runtime error: invalid memory address or nil pointer dereference

[r0bj]

We’re experiencing a crash in k8s-image-availability-exporter v0.12.0 when deployed in our on-prem Kubernetes cluster.

Logs:

time="2025-04-30T21:57:13Z" level=info msg="Starting k8s-image-availability-exporter v0.12.0"
time="2025-04-30T21:57:13Z" level=error msg="Error trying to list secrets" error_message="secrets is forbidden: User \"system:serviceaccount:ops:k8s-image-availability-exporter\" cannot list resource \"secrets\" in API group \"\" in the namespace \"default\""
time="2025-04-30T21:57:13Z" level=info msg="Waiting for cache sync"
time="2025-04-30T21:57:13Z" level=info msg="Caches populated successfully"
{"level":"debug","time":"2025-04-30T21:57:13Z","message":"Trying to get token from IMDSv2"}
{"level":"debug","time":"2025-04-30T21:57:13Z","message":"Unable to retrieve an IMDSv2 token, continuing with IMDSv1, Put \"http://169.254.169.254/latest/api/token\": dial tcp 169.254.169.254:80: connect: no route to host"}
{"level":"error","error":"Unable to parse metadata response: Unable to get a response from IMDS: Get \"http://169.254.169.254/latest/dynamic/instance-identity/document\": dial tcp 169.254.169.254:80: connect: no route to host","time":"2025-04-30T21:57:13Z","message":"Unable to fetch metadata from IMDS"}
E0430 21:59:53.072764       1 panic.go:262] "Observed a panic" panic="runtime error: invalid memory address or nil pointer dereference" panicGoValue="\"invalid memory address or nil pointer dereference\"" stacktrace=<
	goroutine 1 [running]:
	k8s.io/apimachinery/pkg/util/runtime.logPanic({0x2468de0, 0x36271a0}, {0x1e13a60, 0x35c29c0})
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/runtime/runtime.go:107 +0xbc
	k8s.io/apimachinery/pkg/util/runtime.handleCrash({0x2468de0, 0x36271a0}, {0x1e13a60, 0x35c29c0}, {0x36271a0, 0x0, 0x439665?})
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/runtime/runtime.go:82 +0x5e
	k8s.io/apimachinery/pkg/util/runtime.HandleCrash({0x0, 0x0, 0xc0000061c0?})
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/runtime/runtime.go:59 +0x108
	panic({0x1e13a60?, 0x35c29c0?})
		/usr/local/go/src/runtime/panic.go:785 +0x132
	github.com/flant/k8s-image-availability-exporter/pkg/registry.ControllerIndexers.GetImagePullSecrets({{0x247a360, 0xc000010b58}, {0x247a360, 0xc000010bb8}, {0x247a360, 0xc000010be8}, {0x247a360, 0xc000010c48}, {0x247a360, 0xc000010ca8}, ...}, ...)
		/go/src/app/pkg/registry/indexers.go:270 +0x21f
	github.com/flant/k8s-image-availability-exporter/pkg/providers/k8s.Provider.GetAuthKeychain({0xc0007c45a0?, {0x215c037?, 0x0?}}, {0xc000ae8f60?, 0xc0001be000?})
		/go/src/app/pkg/providers/k8s/k8s.go:122 +0x43
	github.com/flant/k8s-image-availability-exporter/pkg/providers.ProviderRegistry.GetAuthKeychain(0xc0007b84b0, {0xc000ae8f60, 0x2a})
		/go/src/app/pkg/providers/provider.go:38 +0xd6
	github.com/flant/k8s-image-availability-exporter/pkg/registry.(*Checker).Check(0xc0001fa2c0, {0xc000ae8f60, 0x2a})
		/go/src/app/pkg/registry/checker.go:302 +0x33
	github.com/flant/k8s-image-availability-exporter/pkg/store.(*ImageStore).popCheckPush(0xc0004559f0, 0x0, 0x32)
		/go/src/app/pkg/store/image_store.go:181 +0x10d
	github.com/flant/k8s-image-availability-exporter/pkg/store.(*ImageStore).Check(0xc0004559f0)
		/go/src/app/pkg/store/image_store.go:159 +0x8b
	github.com/flant/k8s-image-availability-exporter/pkg/registry.(*Checker).Tick(...)
		/go/src/app/pkg/registry/checker.go:281
	main.main.func2()
		/go/src/app/main.go:108 +0x2d
	k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1(0xc002885c58?)
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:226 +0x33
	k8s.io/apimachinery/pkg/util/wait.BackoffUntil(0xc0006b3e40, {0x243d380, 0xc0007b88a0}, 0x1, 0xc000120000)
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:227 +0xaf
	k8s.io/apimachinery/pkg/util/wait.JitterUntil(0xc000113e40, 0xdf8475800, 0x0, 0x1, 0xc000120000)
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:204 +0x7f
	k8s.io/apimachinery/pkg/util/wait.Until(...)
		/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:161
	main.main()
		/go/src/app/main.go:107 +0x9bd
 >
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
	panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x1b9c71f]

