[BUG] Panic error while trying to mount custom ca cert

[Whisper40]

Describe the bug
Because the helm chart does not support mounting volumes into pod, i manually added volumemount, and created a configmap with my certificate.
I definied this env :
VERSION_CHECKER_SELFHOSTED_CA_PATH_REMOTE: ca.pem

        - name: VERSION_CHECKER_SELFHOSTED_CA_PATH_REMOTE
          value: ca.pem
        image: quay.io/jetstack/version-checker:v0.8.5
...
      volumes:
      - name: version-checker
        secret:
          defaultMode: 420
          secretName: version-checker
      - configMap:
          defaultMode: 420
          name: ca-pemstore
        name: ca-pemstore
...
        volumeMounts:
        - mountPath: ca.pem
          name: ca-pemstore
          subPath: ca.pem

The deployment is crashing with errors logs :

Defaulted container "version-checker" out of: version-checker, install-oneagent (init)
time="2025-01-23T14:43:25Z" level=info msg="serving metrics on [::]:8080/metrics" module=metrics
time="2025-01-23T14:43:25Z" level=info msg="flag --test-all-containers=true all containers will be tested, unless they have the annotation \"enable.version-checker.io/${my-container}=false\""
time="2025-01-23T14:43:25Z" level=info msg="starting control loop" module=controller
time="2025-01-23T14:43:25Z" level=info msg="starting workers" module=controller
time="2025-01-23T14:43:25Z" level=info msg="starting cache garbage collector" cache=garbage_collector module=search
time="2025-01-23T14:43:25Z" level=info msg="starting cache garbage collector" cache=garbage_collector module=version_getter
E0123 14:43:25.526571       1 panic.go:262] "Observed a panic" panic="runtime error: invalid memory address or nil pointer dereference" panicGoValue="\"invalid memory address or nil pointer dereference\"" stacktrace=<
        goroutine 68 [running]:
        k8s.io/apimachinery/pkg/util/runtime.logPanic({0x26662f0, 0x39cea60}, {0x1f602e0, 0x39705c0})
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/runtime/runtime.go:107 +0xbc
        k8s.io/apimachinery/pkg/util/runtime.handleCrash({0x26662f0, 0x39cea60}, {0x1f602e0, 0x39705c0}, {0x39cea60, 0x0, 0x10000c0001ad7e0?})
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/runtime/runtime.go:82 +0x5e
        k8s.io/apimachinery/pkg/util/runtime.HandleCrash({0x0, 0x0, 0xc0001ad7e0?})
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/runtime/runtime.go:59 +0x108
        panic({0x1f602e0?, 0x39705c0?})
                /usr/local/go/src/runtime/panic.go:785 +0x132
        regexp.(*Regexp).doExecute(0xc000d0eac0?, {0x0?, 0x0?}, {0x0?, 0x0?, 0x2?}, {0xc00069c460?, 0xc00069c460?}, 0xc000f900e0?, 0x0, ...)
                /usr/local/go/src/regexp/exec.go:527 +0x80
        regexp.(*Regexp).doMatch(...)
                /usr/local/go/src/regexp/exec.go:514
        regexp.(*Regexp).MatchString(...)
                /usr/local/go/src/regexp/regexp.go:527
        github.com/jetstack/version-checker/pkg/client/selfhosted.(*Client).IsHost(0xc00069c460?, {0xc00069c460?, 0x262fc88?})
                /app/pkg/client/selfhosted/path.go:16 +0x45
        github.com/jetstack/version-checker/pkg/client.(*Client).fromImageURL(0xc000629d10, {0xc00069c460, 0x48})
                /app/pkg/client/client.go:128 +0x16c
        github.com/jetstack/version-checker/pkg/client.(*Client).Tags(0x46f770?, {0x2666360, 0xc00019de00}, {0xc00069c460?, 0x1a0000c000d52b40?})
                /app/pkg/client/client.go:106 +0x35
        github.com/jetstack/version-checker/pkg/version.(*Version).Fetch(0x0?, {0x2666360?, 0xc00019de00?}, {0xc00069c460, 0x48}, 0x39ab140?)
                /app/pkg/version/version.go:85 +0x3b
        github.com/jetstack/version-checker/pkg/cache.(*Cache).Get(0xc0002f5180, {0x2666360, 0xc00019de00}, {0xc00069c460, 0x48}, {0xc00069c460, 0x48}, 0x0)
