Trivy TOOMANYREQUESTS ghcr.io

[EsDmitrii]

Hi!
I have errors like this:

{"time":"2024-11-26T10:50:14.094993087Z","level":"ERROR","msg":"Scan job failed","scan_job_id":"2cee11f21fa84d00ed4c2ca7","mime_type":"application/vnd.security.vulnerability.report; version=1.1","scan_job_status":"Failed","err":"running trivy wrapper: running trivy: exit status 1: 2024-11-26T10:50:09Z\tWARN\t'--vuln-type' is deprecated. Use '--pkg-types' instead.\n2024-11-26T10:50:09Z\tINFO\tAdding schema version to the DB repository for backward compatibility\trepository=\"ghcr.io/aquasecurity/trivy-db:2\"\n2024-11-26T10:50:09Z\tINFO\tAdding schema version to the DB repository for backward compatibility\trepository=\"ghcr.io/aquasecurity/trivy-java-db:1\"\n2024-11-26T10:50:09Z\tINFO\t[vulndb] Need to update DB\n2024-11-26T10:50:09Z\tINFO\t[vulndb] Downloading vulnerability DB...\n2024-11-26T10:50:09Z\tINFO\t[vulndb] Downloading artifact...\trepo=\"ghcr.io/aquasecurity/trivy-db:2\"\n2024-11-26T10:50:10Z\tWARN\tSee https://aquasecurity.github.io/trivy/v0.56/docs/references/troubleshooting#db\n2024-11-26T10:50:10Z\tFATAL\tFatal error\tinit error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from ghcr.io/aquasecurity/trivy-db:2: OCI repository error: 2 errors occurred:\n\t* GET https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io: DENIED: denied\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 774.353µs, allowed: 44000/minute\n\n\n"}

The same for trivy-db:2
But I specified gitHubToken for trivy
When I check rate limit for my PAT, I see that it is not used

curl -H "Authorization: token MASKED -X GET https://api.github.com/rate_limit
{
  "resources": {
    "core": {
      "limit": 5000,
      "used": 0,
      "remaining": 5000,
      "reset": 1732622005
    },
    "search": {
      "limit": 30,
      "used": 0,
      "remaining": 30,
      "reset": 1732618465
    },
    "graphql": {
      "limit": 5000,
      "used": 0,
      "remaining": 5000,
      "reset": 1732622005
    },
    "integration_manifest": {
      "limit": 5000,
      "used": 0,
      "remaining": 5000,
      "reset": 1732622005
    },
    "source_import": {
      "limit": 100,
      "used": 0,
      "remaining": 100,
      "reset": 1732618465
    },
    "code_scanning_upload": {
      "limit": 1000,
      "used": 0,
      "remaining": 1000,
      "reset": 1732622005
    },
    "actions_runner_registration": {
      "limit": 10000,
      "used": 0,
      "remaining": 10000,
      "reset": 1732622005
    },
    "scim": {
      "limit": 15000,
      "used": 0,
      "remaining": 15000,
      "reset": 1732622005
    },
    "dependency_snapshots": {
      "limit": 100,
      "used": 0,
      "remaining": 100,
      "reset": 1732618465
    },
    "audit_log": {
      "limit": 1750,
      "used": 0,
      "remaining": 1750,
      "reset": 1732622005
    },
    "audit_log_streaming": {
      "limit": 15,
      "used": 0,
      "remaining": 15,
      "reset": 1732622005
    },
    "code_search": {
      "limit": 10,
      "used": 0,
      "remaining": 10,
      "reset": 1732618465
    }
  },
  "rate": {
    "limit": 5000,
    "used": 0,
    "remaining": 5000,
    "reset": 1732622005
  }
}

In pod I see the same token and var is set

What am I doing wrong?
Chart 1.16.0, v2.12.0

[EsDmitrii]

Also I get

2024-11-27T00:00:39Z	WARN	'--vuln-type' is deprecated. Use '--pkg-types' instead.

How can I set correct parameter?