goroutine 1 [running]:
k8s.io/apimachinery/pkg/util/runtime.handleCrash({0x2468de0, 0x36271a0}, {0x1e13a60, 0x35c29c0}, {0x36271a0, 0x0, 0x439665?})
	/go/pkg/mod/k8s.io/[email protected]/pkg/util/runtime/runtime.go:89 +0xee
k8s.io/apimachinery/pkg/util/runtime.HandleCrash({0x0, 0x0, 0xc0000061c0?})
	/go/pkg/mod/k8s.io/[email protected]/pkg/util/runtime/runtime.go:59 +0x108
panic({0x1e13a60?, 0x35c29c0?})
	/usr/local/go/src/runtime/panic.go:785 +0x132
github.com/flant/k8s-image-availability-exporter/pkg/registry.ControllerIndexers.GetImagePullSecrets({{0x247a360, 0xc000010b58}, {0x247a360, 0xc000010bb8}, {0x247a360, 0xc000010be8}, {0x247a360, 0xc000010c48}, {0x247a360, 0xc000010ca8}, ...}, ...)
	/go/src/app/pkg/registry/indexers.go:270 +0x21f
github.com/flant/k8s-image-availability-exporter/pkg/providers/k8s.Provider.GetAuthKeychain({0xc0007c45a0?, {0x215c037?, 0x0?}}, {0xc000ae8f60?, 0xc0001be000?})
	/go/src/app/pkg/providers/k8s/k8s.go:122 +0x43
github.com/flant/k8s-image-availability-exporter/pkg/providers.ProviderRegistry.GetAuthKeychain(0xc0007b84b0, {0xc000ae8f60, 0x2a})
	/go/src/app/pkg/providers/provider.go:38 +0xd6
github.com/flant/k8s-image-availability-exporter/pkg/registry.(*Checker).Check(0xc0001fa2c0, {0xc000ae8f60, 0x2a})
	/go/src/app/pkg/registry/checker.go:302 +0x33
github.com/flant/k8s-image-availability-exporter/pkg/store.(*ImageStore).popCheckPush(0xc0004559f0, 0x0, 0x32)
	/go/src/app/pkg/store/image_store.go:181 +0x10d
github.com/flant/k8s-image-availability-exporter/pkg/store.(*ImageStore).Check(0xc0004559f0)
	/go/src/app/pkg/store/image_store.go:159 +0x8b
github.com/flant/k8s-image-availability-exporter/pkg/registry.(*Checker).Tick(...)
	/go/src/app/pkg/registry/checker.go:281
main.main.func2()
	/go/src/app/main.go:108 +0x2d
k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1(0xc002885c58?)
	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:226 +0x33
k8s.io/apimachinery/pkg/util/wait.BackoffUntil(0xc0006b3e40, {0x243d380, 0xc0007b88a0}, 0x1, 0xc000120000)
	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:227 +0xaf
k8s.io/apimachinery/pkg/util/wait.JitterUntil(0xc000113e40, 0xdf8475800, 0x0, 0x1, 0xc000120000)
	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:204 +0x7f
k8s.io/apimachinery/pkg/util/wait.Until(...)
	/go/pkg/mod/k8s.io/[email protected]/pkg/util/wait/backoff.go:161
main.main()
	/go/src/app/main.go:107 +0x9bd

k8s-image-availability-exporter is installed using the Helm chart with useSecretsForPrivateRepositories: false, which explains the “Error trying to list secrets” message in the logs.