问题描述
我目前正在寻找可以使用clair扫描quayrepos的工具。 这里有一些基本信息:
- Docker版本:19.03.13
- Docker API版本:1.40
- GO版本:go1.13.15
- 操作系统:redhat 7.9
- 容器版本(Redis,Postgres,Clair,Quay):最新
- 存储:RadisGWStorage
- 码头数据库:Mariadb(外部服务器)
- Clair DB:Postgres(在与码头一样的同一服务器上运行)
- Redis,Postgres,Clair和Quay在同一台服务器上运行,但在不同的容器中。
我的问题:
{"Event":"Could not send notification via notifier","Level":"error","Location":"notifier.go:173","Time":"2020-10-15 08:04:40.730379","error":"Post https://domain/secscan/notify: proxyconnect tcp: dial tcp IP:6063: connect: connection refused","notification name":"09c0498e-c30d-4f1b-9bb2-d07588351618","sender name":"webhook"}
{"Event":"giving up on sending notification : max attempts exceeded","Level":"info","Location":"notifier.go:157","Time":"2020-10-15 08:04:40.730431","max attempts":3,"sender name":"webhook"}
我的Clair配置:
clair:
database:
type: pgsql
options:
# A Postgresql Connection string pointing to the Clair Postgres database.
# Documentation on the format can be found at http//www.postgresql.org/docs/9.4/static/libpq-connect.html
source: postgresql://username:password@domain:5432/clairtest?sslmode=disable
cachesize: 16384
api:
# The port at which Clair will report its health status. For example,if Clair is running at
# https://clair.mycompany.com,the health will be reported at
# http://clair.mycompany.com:6061/health.
healthport: 6061
port: 6062
timeout: 900s
# paginationkey can be any random set of characters. *Must be the same across all Clair instances*.
paginationkey: "key"
updater:
# interval defines how often Clair will check for updates from its upstream vulnerability databases.
interval: 6h
notifier:
attempts: 3
renotifyinterval: 1h
http:
# QUAY_ENDPOINT defines the endpoint at which Quay is running.
# For example: http://myregistry.mycompany.com
endpoint: https://domain/secscan/notify
proxy: https://domain:6063
jwtproxy:
signer_proxy:
enabled: true
listen_addr: :6063
ca_key_file: /certificates/mitm.key # Generated internally,do not change.
ca_crt_file: /certificates/mitm.crt # Generated internally,do not change.
insecure_skip_verify: true
signer:
issuer: security_scanner
expiration_time: 5m
max_skew: 1m
nonce_length: 32
private_key:
type: preshared
options:
key_id: key
private_key_path: /clair/config/security_scanner.pem
verifier_proxies:
- enabled: true
# The port at which Clair will listen.
listen_addr: :6060
# If Clair is to be served via TLS,uncomment these lines. See the "Running Clair under TLS"
# section below for more information.
# key_file: /clair/config/clair.key
# crt_file: /clair/config/clair.crt
verifier:
# CLAIR_ENDPOINT is the endpoint at which this Clair will be accessible. Note that the port
# specified here must match the listen_addr port a few lines above this.
# Example: https://myclair.mycompany.com:6060
audience: https://domain:6060
upstream: https://domain:6062
key_server:
type: keyregistry
options:
# QUAY_ENDPOINT defines the endpoint at which Quay is running.
# Example: https://myregistry.mycompany.com
registry: https://domain/keys/
claims_verifiers:
- type: static
options:
iss: jwtproxy
所以您知道如何解决此问题,或者您知道如何更好地对其进行调试。顺便说一句,我试图用tcpdump和strace和Wireshark调试它。
感谢您的帮助!
解决方法
几个小时前我已经解决了。首先,我将IP更改为127.0.0.1:6063。之后,我们发现,如果您不给他和中间人一个证书,那么码头和便秘就无法建立对rootca的信任链。然后我们发现clair的密钥已过期,无法创建新密钥。因此,我们删除了所有密钥,并在重新启动几次后,一切正常。
LG VallingSki