                /app/pkg/cache/cache.go:69 +0x2af
        github.com/jetstack/version-checker/pkg/version.(*Version).LatestTagFromImage(0xc000d52b10?, {0x2666360?, 0xc00019de00?}, {0xc00069c460, 0x48}, 0xc000d0ea40)
                /app/pkg/version/version.go:47 +0x54
        github.com/jetstack/version-checker/pkg/controller/search.(*Search).Fetch(0x0?, {0x2666360?, 0xc00019de00?}, {0xc00069c460?, 0xa084e0a?}, 0x39ab140?)
                /app/pkg/controller/search/search.go:44 +0x26
        github.com/jetstack/version-checker/pkg/cache.(*Cache).Get(0xc0002f51c0, {0x2666360, 0xc00019de00}, {0xc000c12950, 0xa}, {0xc00069c460, 0x48}, 0xc000d0ea40)
                /app/pkg/cache/cache.go:69 +0x2af
        github.com/jetstack/version-checker/pkg/controller/search.(*Search).LatestImage(0xc0005f5188, {0x2666360, 0xc00019de00}, {0xc00069c460, 0x48}, 0xc000d0ea40)
                /app/pkg/controller/search/search.go:61 +0x75
        github.com/jetstack/version-checker/pkg/controller/checker.(*Checker).isLatestSemver(0xc00069c4a9?, {0x2666360?, 0xc00019de00?}, {0xc00069c460?, 0xc000f90060?}, {0xc000452559, 0x47}, 0xc000d0ea80, 0x4f?)
                /app/pkg/controller/checker/checker.go:147 +0x52
        github.com/jetstack/version-checker/pkg/controller/checker.(*Checker).handleSemver(0xc000620df0, {0x2666360, 0xc00019de00}, {0xc00069c460, 0x48}, {0xc000452559, 0x47}, {0xc00069c4a9, 0x6}, 0x0, ...)
                /app/pkg/controller/checker/checker.go:86 +0xb5
        github.com/jetstack/version-checker/pkg/controller/checker.(*Checker).Container(0xc000620df0, {0x2666360, 0xc00019de00}, 0xc000329b20, 0x9?, 0xc000c5f760, 0xc000d0ea40)
                /app/pkg/controller/checker/checker.go:55 +0x1cf
        github.com/jetstack/version-checker/pkg/controller.(*Controller).checkContainer(0xc00061afc0, {0x2666360?, 0xc00019de00?}, 0xc000329b20, 0xc000c1e908, 0xc000c5f760, {0x232e0be, 0x4}, 0x7f97e1e06108?)
                /app/pkg/controller/sync.go:78 +0x69
        github.com/jetstack/version-checker/pkg/controller.(*Controller).syncContainer(0xc00061afc0, {0x2666360, 0xc00019de00}, 0xc000329ab0, 0xc000c5f8f0, 0xc000c1e908, 0xc000c5f760, {0x232e0be, 0x4})
                /app/pkg/controller/sync.go:60 +0x367
        github.com/jetstack/version-checker/pkg/controller.(*Controller).sync(0xc00061afc0, {0x2666360, 0xc00019de00}, 0xc000c1e908)
                /app/pkg/controller/sync.go:24 +0x333
        github.com/jetstack/version-checker/pkg/controller.(*Controller).processNextWorkItem(0xc00061afc0, {0x2666360, 0xc00019de00}, {0xc000d44540, 0x2e}, 0xd18c2e2800)
                /app/pkg/controller/controller.go:178 +0x22b
        github.com/jetstack/version-checker/pkg/controller.(*Controller).runWorker(0xc00061afc0, {0x2666360, 0xc00019de00}, 0xd18c2e2800)
                /app/pkg/controller/controller.go:131 +0x74
        github.com/jetstack/version-checker/pkg/controller.(*Controller).Run.func2()
                /app/pkg/controller/controller.go:105 +0x25
        k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1(0x30?)
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:226 +0x33
        k8s.io/apimachinery/pkg/util/wait.BackoffUntil(0xc000c8e8d0, {0x263c820, 0xc000d52930}, 0x1, 0xc00043f730)
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:227 +0xaf
        k8s.io/apimachinery/pkg/util/wait.JitterUntil(0xc000c8e8d0, 0x3b9aca00, 0x0, 0x1, 0xc00043f730)
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:204 +0x7f
        k8s.io/apimachinery/pkg/util/wait.Until(...)
                /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:161
        created by github.com/jetstack/version-checker/pkg/controller.(*Controller).Run in goroutine 1
                /app/pkg/controller/controller.go:105 +0x465
 >
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x90 pc=0x60a180]

goroutine 68 [running]:
k8s.io/apimachinery/pkg/util/runtime.handleCrash({0x26662f0, 0x39cea60}, {0x1f602e0, 0x39705c0}, {0x39cea60, 0x0, 0x10000c0001ad7e0?})
        /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/runtime/runtime.go:89 +0xee
k8s.io/apimachinery/pkg/util/runtime.HandleCrash({0x0, 0x0, 0xc0001ad7e0?})
        /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/runtime/runtime.go:59 +0x108
panic({0x1f602e0?, 0x39705c0?})
        /usr/local/go/src/runtime/panic.go:785 +0x132
regexp.(*Regexp).doExecute(0xc000d0eac0?, {0x0?, 0x0?}, {0x0?, 0x0?, 0x2?}, {0xc00069c460?, 0xc00069c460?}, 0xc000f900e0?, 0x0, ...)
        /usr/local/go/src/regexp/exec.go:527 +0x80
regexp.(*Regexp).doMatch(...)
        /usr/local/go/src/regexp/exec.go:514
regexp.(*Regexp).MatchString(...)
        /usr/local/go/src/regexp/regexp.go:527
github.com/jetstack/version-checker/pkg/client/selfhosted.(*Client).IsHost(0xc00069c460?, {0xc00069c460?, 0x262fc88?})
        /app/pkg/client/selfhosted/path.go:16 +0x45
github.com/jetstack/version-checker/pkg/client.(*Client).fromImageURL(0xc000629d10, {0xc00069c460, 0x48})
        /app/pkg/client/client.go:128 +0x16c
github.com/jetstack/version-checker/pkg/client.(*Client).Tags(0x46f770?, {0x2666360, 0xc00019de00}, {0xc00069c460?, 0x1a0000c000d52b40?})
        /app/pkg/client/client.go:106 +0x35
github.com/jetstack/version-checker/pkg/version.(*Version).Fetch(0x0?, {0x2666360?, 0xc00019de00?}, {0xc00069c460, 0x48}, 0x39ab140?)
        /app/pkg/version/version.go:85 +0x3b
github.com/jetstack/version-checker/pkg/cache.(*Cache).Get(0xc0002f5180, {0x2666360, 0xc00019de00}, {0xc00069c460, 0x48}, {0xc00069c460, 0x48}, 0x0)
        /app/pkg/cache/cache.go:69 +0x2af
github.com/jetstack/version-checker/pkg/version.(*Version).LatestTagFromImage(0xc000d52b10?, {0x2666360?, 0xc00019de00?}, {0xc00069c460, 0x48}, 0xc000d0ea40)
        /app/pkg/version/version.go:47 +0x54
github.com/jetstack/version-checker/pkg/controller/search.(*Search).Fetch(0x0?, {0x2666360?, 0xc00019de00?}, {0xc00069c460?, 0xa084e0a?}, 0x39ab140?)
        /app/pkg/controller/search/search.go:44 +0x26
github.com/jetstack/version-checker/pkg/cache.(*Cache).Get(0xc0002f51c0, {0x2666360, 0xc00019de00}, {0xc000c12950, 0xa}, {0xc00069c460, 0x48}, 0xc000d0ea40)
        /app/pkg/cache/cache.go:69 +0x2af
github.com/jetstack/version-checker/pkg/controller/search.(*Search).LatestImage(0xc0005f5188, {0x2666360, 0xc00019de00}, {0xc00069c460, 0x48}, 0xc000d0ea40)
        /app/pkg/controller/search/search.go:61 +0x75
github.com/jetstack/version-checker/pkg/controller/checker.(*Checker).isLatestSemver(0xc00069c4a9?, {0x2666360?, 0xc00019de00?}, {0xc00069c460?, 0xc000f90060?}, {0xc000452559, 0x47}, 0xc000d0ea80, 0x4f?)
        /app/pkg/controller/checker/checker.go:147 +0x52
github.com/jetstack/version-checker/pkg/controller/checker.(*Checker).handleSemver(0xc000620df0, {0x2666360, 0xc00019de00}, {0xc00069c460, 0x48}, {0xc000452559, 0x47}, {0xc00069c4a9, 0x6}, 0x0, ...)
        /app/pkg/controller/checker/checker.go:86 +0xb5
github.com/jetstack/version-checker/pkg/controller/checker.(*Checker).Container(0xc000620df0, {0x2666360, 0xc00019de00}, 0xc000329b20, 0x9?, 0xc000c5f760, 0xc000d0ea40)
        /app/pkg/controller/checker/checker.go:55 +0x1cf
github.com/jetstack/version-checker/pkg/controller.(*Controller).checkContainer(0xc00061afc0, {0x2666360?, 0xc00019de00?}, 0xc000329b20, 0xc000c1e908, 0xc000b07760, {0x232e0be, 0x4}, 0x7f97e1e06108?)
        /app/pkg/controller/sync.go:78 +0x69
github.com/jetstack/version-checker/pkg/controller.(*Controller).syncContainer(0xc00061afc0, {0x2666360, 0xc00019de00}, 0xc000329ab0, 0xc000c5f8f0, 0xc000c1e908, 0xc000b07760, {0x232e0be, 0x4})
        /app/pkg/controller/sync.go:60 +0x367
github.com/jetstack/version-checker/pkg/controller.(*Controller).sync(0xc00061afc0, {0x2666360, 0xc00019de00}, 0xc000c1e908)
        /app/pkg/controller/sync.go:24 +0x333
github.com/jetstack/version-checker/pkg/controller.(*Controller).processNextWorkItem(0xc00061afc0, {0x2666360, 0xc00019de00}, {0xc000d44540, 0x2e}, 0xd18c2e2800)
        /app/pkg/controller/controller.go:178 +0x22b
github.com/jetstack/version-checker/pkg/controller.(*Controller).runWorker(0xc00061afc0, {0x2666360, 0xc00019de00}, 0xd18c2e2800)
        /app/pkg/controller/controller.go:131 +0x74
github.com/jetstack/version-checker/pkg/controller.(*Controller).Run.func2()
        /app/pkg/controller/controller.go:105 +0x25
k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1(0x30?)
        /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:226 +0x33
k8s.io/apimachinery/pkg/util/wait.BackoffUntil(0xc000c8e8d0, {0x263c820, 0xc000d52930}, 0x1, 0xc00043f730)
        /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:227 +0xaf
k8s.io/apimachinery/pkg/util/wait.JitterUntil(0xc000c8e8d0, 0x3b9aca00, 0x0, 0x1, 0xc00043f730)
        /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:204 +0x7f
k8s.io/apimachinery/pkg/util/wait.Until(...)
        /go/pkg/mod/k8s.io/apimachinery@v0.32.0/pkg/util/wait/backoff.go:161
created by github.com/jetstack/version-checker/pkg/controller.(*Controller).Run in goroutine 1
        /app/pkg/controller/controller.go:105 +0x465

To Reproduce
Steps to reproduce the behavior:

1. Do what i described (add volume/configmap with cert)
2. See error

Expected behavior
The goal is that no tls error appears while connecting to a selfhosted registry

Environment (please complete the following information):

• Version-Checker: 0.8.5
• Kubernetes: 1.28

[davidcollom]

Hi @Whisper40 , thanks for reporting this issue, I'm not convinced this issue is related to the new CA Env and Volume, as the file pkg/client/selfhosted/path.go has nothing associated with the CA flags.

Would you be able to provide (and/or redact where applicable) all the environment variables and/or flags you're passing to version-checker to investigate this further?

As for VERSION_CHECKER_SELFHOSTED_CA_PATH_REMOTE - I would suggest looking to include absolute paths to the volume mount files, I.E:

        - name: VERSION_CHECKER_SELFHOSTED_CA_PATH_REMOTE
          value: "/ca.pem"
        image: quay.io/jetstack/version-checker:v0.8.5
...
      volumes:
      - name: version-checker
        secret:
          defaultMode: 420
          secretName: version-checker
      - configMap:
          defaultMode: 420
          name: ca-pemstore
        name: ca-pemstore
...
        volumeMounts:
        - mountPath: /ca.pem
           name: ca-pemstore
           subPath: ca.pem

[Whisper40]

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "19"
    meta.helm.sh/release-name: version-checker
    meta.helm.sh/release-namespace: version-checker
  creationTimestamp: "2025-01-22T15:40:26Z"
  generation: 19
  labels:
    app.kubernetes.io/instance: version-checker
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: version-checker
    app.kubernetes.io/version: v0.8.5
    helm.sh/chart: version-checker-v0.8.5
    helm.toolkit.fluxcd.io/name: version-checker
    helm.toolkit.fluxcd.io/namespace: version-checker
  name: version-checker
  namespace: version-checker
  resourceVersion: "82235536"
  uid: 6b66968c-261d-48b7-86b5-1b731693cf89
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: version-checker
      app.kubernetes.io/name: version-checker
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        enable.version-checker.io/version-checker: "true"
        kubectl.kubernetes.io/restartedAt: "2025-01-22T16:48:34+01:00"
        prometheus.io/path: /metrics
        prometheus.io/port: "8080"
        prometheus.io/scrape: "true"
      creationTimestamp: null
      labels:
        app.kubernetes.io/instance: version-checker
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: version-checker
        app.kubernetes.io/version: v0.8.5
        helm.sh/chart: version-checker-v0.8.5
    spec:
      containers:
      - args:
        - --image-cache-timeout=30m
        - --log-level=info
        - --metrics-serving-address=0.0.0.0:8080
        - --test-all-containers=true
        - --insecure-skip-tls-verify=true
        command:
        - version-checker
        env:
        - name: HTTP_PROXY
          value: http://10.56.177.242:8089
        - name: HTTPS_PROXY
          value: http://10.56.177.242:8089
        - name: NO_PROXY
          value: 127.0.0.1,10.96.0.0/16,172.20.0.0/16
        - name: VERSION_CHECKER_SELFHOSTED_INSECURE_REMOTE
          value: "true"
        - name: VERSION_CHECKER_SELFHOSTED_CA_PATH_REMOTE
          value: /ca.pem
        image: quay.io/jetstack/version-checker:v0.8.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 3
          periodSeconds: 3
          successThreshold: 1
          timeoutSeconds: 1
        name: version-checker
        ports:
        - containerPort: 8080
          name: metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 3
          periodSeconds: 3
          successThreshold: 1
          timeoutSeconds: 1
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /ca.pem
          name: ca-pemstore
          subPath: ca.pem
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: version-checker
      serviceAccountName: version-checker
      terminationGracePeriodSeconds: 30
      volumes:
      - name: version-checker
        secret:
          defaultMode: 420
          secretName: version-checker
      - configMap:
          defaultMode: 420
          name: ca-pemstore
        name: ca-pemstore
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2025-01-22T15:40:42Z"
    lastUpdateTime: "2025-01-22T15:40:42Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2025-01-23T15:24:42Z"
    lastUpdateTime: "2025-01-23T15:24:42Z"
    message: ReplicaSet "version-checker-6c4dd968c5" is progressing.
    reason: ReplicaSetUpdated
    status: "True"
    type: Progressing
  observedGeneration: 19
  readyReplicas: 1
  replicas: 2
  unavailableReplicas: 1
  updatedReplicas: 1

apiVersion: v1
data:
  ca.pem: |
    -----BEGIN CERTIFICATE-----
   XXXXX
    -----END CERTIFICATE-----
kind: ConfigMap

[davidcollom]

Amazing! Thanks @Whisper40 - Let me try and take a look

[davidcollom]

Ah! I see the issue!

From the output I can see you're missing some VERSION_CHECKER_SELFHOSTED_XXXX_REMOTE environment variables...

If you add the following, things should start working:

        - name: VERSION_CHECKER_SELFHOSTED_HOST_REMOTE
          value: "https://[REPLACE_WITH_URI_TO_REGISTRY]"
        - name: VERSION_CHECKER_SELFHOSTED_INSECURE_REMOTE
          value: "true"
        - name: VERSION_CHECKER_SELFHOSTED_CA_PATH_REMOTE
          value: /ca.pem

The following Values are tested here: https://github.com/jetstack/version-checker/blob/main/deploy/charts/version-checker/tests/deployment_test.yaml#L268-L272

[Whisper40]

I can confirm that is fixes this error, maybe it should be handled better to understand what's wrong.
You can close

[davidcollom]

Amazing that, adding the extra env var's resolved your issue and I agree, we should have something in place which validates/ensures that required fields/values are present... I will keep this issue open for history/context but update/rename.

Describe the bug
When setting selfhosted values, its possible to NOT expose required fields (name,host, etc) but expose others (ca_path, etc)
This causes a panic

To Reproduce
See above,

Expected behavior
We should handle the lack of missing configuration values (name,host) and fail to start up with a clear message to the user of whats required.

[paulwilljones]

fixed in #361