Security Scan report not loading

[mkmumbai]

We are using Clair version clair:4.7.4 and Quay version quay:3.12.11. I am having issue where some images in UI I can see Security Scan as Passed and all the vulnerabilities reported in UI. But for many repository images I see no scan and only it says "Could not load security information"

[mkmumbai]

[hdonnay]

Please post Clair logs from the time period where you're making the vulnerability report request.

[mkmumbai]

log.zip

[mkmumbai]

log.zip

Please find Clair logs attached.

[mkmumbai]

I see Vulnerability report refresh after 5-6 times but not getting instantly. Do we need to tweak some parameter so that refresh is faster. I am attaching the screenshot.

[crozzy]

It seems like the database is the bottleneck here, specifically the enrichment queries on the matcher tables. There are some enrichment optimizations in the latest versions so upgrading is an option, other than that you can try increasing the database resources and see if you see better performance.

[mkmumbai]

Sometimes I see Gateway Timeout from Nginx running on Quay. Can we tweak nginx so that it waits for some more time to fetch the result. Because sometime the same query result is received within 20 seconds. The nginx gateway timeout is exactly happening at 60 seconds.

[crozzy]

I'm not sure about the quay configuration options, it's possible there is configuration option for that

[mkmumbai]

Can you please add option to update proxy_read_timeout in server_base.conf.jnj for /api/ location

location /api/ {
proxy_pass http://web_app_server;

{% if enable_rate_limits %}
limit_req zone=dynamicauth_heavy_http1 burst=25 nodelay;
limit_req zone=dynamicauth_heavy_http2 burst=100 nodelay;
{% endif %}

keepalive_timeout 0; # Disables HTTP 1.1 keep-alive and forces round-robin.

}

Just like you did for /v2 api.
The below setting is added in v.3.13.0 with config param
manifests_endpoint_read_timeout = config.get("MANIFESTS_ENDPOINT_READ_TIMEOUT", None)

{% if manifests_endpoint_read_timeout %}
proxy_read_timeout {{ manifests_endpoint_read_timeout }};
{% endif %}
}

[crozzy]

Would you be able to create an issue in the quay issue tracker? None of us work on quay so we cannot triage / prioritize this work. Thanks!