helm Values file.

image:
  # -- The docker image repository to use
  repository: devopstales/trivy-operator
  # -- The docker image pull policy
  pullPolicy: Always
  # -- The docker image tag to use
  tag: "2.5.1-devel"

# -- Time Zone in container
TimeZone: UTC

# -- Log level
log_level: "DEBUG"
# INFO, HIGH, DEBUG

# -- list of secrets to use for imae pull
imagePullSecrets: []
# -- security options for the pod
podSecurityContext:
  fsGroup: 10001
  fsGroupChangePolicy: "OnRootMismatch"

serviceAccount:
  # -- Enable serviceAccount creation
  create: true
  # -- serviceAccount annotations
  annotations: {}
  # -- Name of the serviceAccount
  name: "trivy-operator"

# Dont try to download trivy db, run in air-gapped env:
offline:
  # -- enable air-gapped mode
  enabled: false
  # -- repository to use for download trivy vuln db
  db_repository: localhost:5000/trivy-db
  # -- insecure repository
  db_repository_insecure: False

cache:
  # -- enable redis cache
  enabled: false

monitoring:
  # -- configure prometheus monitoring port
  port: "9115"

# deploy service monitor
serviceMonitor:
  # -- allow to override the namespace for serviceMonitor
  enabled: false
  # -- Name of the namespace for serviceMonitor
  namespace: {}
  labels:
    # -- labels to match the serviceMonitorSelector of the Prometheus Resource
    release: prometheus
  # https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
  # -- relabel config for serviceMonitor
  relabelings: []
  # see serviceMonitor.relabelings
  # -- metricRelabeling config for serviceMonitor
  metricRelabelings: []

grafana:
  # -- namespace for configMap of grafana dashboards
  namespace:
  dashboards:
    # -- Enable the deployment of grafana dashboards
    enabled: true
    # -- Label to find dashboards using the k8s sidecar
    label: grafana_dashboard
    # -- Label value to find dashboards using the k8s sidecar
    value: "1"
  folder:
    # -- Annotation to enable folder storage using the k8s sidecar
    annotation: grafana_folder
    # -- Grafana folder in which to store the dashboards
    name: Policy Reporter

persistence:
  # -- Volumes for the pod
  enabled: true
  # -- Volumes mode
  accessMode: "ReadWriteOnce"
  # -- Volumes size
  size: "2Gi"
  # -- Volumes annotations
  annotations: {}
  ## database data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  # storageClass: "-"

# content foc ns-scan CRD
namespaceScanner:
  crontab: "*/1 * * * *"
  namespaceSelector: "trivy-scan"
  clusterWide: false
  integrations:
    policyreport: false
#    defectdojo:
#      host: "https://defectdojo.k8s.intra"
#      api_key: "xyz456ucdssd67sd67dsg"
#      k8s-cluster-name: "eks-prod"

kube_bench_scnner:
  image:
    # -- The docker image repository to use
    repository: devopstales/kube-bench-scnner
    # -- The docker image pull policy
    pullPolicy: Always
    # -- The docker image tag to use
    tag: "2.5"

clusterScanner:
  # -- enable clusterScanner cr creation
  enabled: false
  # -- crontab for scheduled scan
  crontab: "*/1 * * * *"
  # -- kube-hunter scan profile
  scanProfileName: "cis-1.23"
  # -- configure defectdojo integration
  integrations: {}
#    defectdojo:
#      host: "https://defectdojo.k8s.intra"
#      api_key: "xyz456ucdssd67sd67dsg"
#      k8s-cluster-name: "eks-prod"

admissionController:
  # -- enable adission controller
  enabled: false

# authentication informatin for trivy to use wen scan image
registryAuth:
  # -- enable registry authentication
  enabled: false
  # -- list of image pull secrets for authentication
  image_pull_secrets:
    - regcred
## list containing the names of the image pull secrets
## you want to use from the operator namespace for image pulls
#  registry:
#  - name: docker.io
#    username: "user"
#    password: "password"

# github authentiation token for trivy database download
githubToken:
  # -- enable github authentiation token
  enabled: false
  # -- github authentiation token value
  token: ""

## Define which Nodes the Pods are scheduled on.
## ref: https://kubernetes.io/docs/user-guide/node-selection/
# -- Set the node selector for the pod.
nodeSelector: {}

## Tolerations for use with node taints
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
# -- Set the tolerations for the pod.
tolerations: []
# - key: "key"
#   operator: "Equal"
#   value: "value"
#   effect: "NoSchedule"

## Assign custom affinity rules to the trivy operator
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
# -- Set the affinity for the pod.
affinity: {}
# nodeAffinity:
#   requiredDuringSchedulingIgnoredDuringExecution:
#     nodeSelectorTerms:
#     - matchExpressions:
#       - key: kubernetes.io/e2e-az-name
#         operator: In
#         values:
#         - e2e-az1
#         - e2e-az2

[devopstales]

@kmotojim Please try it again I built a new image with the same dev tag.

[kmotojim]

I have tried again and it looks fixed in this time!
Thank you for your quick response!

[devopstales]

This fix will be in the next 2.6 release until that use this develop image.