Kubernetes scan fails with error: panic: runtime error: invalid memory address or nil pointer dereference

[apinter]

Description

Hi,

I'm toying with a little trivy container (based on the official aquasec/trivy image) which I would like to use to scan kubernetes clusters, save the output in a json format, then upload it to an S3 bucket. All the customization from my side is done (a simple python script that executes trivy scan just like one would from any shell) and works fine outside of the cluster, however, once I deploy it inside the k8s cluster it fails with a nasty panic. Since I have quite a unique situation, I can't use the operator.
Very similar to this older issue: #2174

Desired Behavior

The container is capable of scanning the cluster from within the cluster.

Actual Behavior

I received the following error:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x6478eb4]

goroutine 1 [running]:
github.com/aquasecurity/trivy-kubernetes/pkg/k8s.(*cluster).ClusterNameVersion(0xc000f860e0)
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/k8s/k8s.go:507 +0xf4
github.com/aquasecurity/trivy-kubernetes/pkg/k8s.(*cluster).getClusterBomInfo(0xc050b58?, {0xc000f51ea0, 0x2, 0x2}, {0xc0010aebd0, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/k8s/k8s.go:487 +0x4d
github.com/aquasecurity/trivy-kubernetes/pkg/k8s.(*cluster).CreateClusterBom(0x0?, {0x8cd9090, 0xc001336270})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/k8s/k8s.go:347 +0x47f
github.com/aquasecurity/trivy-kubernetes/pkg/trivyk8s.(*client).ListBomInfo(0xc00079ccd0, {0x8cd9090, 0xc001336270})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/trivyk8s/trivyk8s.go:221 +0x7f
github.com/aquasecurity/trivy-kubernetes/pkg/trivyk8s.(*client).ListArtifacts(0xc00079ccd0, {0x8cd9090, 0xc001336270})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/trivyk8s/trivyk8s.go:159 +0x39e
github.com/aquasecurity/trivy/pkg/k8s/commands.namespaceRun({_, _}, {{{0x78de96c, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0xc000555e60, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/k8s/commands/namespace.go:26 +0x245
github.com/aquasecurity/trivy/pkg/k8s/commands.Run({_, _}, {_, _, _}, {{{0x78de96c, 0xa}, 0x0, 0x0, 0x0, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/k8s/commands/run.go:50 +0x34c
github.com/aquasecurity/trivy/pkg/commands.NewKubernetesCommand.func2(0xc000247500, {0xc001156cc0, 0x1, 0x3})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:943 +0x1d6
github.com/spf13/cobra.(*Command).execute(0xc000247500, {0xc001156c60, 0x3, 0x3})
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:940 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0xc000160f00)
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:1068 +0x3bd
github.com/spf13/cobra.(*Command).Execute(0x7941b91?)
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:992 +0x19
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:35 +0x16a
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:17 +0x19
command terminated with exit code 2

Reproduction Steps

1. Create pod using the following manifest in a k8s cluster:


---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: trivy-service-account
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: trivy-cluster-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: trivy-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: trivy-cluster-role
subjects:
- kind: ServiceAccount
  name: trivy-service-account
  namespace: default
---
apiVersion: v1
kind: Pod
metadata:
  name: trivy-pod
spec:
  serviceAccountName: trivy-service-account
  containers:
    - name: trivy-container
      image: aquasec/trivy:latest
      command: ["/bin/sleep", "3600"]
      resources:
        requests:
          memory: "512M"
          cpu: "200m"
        limits:
          memory: "850M"
          cpu: "1"
      securityContext:
        privileged: true
        capabilities: 
          add: ["SYS_ADMIN"]

With or without `securityContext` the result remains the same, and for the record, this just a debug example, so don't freak out ^-^

2. `kubectl exec -it pods/trivy-pod -- trivy k8s all -f json`

Target

Kubernetes

Scanner

None

Output Format

JSON

Mode

Standalone

Debug Output

/ # trivy k8s all -f json --debug --severity="LOW"
2023-11-21T10:19:10.387Z        DEBUG   Severities: ["LOW"]
2023-11-21T10:19:10.388Z        DEBUG   Ignore statuses {"statuses": null}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x6478eb4]

goroutine 1 [running]:
github.com/aquasecurity/trivy-kubernetes/pkg/k8s.(*cluster).ClusterNameVersion(0xc001a94a10)
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/k8s/k8s.go:507 +0xf4
github.com/aquasecurity/trivy-kubernetes/pkg/k8s.(*cluster).getClusterBomInfo(0xc050b58?, {0xc0004ada40, 0x2, 0x2}, {0xc000f6c690, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/k8s/k8s.go:487 +0x4d
github.com/aquasecurity/trivy-kubernetes/pkg/k8s.(*cluster).CreateClusterBom(0x0?, {0x8cd9090, 0xc000f74ae0})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/k8s/k8s.go:347 +0x47f
github.com/aquasecurity/trivy-kubernetes/pkg/trivyk8s.(*client).ListBomInfo(0xc0019385a0, {0x8cd9090, 0xc000f74ae0})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/trivyk8s/trivyk8s.go:221 +0x7f
github.com/aquasecurity/trivy-kubernetes/pkg/trivyk8s.(*client).ListArtifacts(0xc0019385a0, {0x8cd9090, 0xc000f74ae0})
        /home/runner/go/pkg/mod/github.com/aquasecurity/trivy-kubernetes@v0.5.9-0.20231019164303-dcdfdc50763f/pkg/trivyk8s/trivyk8s.go:159 +0x39e
github.com/aquasecurity/trivy/pkg/k8s/commands.namespaceRun({_, _}, {{{0x78de96c, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc00050f158, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/k8s/commands/namespace.go:26 +0x245
github.com/aquasecurity/trivy/pkg/k8s/commands.Run({_, _}, {_, _, _}, {{{0x78de96c, 0xa}, 0x0, 0x0, 0x1, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/k8s/commands/run.go:50 +0x34c
github.com/aquasecurity/trivy/pkg/commands.NewKubernetesCommand.func2(0xc00015ef00, {0xc000525ea0, 0x1, 0x5})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:943 +0x1d6
github.com/spf13/cobra.(*Command).execute(0xc00015ef00, {0xc000525e50, 0x5, 0x5})
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:940 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0xc000f07200)
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:1068 +0x3bd
github.com/spf13/cobra.(*Command).Execute(0x7941b91?)
        /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.7.0/command.go:992 +0x19
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:35 +0x16a
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:17 +0x19

Operating System

k3s 1.27 and kind 1.25

Version

/ # trivy --version
Version: 0.47.0

This image: https://hub.docker.com/layers/aquasec/trivy/latest/images/sha256-163b935486680eefe46e38534eaeabd95e36e0e6b7b3fa5d08fb1e05c6ad9f20?context=explore

Checklist

• Run trivy image --reset
• Read the troubleshooting

[chen-keinan]

@apinter fixed by #5629

[apinter]

Awesome, thank you!