-
Task
-
Resolution: Unresolved
-
Normal
-
None
-
4.6.1
-
None
-
Improvement
-
False
-
-
False
-
-
-
0
ACS Documentation provides very useful troubleshooting recommendations in 'Understanding and addressing common Scanner warning messages' section here:
https://docs.openshift.com/acs/4.6/operating/examine-images-for-vulnerabilities.html#common-scanner-warning-messages_examine-images-for-vulnerabilities
Based on the experience at a large customer I'd recommend to expand description for 'Failed to retrieve metadata from the registry' message by adding something likeĀ the following:
"Additional causes for this message could be:
- Source image used in the deployment is overwritten in the registry
- Sensor component on secured cluster is experiencing issues.
ACS tracks images by how they are configured in the deployment (by tag or by digest). However, even if image is tracked by tag - ACS Scanner will try to use image digest to retrieve metadata from the registry. If Image tag is overwritten in the registry since it was deployed - ACS Scanner will not be able to access it. The recommendation is this case is not to re-use / over write image tags in the registry.
Sensor component on secured cluster can experience issues on some larger clusters (OOMKilled, Queues overfilled) causing ACS to report this warning message. To resolve this issue - observe that sensor is running and not reporting Queue size warnings. Increase queue sizes and/or increase memory limits to resolve this issue."