Some PODs do not get scanned and shown in Vulnerability List

[VF-mbrauer]

For some PODs we see that they are not getting scanned in the Vulnerability list. Other PODs in the same namespace are OK.
Also, this affects other Namespaces. Intermittent PODs across the complete cluster namespace landscape are affected.

Also, there is no error message at all. Only in DEBUG we see that it got skipped:

1.6866599947487166e+09  DEBUG   reconciler.vulnerabilityreport  Getting workload from cache     {"kind": "Pod", "name": "mynamespace/mydeployment-7cf47f76dc-pxlpg"}
1.6866599947487452e+09  DEBUG   reconciler.vulnerabilityreport  Ignoring managed pod    {"kind": "Pod", "name": "mynamespace/mydeployment-7cf47f76dc-pxlpg", "controllerKind": "ReplicaSet", "controllerName": "mydeployment"}
1.6866599962622077e+09  DEBUG   reconciler.vulnerabilityreport  Getting workload from cache     {"kind": "ReplicaSet", "name": "mydeployment-7cf47f76dc"}
1.6866599962627e+09     DEBUG   reconciler.vulnerabilityreport  Scan job already exists {"kind": "ReplicaSet", "name": "mynamespace/mydeployment-7cf47f76dc", "podSpecHash": "bb6696d6c", "job": "trivy-system/scan-vulnerabilityreport-5456688f94"}

Helm Chart 0.14.1, App-Version 0.14.1, k8s 1.23

[chen-keinan]

@VF-mbrauer this msg Scan job already exists appear in log when the exact same scan-job for same resource is already in progress.

The logic the determine above check two things:

• job with same name exist based on (name, kind,namespace)
• if 1st one found it check it has the label (resource-spec-hash) which match specific hash(compute based on pod spec)

[VF-mbrauer]

Also created an Issue upon @chen-keinan advise.

[farizz1]

Hi, i have same problem Trivy-operator deployed to a Rancher K8s cluster, some pods with in the same namespace and rancher project are scanned while others not. especially the kube-system namespace workloads are not scanned at all or either no vulnerability-report is generated.
Trivy-operator version: 0.23.0
trivy:0.58.0