Uploaded image for project: 'Red Hat Advanced Cluster Security'
  1. Red Hat Advanced Cluster Security
  2. ROX-27477

Scanner warning messages recommendation

Create Feature from Fe...Move to CloseXMLWordPrintable

    • Icon: Task Task
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • 4.6.1
    • Documentation
    • None
    • Improvement
    • False
    • Hide

      None

      Show
      None
    • False
    • 0

      ACS Documentation provides very useful troubleshooting recommendations in 'Understanding and addressing common Scanner warning messages' section here:
      https://docs.openshift.com/acs/4.6/operating/examine-images-for-vulnerabilities.html#common-scanner-warning-messages_examine-images-for-vulnerabilities

      Based on the experience at a large customer I'd recommend to expand description for 'Failed to retrieve metadata from the registry' message by adding something likeĀ  the following:

      "Additional causes for this message could be:

      • Source image used in the deployment is overwritten in the registry
      • Sensor component on secured cluster is experiencing issues.

      ACS tracks images by how they are configured in the deployment (by tag or by digest). However, even if image is tracked by tag - ACS Scanner will try to use image digest to retrieve metadata from the registry. If Image tag is overwritten in the registry since it was deployed - ACS Scanner will not be able to access it. The recommendation is this case is not to re-use / over write image tags in the registry.

      Sensor component on secured cluster can experience issues on some larger clusters (OOMKilled, Queues overfilled) causing ACS to report this warning message. To resolve this issue - observe that sensor is running and not reporting Queue size warnings. Increase queue sizes and/or increase memory limits to resolve this issue."

              ybeisemb@redhat.com Yerzhan Beisembayev
              ybeisemb@redhat.com Yerzhan Beisembayev
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: