Setup static single robot account for job service ScanAll

[rekha-prakash-maersk]

Hello,

I have weekly scan that scans some half million artifacts. So noticing in the logs that job services deletes a unique token after scanning each artifact. I understand that this unique robot provide enhanced security. But I like to know is there any option I can provide a system robot secret that can be used for pulling images during the scan job ?

I assume it would reduce load on other components while creating and deleting each robots.

[MinerYang]

Hi @rekha-prakash-maersk ,

Which harbor version it is?
Would a system robot account satisfy your use case?

[rekha-prakash-maersk]

Hi @MinerYang , yes we have a system robot that can be used for this task.

I am on harbor version v2.12.2

I am using harbor helm charts. So, my question is around how to configure the job service values.yaml file to use a system robot account for the ScanAll task alone and follow the default robot creation behaviour for other tasks as usual

[MinerYang]

the default robot account your mentioned is for trivy to scan or generate SBOM, and will be deleted after the job done, this is internally used only and there's no options to configure it.

[reasonerjt]

@rekha-prakash-maersk Just to clarify the creation and removel of robot account is considered relatively cheap. It won't help if you think it takes too long to scan half a million images.

[rekha-prakash-maersk]

@reasonerjt , I am running into performance issues when I run the scanAll against the half a million (~16TB) even at midnight. so looking for some fine tuning options.

I have HPA enabled, but I cant seem to apply the HPA on job service based on the pending scan queues. I do have postgres with replica , so increasing worker pool on job service also puts pressure on postgres DB.

[rekha-prakash-maersk]

@reasonerjt , the job service suddenly requires more memory at the end of the ScanAll. I also notice sudden spike in Trivy network bandwidth and also Egress spike in DB only at the end of scanAll. can you point me to the code what happens at the end of ScanAll that requires more resources for job service ?

is there any list of tasks like job summary or scan result upload happens at the end ? thanks!

[rekha-prakash-maersk]

Just sharing reference here, the scanAll starts 17:00 and 99.99% artifacts shows completed on UI around 18:00. But then suddenly the job service goes into restarts loop with OOM Killed