Node-collector pods not running on master nodes #1947
Answered
by
xRTRx
xRTRx
asked this question in
Help & Support
-
|
I have deployed trivy-operator via argocd. ---
kind: Application
metadata:
name: trivy-operator
namespace: argocd
spec:
project: default
source:
repoURL: 'https://aquasecurity.github.io/helm-charts/'
targetRevision: 0.20.6
helm:
parameters:
- name: compliance.cron
value: '0 0 * * *'
- name: compliance.reportType
value: 'all'
- name: service.headless
value: 'false'
- name: serviceMonitor.enabled
value: 'true'
- name: trivy.storageClassEnabled
value: 'true'
- name: trivy.storageClassName
value: "openebs-hostpath"
- name: trivy.storageSize
value: "10Gi"
- name: trivyOperator.scanJobTolerations
value: '[{"key": "node-role.kubernetes.io/master", "operator": "Equal", "value": "master", "effect": "NoSchedule"}]'
chart: trivy-operator
destination:
server: 'https://kubernetes.default.svc'
namespace: trivy-system
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=trueI can see clusterinfraassessmentreports only for my worker nodes In the logs of the trivy-operator pod, I can see the following error: I have a master node with these values, some values were hidden with the * sign. The syntax of the tolerations field looks correct. |
Beta Was this translation helpful? Give feedback.
Answered by
xRTRx
Apr 2, 2024
Replies: 4 comments 9 replies
-
|
I also noticed that PVC was not created for trivy-operator. |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
After editing scanJobTolerations - name: trivyOperator.scanJobTolerations
value: '[{"key": "node-role.kubernetes.io/control-plane", "operator": "Equal", "value": "true", "effect": "NoSchedule"}, {"key": "node-role.kubernetes.io/master", "operator": "Equal", "value": "true", "effect": "NoSchedule"}, {"key": "node-taint.kubernetes.io/ingress", "operator": "Equal", "value": "ingress", "effect": "NoSchedule"}]'I got Reconciler error for every controller |
Beta Was this translation helpful? Give feedback.
-
|
is the error is the one mention above |
Beta Was this translation helpful? Give feedback.
-
|
No, not only one. |
Beta Was this translation helpful? Give feedback.
-
|
@xRTRx can you please share how this value, |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
Ingress nodes weren't scanned either. |
Beta Was this translation helpful? Give feedback.
-
|
@chen-keinan any suggestions or updates for this? |
Beta Was this translation helpful? Give feedback.
-
|
@xRTRx I think I found the issue, its the additional apostrophe at the beginning and at the end of the toleration: |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Thank you, that was the issue. kind: Application
metadata:
name: trivy-operator
namespace: argocd
spec:
project: default
source:
repoURL: 'https://aquasecurity.github.io/helm-charts/'
targetRevision: 0.21.2
helm:
parameters:
- name: compliance.cron
value: '0 0 * * *'
- name: compliance.reportType
value: 'all'
- name: service.headless
value: 'false'
- name: serviceMonitor.enabled
value: 'true'
- name: operator.metricsClusterComplianceInfo
value: 'true'
- name: operator.metricsConfigAuditInfo
value: 'true'
- name: operator.metricsExposedSecretInfo
value: 'true'
- name: operator.metricsFindingsEnabled
value: 'true'
- name: operator.metricsImageInfo
value: 'true'
- name: operator.metricsInfraAssessmentInfo
value: 'true'
- name: operator.metricsRbacAssessmentInfo
value: 'true'
- name: operator.metricsVulnIdEnabled
value: 'true'
- name: operator.clusterSbomCacheEnabled
value: 'true'
- name: trivy.storageClassEnabled
value: 'true'
- name: trivy.storageClassName
value: "openebs-hostpath"
- name: trivy.storageSize
value: "10Gi"
values: |
trivyOperator:
scanJobTolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
- key: "node-role.kubernetes.io/master"
operator: "Exists"
effect: "NoSchedule"
- key: "node-taint.kubernetes.io/ingress"
operator: "Equal"
value: "ingress"
effect: "NoSchedule"
chart: trivy-operator
destination:
server: 'https://kubernetes.default.svc'
namespace: trivy-system
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- ApplyOutOfSyncOnly=true |
Beta Was this translation helpful? Give feedback.
Answer selected by
xRTRx
-
|
@xRTRx thanks for this update, can we close this issue ? |
Beta Was this translation helpful? Give feedback.
2 replies
-
|
What about PVC not being created? |
Beta Was this translation helpful? Give feedback.
-
|
please open another issue |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Thank you, that was the issue.
I couldn't correctly set the required value in the parameters section of the ArgoCD manifest, so moved it to the values section, now it works as expected, here is my updated manifest: