🤖 Generated by the Daily AI Assistant
Problem
Posture results are still empty after #2443/#2452 deployed (v4.0.10 + scheduler keepLocal live at 16:13Z): 0 workloadconfigurationscansummaries, compliance stuck at 0 in Headlamp. Live scanner logs show every scan since the rollout (51/51 in ~45 min, ~1 per 36s) aborting at the cloud-submit step:
failed to generate account ID: chmod /home/nonroot/.kubescape: read-only file system → scanning failed
These are operator-triggered continuous-scan requests (capabilities.continuousScan: enable + offline renders continuousPostureScan: true; the operator's continuousscanning service fires a kubescapeScan command per watched-resource event). That request path never carries scanV1.keepLocal — upstream's offline fix (helm-charts#862) only patched the scheduler CronJob request body — so offline, every one of these scans runs Submit-mode, hits account-ID generation, and dies. The retry flood also keeps the scan queue permanently backlogged, delaying/starving the daily keepLocal scheduler scan.
Proposed direction
Set capabilities.continuousScan: disable (the chart 1.40.2 default). The daily scheduler scan (with keepLocal: true, from #2443) becomes the posture source — correct for an air-gapped install. Re-enable only if upstream propagates Local/keepLocal into the continuous-scan command path.
Size
S — one values line + doc comment.
Part of #2447
Problem
Posture results are still empty after #2443/#2452 deployed (v4.0.10 + scheduler
keepLocallive at 16:13Z): 0workloadconfigurationscansummaries, compliance stuck at 0 in Headlamp. Live scanner logs show every scan since the rollout (51/51 in ~45 min, ~1 per 36s) aborting at the cloud-submit step:failed to generate account ID: chmod /home/nonroot/.kubescape: read-only file system→scanning failedThese are operator-triggered continuous-scan requests (
capabilities.continuousScan: enable+ offline renderscontinuousPostureScan: true; the operator's continuousscanning service fires akubescapeScancommand per watched-resource event). That request path never carriesscanV1.keepLocal— upstream's offline fix (helm-charts#862) only patched the scheduler CronJob request body — so offline, every one of these scans runs Submit-mode, hits account-ID generation, and dies. The retry flood also keeps the scan queue permanently backlogged, delaying/starving the daily keepLocal scheduler scan.Proposed direction
Set
capabilities.continuousScan: disable(the chart 1.40.2 default). The daily scheduler scan (withkeepLocal: true, from #2443) becomes the posture source — correct for an air-gapped install. Re-enable only if upstream propagates Local/keepLocal into the continuous-scan command path.Size
S — one values line + doc comment.
Part of #2447