Trivy image scan fails with error 'Unable to initialize the Java DB: Java DB update failed: DB download error'

Products

• VMware Telco Cloud Automation

Issue/Introduction

Trivy image scanning fails in Harbor with error 

timage scan error: scan error: scan failed: failed analysis: analyze error: pipeline error: failed to analyze layer post analysis error: post analysis error: Unable to initialize the Java DB: Java DB update failed: DB download error: OCI repository error: 2 errors occurred:\n\t* Get \"https://ghcr.io/v2/\": dial tcp: lookup ghcr.io on xxx.xxx.xxx.xxx: server 

Environment

• TCA 3.2
• Cloud native Harbor running inside dedicated workload cluster (K8s Version v1.30.2+vmware.1)
• Trivy Version: 0.50.1
• TKG Version: v2.5.2
• Harbor Version: v2.10.2

Cause

Missing java-db latest file in directory /home/scanner/.cache/java-db/ inside pod harbor-trivy-0

Resolution

• In addition to the steps mentioned in the deployment documentation  paragraph Configuring Trivy Scanning & Updating Trivy DB   please follow below steps to download and transfer the java-db inside harbor-trivy-0 Pod
• Pull trivy-java.db DB using ORAS.

oras pull ghcr.io/aquasecurity/trivy-java-db:1

• Copy (using scp, rsync and so on) downloaded javadb.tar.gz to one of the K8s control plane node under some directory.

scp javadb.tar.gz user@<k8s-control-plane-node-ip>:/home/<user home directory>/

• Log in to the control plane node where the file was transferred in above step 

ssh user@control-plane-node-ip

• unzip the downloaded file

tar -zxvf javadb.tar.gz

• Create  directory in the harbor-trivy-o pod as shown in below command

kubectl exec -it harbor-trivy-0-n <HARBOR_NAMESPACE> -- mkdir -p /home/scanner/.cache/trivy/java-db

• Copy the metadata.jason & trivy-java.db to the java-db directory inside pod harbor-trivy-0

kubectl cp <TRIVY_DATABASE_PATH>/metadata.json <HARBOR_NAMESPACE>/harbor-trivy-0:/home/scanner/.cache/trivy/java-db/
kubectl cp <TRIVY_DATABASE_PATH>/trivy-java.db <HARBOR_NAMESPACE>/harbor-trivy-0:/home/scanner/.cache/trivy/java-db/

• Restart the Trivy Pod

kubectl delete pod harbor-trivy-0 -n namespace

• The image scan should now work