-
Notifications
You must be signed in to change notification settings - Fork 231
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ratelimiting error when downloading vulnerability db from ghcr.io #389
Comments
Thanks for the report, we will look into it. |
I also saw this right now :/ Any ideas why? |
I believe this is currently causing problems with anyone using the trivy action. We have had to turn it off on some workflows. I'm not sure what the long term solution might be - if GH cannot increase the global rate limit for the artifact pull then maybe it needs to be in a public AWS S3 bucket or something similar? |
From My PR above, a workaround suggested by someone else:
|
Does anyone know how to get trivy-action to auth with a privately hosted trivy-db repo? I can get it working fine with normal trivy on local, but trivy-action does not work with either
|
I was able to get it to work with ECR only using an OIDC login via the configure-aws-credentials action used right before the trivy action. It is not using docker to pull the artifact as it is not a docker image. |
I am poor student |
I have no long-term tests yet, but from my understanding of GH's rate limiting, just providing a token of any sort will give you higher quotas? If that's the case, the following should help: - name: Run Trivy scan on image
uses: aquasecurity/trivy-action@0.24.0
with:
[... your config ...]
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
I've tried logging in to GHCR via docker/login-action before running Trivy CLI (not action), and I am still getting lots of 429 errors. |
So, if I understand this correctly: I, as the consumer of this action, must download copies of these DBs and store them on my own registry. Then, I must pass environment variables to the action which point at my copies of the DBs. Is that correct? How often are these DBs updated? |
@nnellanspdl think its at 00:00 every day? but im not sure. But anyway this workaround is a hustle to host them self if u need to update them every day |
Same for me, it doesn't seem to have significant effects. |
I'm trying with: env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} I spawned multiple parallel ci/cd actions, and this seems more reliable. |
If anyone is going the route of uploading the Trivy DB to their own registry, I've had success using https://github.com/oras-project/setup-oras Something like:
|
I setup AWS ECR pull-throuhg cache for trivy-db and trivy-java-db , modified action:
but pulling of trivy-db fails with:
Docker is logged-in.
Has somebody tried to pull trivy-db from AWS ECR using action? |
Yes so you can pull from ECR pull through but only if you do an OIDC set-aws-credentials action first before the trivy action. Im not sure why yet that you cannot use anything but OIDC, or at least I can't seem to get regular role assumption to work. Docker login doesnt help you as the container doesnt try to pull the DB using docker commands. If you try a docker pull you will get the unsupported media type error as the above post, as the artifact isnt an 'image' |
Ah, thanks. I was logged in under the incorrect account when I posted originally. That's what I was wondering, @billhammond-dev ! |
This was my error, for anyone else who runs into it:
|
Thanks. Yes, this is a lot to ask of consumers of your action. |
I'm guessing it would be too much work to update the logic for pulling the file to allow passing it the file directly? We could setup a workflow to pull and stash the image every X hours, and then in the workflow that uses the image, we pull the file from the stash to use. It'd lower the amount of hits by users, and we wouldn't need to host it in AWS and pay |
@NicholasFiorentini that's interesting, would you mind creating a PR to document this in the repo? If possible, could you also reference where this environment variable is documented? |
FWIW, here's a sample snippet for using AWS ECR pull through cache repositories using OIDC for AWS auth. Pull through cache ECR repositories (for hosting the cached trivy DB artifacts) must be configured prior to running this workflow, see documentation.
Per AWS documentation:
|
does |
Surely it can t be hard @simar7 to have automatic fallback to other registrys as a feature! We shouldn't be having to edit our actions to add this config otherwise its a breaking change! How hard could it be to have it mirrored in multiple locations and then just have a list of these it trys first inside the actual action! |
This is an open source project we use for free, not a paid proprietary software you are paying to use, so there is no point in being offensive. Go is not my strength, but I have made a small PR with the changes (I believe) needed to add this other AWS mirror Registry as part of the default registries along with GHRC. Hopefully it can pass. |
* ci: refactor scan-images.yaml workflow This commit refactors the scan images workflow to use the aquasecurity/trivy-action Github action instead of the kubeflow-ci/scripts/images/scan-images.sh. This to make the workflow faster and more configurable based on the action's inputs. This commit also applies a mitigation for the upstream issue aquasecurity/trivy-action#389, as the number of DB download requests would be reduced (each image is scanned independently in its own Github runner).
This commit mitigates aquasecurity/trivy-action#389, by passing ecr registries to the TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY to avoid hitting request limits.
This commit mitigates aquasecurity/trivy-action#389, by passing ecr registries to the TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY to avoid hitting request limits.
GitHub Container Registry is returning a TOOMANYREQUESTS error. Switch to AWS ECR mirror, as suggested in aquasecurity/trivy-action#389. Signed-off-by: Ivan Valdes <ivan@vald.es>
GitHub Container Registry is returning a TOOMANYREQUESTS error. Switch to AWS ECR mirror, as suggested in aquasecurity/trivy-action#389. Signed-off-by: Ivan Valdes <ivan@vald.es>
This will probably get me down voted, but (as a long time open source dev myself) I don't think what @adambirds wrote is offensive at all. I just read a fairly understandable expression of frustration from a fellow human about the fact that the vulnerability DB availability is unstable. Anyway, having said that and to come back to the heart of the matter and to summarize:
While I agree this is an open source project, it is also an open source project backed by Aquasec themselves and used as a backbone for their commercial products. Or did I get that wrong? Anyway, all of the above sounds like workarounds to me and not final solutions. While it is perfectly feasible for companies (and even larger open source projects) to setup caching proxies for the DB themselves, small open source projects / devs generally don't have that luxury. edit: so the most practical solution so far is to use a Github workflow to cache an updated DB once a day.. though that's far from ideal. |
Couldn't have put it better @mvdkleijn! As you say small developers don't have the luxury of setting up proxies or extra caches or keeping their own mirror! As @nvuillam also said the other week, having people host their own mirrors becomes a vulnerability in itself! My comment was just frustration because it shouldn't be that hard to have more official mirrors and a list built into the code that it loops round and tries which would solve the issue! And as far as my research goes there is apparently a couple of mirrors but no official list of them anywhere and we should by required to edit all our action to include an argument list of mirrors ourselves because they could become out of date and it is a breaking change which based off the version change it shouldn't be as they only did a minor version number change. At the moment it's still broken, causing hundreds probably of failures for people using it wasting so many hours and minutes of actions! |
Hi, we're using trivy to scan our containers, lately we've been seeing an increase number of rate-limiting errors when trivy is downloading the vulnerability database.
My guess is this is a global ratelimit as i can't imagine our low number of devs are causing 700+ requests a second.
I have in the meantime discovered that these scans are only used for SBOM generation on our end so we don't need to download the vulnerability database everytime, but i though this issue should be raised as i can't imagine we are the only ones seeing these errors.
The text was updated successfully, but these errors were encountered: