Giters

aquasecurity / starboard

Moved to https://github.com/aquasecurity/trivy-operator

Home Page:https://aquasecurity.github.io/starboard/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Starboard operator pod crashes when runs on kubernetes v1.25

anupamtamrakar opened this issue · comments

commented

Starboard operator pod crashes when runs on kubernetes v1.25

Root cause:

  1. Pod security standard is dropped in 1.25.
  2. Cronjob kind batch/v1beta1 not supported in v.1.25

Error logs:
{"level":"error","ts":1662373136.5983863,"logger":"controller-runtime.source","msg":"if kind is a CRD, it should be installed before calling Start","kind":"PodSecurityPolicy.policy","error":"no matches for kind "PodSecurityPolicy" in version "policy/v1beta1"","stacktrace":"sigs.k8s.io/controller-runtime/pkg/source.(*Kind).Start.func1.1\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.2/pkg/source/source.go:137\nk8s.io/apimachinery/pkg/util/wait.runConditionWithCrashProtectionWithContext\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:233\nk8s.io/apimachinery/pkg/util/wait.WaitForWithContext\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:660\nk8s.io/apimachinery/pkg/util/wait.poll\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:594\nk8s.io/apimachinery/pkg/util/wait.PollImmediateUntilWithContext\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:545\nsigs.k8s.io/controller-runtime/pkg/source.(*Kind).Start.func1\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.2/pkg/source/source.go:131"}

{"level":"error","ts":1662373135.2498226,"logger":"controller-runtime.source","msg":"if kind is a CRD, it should be installed before calling Start","kind":"CronJob.batch","error":"no matches for kind "CronJob" in version "batch/v1beta1"","stacktrace":"sigs.k8s.io/controller-runtime/pkg/source.(*Kind).Start.func1.1\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.2/pkg/source/source.go:137\nk8s.io/apimachinery/pkg/util/wait.runConditionWithCrashProtectionWithContext\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:233\nk8s.io/apimachinery/pkg/util/wait.WaitForWithContext\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:660\nk8s.io/apimachinery/pkg/util/wait.poll\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:594\nk8s.io/apimachinery/pkg/util/wait.PollImmediateUntilWithContext\n\t/home/runner/go/pkg/mod/k8s.io/apimachinery@v0.23.5/pkg/util/wait/wait.go:545\nsigs.k8s.io/controller-runtime/pkg/source.(*Kind).Start.func1\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.11.2/pkg/source/source.go:131"}

cc @deven0t @josedonizetti @chen-keinan

commented

@anupamtamrakar thanks for the update , I'll add here the fix we put in trivy-operator for CronJon issue.

commented

Thanks @chen-keinan for quick fix.

  1. Will this solve issue with pod security standard as well ?
  2. Is backward compatibility maintained for older Kubernetes versions ?
commented

Thanks @chen-keinan for quick fix.

  1. Will this solve issue with pod security standard as well ?
  2. Is backward compatibility maintained for older Kubernetes versions ?

Yes , the PR include :

  • Removal of PSP support as its not in use (let me know if it is a problem)
  • Support CronJob v1 and v1Beta1 all together
commented

@anupamtamrakar Once the PR is approved , I'll merge it and create an RC for you to test