Redhat clair 无法通过通知程序发送通知答案

【问题标题】：Redhat clair could not send notification via notifierRedhat clair 无法通过通知程序发送通知
【发布时间】：2020-10-15 08:19:05
【问题描述】：

我目前正在寻找可以使用 clair 扫描 quayrepos。这里有一些基本信息：

Docker 版本：19.03.13
Docker API 版本：1.40
GO版本：go1.13.15
操作系统：redhat 7.9
容器版本（Redis、Postgres、Clair、Quay）：最新
存储：RadisGWStorage
码头数据库：Mariadb（外部服务器）
Clair DB：Postgres（在与 quay 相同的服务器上运行）
Redis、Postgres、Clair 和 Quay 在同一台服务器上运行，但在不同的容器中。

我的问题：

{"Event":"could not send notification via notifier","Level":"error","Location":"notifier.go:173","Time":"2020-10-15 08:04:40.730379","error":"Post https://domain/secscan/notify: proxyconnect tcp: dial tcp IP:6063: connect: connection refused","notification name":"09c0498e-c30d-4f1b-9bb2-d07588351618","sender name":"webhook"}


{"Event":"giving up on sending notification : max attempts exceeded","Level":"info","Location":"notifier.go:157","Time":"2020-10-15 08:04:40.730431","max attempts":3,"notification name":"09c0498e-c30d-4f1b-9bb2-d07588351618","sender name":"webhook"}

我的 Clair 配置：

    clair:
  database:
    type: pgsql
    options:
      # A PostgreSQL Connection string pointing to the Clair Postgres database.
      # Documentation on the format can be found at http//www.postgresql.org/docs/9.4/static/libpq-connect.html
      source:  postgresql://username:password@domain:5432/clairtest?sslmode=disable
      cachesize: 16384
  api:
    # The port at which Clair will report its health status. For example, if Clair is running at
    # https://clair.mycompany.com, the health will be reported at
    # http://clair.mycompany.com:6061/health.
    healthport: 6061

    port: 6062
    timeout: 900s

    # paginationkey can be any random set of characters. *Must be the same across all Clair instances*.
    paginationkey: "key"

  updater:
    # interval defines how often Clair will check for updates from its upstream vulnerability databases.
    interval: 6h
  notifier:
    attempts: 3
    renotifyinterval: 1h
    http:
      # QUAY_ENDPOINT defines the endpoint at which Quay is running.
      # For example: http://myregistry.mycompany.com
      endpoint: https://domain/secscan/notify
      proxy: https://domain:6063

jwtproxy:
  signer_proxy:
    enabled: true
    listen_addr: :6063
    ca_key_file: /certificates/mitm.key # Generated internally, do not change.
    ca_crt_file: /certificates/mitm.crt # Generated internally, do not change.
    insecure_skip_verify: true
    signer:
      issuer: security_scanner
      expiration_time: 5m
      max_skew: 1m
      nonce_length: 32
      private_key:
        type: preshared
        options:
          key_id: key
          private_key_path: /clair/config/security_scanner.pem

  verifier_proxies:
  - enabled: true
    # The port at which Clair will listen.
    listen_addr: :6060

    # If Clair is to be served via TLS, uncomment these lines. See the "Running Clair under TLS"
    # section below for more information.
    # key_file: /clair/config/clair.key
    # crt_file: /clair/config/clair.crt

    verifier:
      # CLAIR_ENDPOINT is the endpoint at which this Clair will be accessible. Note that the port
      # specified here must match the listen_addr port a few lines above this.
      # Example: https://myclair.mycompany.com:6060
      audience: https://domain:6060

      upstream: https://domain:6062
      key_server:
        type: keyregistry
        options:
          # QUAY_ENDPOINT defines the endpoint at which Quay is running.
          # Example: https://myregistry.mycompany.com
          registry: https://domain/keys/
      claims_verifiers:
      - type: static
        options:
          iss: jwtproxy

那么你知道如何解决这个问题，或者你知道我怎样才能更好地调试它。顺便说一句，我尝试使用 tcpdump 和 strace 和 wireshark 对其进行调试。

感谢您的帮助！

【问题讨论】：

标签： docker proxy redhat clair quay.io

【解决方案1】：

几个小时前我已经解决了。首先，我将 IP 更改为 127.0.0.1:6063。之后我们发现如果你不给他中间 ca，quay 和 clair 就无法创建到 rootca 的信任链。然后我们发现 clair 有一个过期的密钥，不能创建一个新的。所以我们删除了所有密钥，重启几次后，它工作正常。

LG 瓦林滑雪

【讨论】：