node-selector taints

[bpopovich44]

Question

I have recently added trivy-operator to my rke2 kubernetes cluster. The node-collector sits in pending because I have taints on my master nodes. If I remove the taints the node-collector runs as expected. I need these taints in place to ensure pods are not assigned to the master nodes. How can I apply taints to the node-collector job/pod? I did a test and removed the taints from the master nodes and the node-collector succeeded, but when I reapplied the taints I get the error again.

Warning FailedScheduling 81s (x3 over 11m) default-scheduler 0/6 nodes are available: 3 node(s) didn't match Pod's node affinity/selector, 3 node(s) had untolerated taint {node-role.kubernetes.io/control-plane: }. preemption: 0/6 nodes are available: 6 Preemption is not helpful for scheduling..

I did add a toleration directly to the node-collector, but when it is re-created, the toleration is not there. I also added the toleration to the deployment, but it only reflects in the trivy-operator which is running with no issues. I am not able to add the toleration to the job.

Thank you

Target

Kubernetes

Scanner

Vulnerability

Output Format

Table

Mode

Client/Server

Operating System

linux

Version

0.18.4

[chen-keinan]

@bpopovich44 should be fixed by aquasecurity/trivy-operator#1644 and to be released with v0.17.0

[asamudrala1]

Hello @chen-keinan, I'm encountering a similar issue as described earlier. Currently, I'm utilizing the static kustomization files available in the following repository: https://github.com/aquasecurity/trivy-operator/tree/main/deploy/static
Our cluster has Karpenter enabled, and although I've set up tolerations for the trivy-operator, they seem to be applied only to the trivy-operator pod and not the node-collector pod. As a result, the node-collector pod remains in the pending state.

[itaysk]

@chen-keinan ?

[chen-keinan]

@asamudrala1 can you please open an issue with trivy-operator github and add your env. details (k8s version , trivy-operator version) and trivy-operator config maps.