Trivy image scan fails with error 'Unable to initialize the Java DB: Java DB update failed: DB download error'
search cancel

Trivy image scan fails with error 'Unable to initialize the Java DB: Java DB update failed: DB download error'

book

Article ID: 387856

calendar_today

Updated On:

Products

VMware Telco Cloud Automation

Issue/Introduction

Trivy image scanning fails in Harbor with error 

timage scan error: scan error: scan failed: failed analysis: analyze error: pipeline error: failed to analyze layer post analysis error: post analysis error: Unable to initialize the Java DB: Java DB update failed: DB download error: OCI repository error: 2 errors occurred:\n\t* Get \"https://ghcr.io/v2/\": dial tcp: lookup ghcr.io on xxx.xxx.xxx.xxx: server 

Environment

  • TCA 3.2
  • Cloud native Harbor running inside dedicated workload cluster (K8s Version v1.30.2+vmware.1)
  • Trivy Version: 0.50.1
  • TKG Version: v2.5.2
  • Harbor Version: v2.10.2

Cause

Missing java-db latest file in directory /home/scanner/.cache/java-db/ inside pod harbor-trivy-0

Resolution

  • In addition to the steps mentioned in the deployment documentation  paragraph Configuring Trivy ScanningUpdating Trivy DB   please follow below steps to download and transfer the java-db inside harbor-trivy-0 Pod
  • Pull trivy-java.db DB using ORAS.
oras pull ghcr.io/aquasecurity/trivy-java-db:1
  • Copy (using scp, rsync and so on) downloaded javadb.tar.gz to one of the K8s control plane node under some directory.
scp javadb.tar.gz user@<k8s-control-plane-node-ip>:/home/<user home directory>/
  • Log in to the control plane node where the file was transferred in above step 
ssh user@control-plane-node-ip
  • unzip the downloaded file
tar -zxvf javadb.tar.gz
  • Create  directory in the harbor-trivy-o pod as shown in below command
kubectl exec -it harbor-trivy-0-n <HARBOR_NAMESPACE> -- mkdir -p /home/scanner/.cache/trivy/java-db
  • Copy the metadata.jason & trivy-java.db to the java-db directory inside pod harbor-trivy-0
kubectl cp <TRIVY_DATABASE_PATH>/metadata.json <HARBOR_NAMESPACE>/harbor-trivy-0:/home/scanner/.cache/trivy/java-db/
kubectl cp <TRIVY_DATABASE_PATH>/trivy-java.db <HARBOR_NAMESPACE>/harbor-trivy-0:/home/scanner/.cache/trivy/java-db/
  • Restart the Trivy Pod
kubectl delete pod harbor-trivy-0 -n namespace
  • The image scan should now work