Where does trivy-operator take the report.artifact.digest value in sbom report from?

[Talkapon]

I am seeing multiple cases where the report.artifact.digest does not correspond to any of the values in the relevant pods. I am looking at containerStatuses.image, containerStatuses.imageID, and containers.image. Can you explain why is that?

[chen-keinan]

@Talkapon can you please add example with details where it do not match ? with an image that can be reproduced ?

[Talkapon]

Here is an example:

The sbom yaml (partial)

apiVersion: aquasecurity.github.io/v1alpha1
kind: SbomReport
metadata:
creationTimestamp: "2024-04-02T04:50:06Z"
generation: 24
labels:
resource-spec-hash: 598c5c7d4
trivy-operator.container.name: opencost
trivy-operator.resource.kind: ReplicaSet
trivy-operator.resource.name: opencost-756774ccc9
trivy-operator.resource.namespace: opencost
name: replicaset-opencost-756774ccc9-opencost
namespace: opencost
ownerReferences:

• apiVersion: apps/v1
  blockOwnerDeletion: false
  controller: true
  kind: ReplicaSet
  name: opencost-756774ccc9
  uid: 994515f3-0a92-4eac-9a48-de033db71db6
  resourceVersion: "114677152"
  uid: 2b707100-e81a-4602-b0ae-94d3f545aebd
  report:
  artifact:
  digest: sha256:794edb116f441ca8276a9141297e4b7f268a96dfdeec06eabaab877290bd5d69
  repository: kubecost1/kubecost-cost-model
  tag: latest

The pod yaml:

apiVersion: v1
items:

• apiVersion: v1
  kind: Pod
  metadata:
  annotations:
  cni.projectcalico.org/containerID: f622edb7576e4ca5175f984a6eae3da08469a11ef90ad03cd60bd4c6b38d629f
  cni.projectcalico.org/podIP: 10.244.2.4/32
  cni.projectcalico.org/podIPs: 10.244.2.4/32
  creationTimestamp: "2023-12-06T09:26:21Z"
  generateName: opencost-756774ccc9-
  labels:
  app: opencost
  pod-template-hash: 756774ccc9
  name: opencost-756774ccc9-qp7px
  namespace: opencost
  ownerReferences:
  • apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: opencost-756774ccc9
    uid: 994515f3-0a92-4eac-9a48-de033db71db6
    resourceVersion: "87655633"
    uid: dcdf99d1-772b-4ba3-83e4-6192fd05a31f
    spec:
    containers:
  • env:
    • name: PROMETHEUS_SERVER_ENDPOINT
      value: http://my-prometheus-server.prometheus.svc
    • name: CLOUD_PROVIDER_API_KEY
      value: AIzaSyD29bGxmHAVEOBYtgd8sYM2gM2ekfxQX4U
    • name: CLUSTER_ID
      value: cluster-one
      image: quay.io/kubecost1/kubecost-cost-model:latest
      imagePullPolicy: Always
      name: opencost
      resources:
      limits:
      cpu: 999m
      memory: 1G
      requests:
      cpu: 10m
      memory: 55M
      securityContext:
      allowPrivilegeEscalation: false
      capabilities:
      drop:
      • ALL
        privileged: false
        readOnlyRootFilesystem: true
        runAsUser: 1001
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
    • mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-g8f6p
      readOnly: true
  • image: quay.io/kubecost1/opencost-ui:latest
    imagePullPolicy: Always
    name: opencost-ui
    resources:
    limits:
    cpu: 999m
    memory: 1G
    requests:
    cpu: 10m
    memory: 55M
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    • mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-g8f6p
      readOnly: true
      dnsPolicy: ClusterFirst
      enableServiceLinks: true
      nodeName: aks-agentpool-20722746-vmss000007
      preemptionPolicy: PreemptLowerPriority
      priority: 0
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: opencost
      serviceAccountName: opencost
      terminationGracePeriodSeconds: 30
      tolerations:
  • effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  • effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  • effect: NoSchedule
    key: node.kubernetes.io/memory-pressure
    operator: Exists
    volumes:
  • name: kube-api-access-g8f6p
    projected:
    defaultMode: 420
    sources:
    • serviceAccountToken:
      expirationSeconds: 3607
      path: token
    • configMap:
      items:
      • key: ca.crt
        path: ca.crt
        name: kube-root-ca.crt
    • downwardAPI:
      items:
      • fieldRef:
        apiVersion: v1
        fieldPath: metadata.namespace
        path: namespace
        status:
        conditions:
  • lastProbeTime: null
    lastTransitionTime: "2023-12-06T09:26:21Z"
    status: "True"
    type: Initialized
  • lastProbeTime: null
    lastTransitionTime: "2023-12-06T09:26:24Z"
    status: "True"
    type: Ready
  • lastProbeTime: null
    lastTransitionTime: "2023-12-06T09:26:24Z"
    status: "True"
    type: ContainersReady
  • lastProbeTime: null
    lastTransitionTime: "2023-12-06T09:26:21Z"
    status: "True"
    type: PodScheduled
    containerStatuses:
  • containerID: containerd://3e98585cd00c9faa856000bd8e904c4df44cebaa8ca9a516015ab769acfe5302
    image: quay.io/kubecost1/kubecost-cost-model:latest
    imageID: quay.io/kubecost1/kubecost-cost-model@sha256:223fa58c90ab41ec280e2eddd1ebefc8680e1b4689156b4c6996dc3f48c69628
    lastState: {}
    name: opencost
    ready: true
    restartCount: 0
    started: true
    state:
    running:
    startedAt: "2023-12-06T09:26:23Z"
  • containerID: containerd://7aba1afec5631fd95b0c0c83a28cfe73c584e0f25648916094d62420e3d1d4d4
    image: quay.io/kubecost1/opencost-ui:latest
    imageID: quay.io/kubecost1/opencost-ui@sha256:71ac83e5fef451a3009abb92d2d974ef5b5ea20f00597053c87d89fd744b08d5
    lastState: {}
    name: opencost-ui
    ready: true
    restartCount: 0
    started: true
    state:
    running:
    startedAt: "2023-12-06T09:26:24Z"
    hostIP: 10.224.0.4
    phase: Running
    podIP: 10.244.2.4
    podIPs:
  • ip: 10.244.2.4
    qosClass: Burstable
    startTime: "2023-12-06T09:26:21Z"
    kind: List
    metadata:
    resourceVersion: ""

[chen-keinan]

@Talkapon I need something more simple, if you can put here a public image name for example (so I could reproduce it).
and write what digest you expect to see for it.

[Talkapon]

Hi Chen, as you can see in the yamls, the images mentioned are public images. For example: quay.io/kubecost1/kubecost-cost-model. To install the whole kubecost app, you can follow the instructions in https://www.kubecost.com/install#show-instructions.