How to configure notification in clair without error messages

[flomickl]

Hi,
I am wondering how to set up the notification.

At the moment I get a lot of errors in my clair logs like

{"level":"error","component":"notifier/Delivery.Deliver","deliverer":"webhook","error":"failed to deliver notification: code: 401 status 401 Unauthorized","time":"2024-07-12T09:17:53Z","message":"encountered error on tick"}
{"level":"error","deliverer":"webhook","component":"notifier/Delivery.Deliver","error":"failed to deliver notification: code: 401 status 401 Unauthorized","time":"2024-07-12T09:17:58Z","message":"encountered error on tick"}

I could not find a complete configuration for the notifier. The only info I found was here [1] or here [2] and some config.yml examples from clair.

Do I have to cinfig anything else? Why do I get the errors?

In the end I came up with following config:

log_level: warn
introspection_addr: ":8000"
http_listen_addr: ":6000"
updaters:
  sets:
    - "alpine"
    - "aws"
    - "debian"
    - "oracle"
    - "osv"
    - "photon"
    - "rhcc"
    - "rhel"
    - "suse"
    - "ubuntu"
indexer:
  connstring: "host=clair-db port=5432 user=clair password=clair dbname=indexer sslmode=disable"
  scanlock_retry: 10
  layer_scan_concurrency: 5
  migrations: true
matcher:
  connstring: "host=clair-db port=5432 user=clair password=clair dbname=matcher sslmode=disable"
  migrations: true
matchers:
  names:
  - "alpine-matcher"
  - "aws-matcher"
  - "debian-matcher"
  - "gobin"
  - "java-maven"
  - "oracle"
  - "photon"
  - "python"
  - "rhel"
  - "rhel-container-matcher"
  - "suse"
  - "ubuntu"
notifier:
  connstring: "host=clair-db port=5432 user=clair password=clair dbname=notifier sslmode=disable"
  indexer_addr: http://localhost:6000/
  matcher_addr: http://localhost:6000/
  migrations: true
  delivery_interval: 5s
  poll_interval: 15s
  webhook:
    target: "http://localhost:6000/secscan/notification"
    callback: "http://localhost:6000/notifier/api/v1/notification/"
metrics:
  name: "prometheus"

# ===== AUTH
auth:
  psk:                  
    key: 'xxxxxxxxxxx'
    iss:
      - 'quay'

I am starting clair with following podman run command

podman run \
  --name clair \
  --network quay-backend \
  --network clair-backend \
  --network traefik-proxy \
  -it \
  -d \
  -v /data/quay/config/clair/config.yaml:/src/clair/config.yaml:ro,Z \
  --env-file /data/quay/clair.env \
  -e TZ=Europe/Berlin \
  -e CLAIR_CONF="/src/clair/config.yaml" \
  -e CLAIR_MODE="combo" \
  -e CLAIR_DB_USER="clair" \
  -e CLAIR_DB_PASSWORD="clair" \
  -e TZ=Europe/Berlin \
  --label diun.enable=true \
  --label io.containers.autoupdate=registry \
  --health-cmd="curl -f http://localhost:8000/healthz || exit 1" \
  --health-interval=30s \
  --health-timeout=10s \
  --health-retries=3 \
  quay.io/projectquay/clair:4.7.4 \
  bash -c "cd /src/clair/cmd/clair; go run -mod vendor ."

[1] https://quay.github.io/clair/reference/notifier.html
[2] https://quay.github.io/clair/concepts/notifications.html

It seems to work in some way. In quay I get scan results with vulnerabilities after pushing images to the registry.

[hdonnay]

401 Unauthorized

This is coming from the webhook receiver. It looks like you have Clair configured to send notifications to itself, which won't work.