Bug 1312238

Summary: Failed to source build with private image if using docker/config.json to create secret
Product: OpenShift Container Platform Reporter: Wenjing Zheng <wzheng>
Component: BuildAssignee: Ben Parees <bparees>
Status: CLOSED NOTABUG QA Contact: Wenjing Zheng <wzheng>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.2.0CC: aos-bugs, bparees, wzheng
Target Milestone: ---Keywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-01 05:09:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Wenjing Zheng 2016-02-26 08:22:59 UTC 
Description of problem:
Cannot source build with private image if using new docker authentication file(~/.docker/config.json) to create secret
I0226 02:23:54.037079       1 docker.go:299] error inspecting image docker.io/wzheng/ruby-22-centos7:latest: no such image
I0226 02:23:54.037103       1 docker.go:286] Image "docker.io/wzheng/ruby-22-centos7:latest" not available locally, pulling ...
I0226 02:23:54.037113       1 docker.go:308] Pulling Docker image docker.io/wzheng/ruby-22-centos7:latest ...
I0226 02:23:55.818114       1 docker.go:311] An error was received from the PullImage call: Error: image wzheng/ruby-22-centos7:latest not found
F0226 02:23:55.825014       1 builder.go:204] Error: build error: unable to get docker.io/wzheng/ruby-22-centos7:latest

Version-Release number of selected component (if applicable):
openshift v3.1.1.906
kubernetes v1.2.0-alpha.7-703-gbc4550d
etcd 2.2.5
oc v3.1.1.906
kubernetes v1.2.0-alpha.7-703-gbc4550d
openshift3/ose-sti-builder  v3.1.1.906          aa6466ccc681

How reproducible:
always

Steps to Reproduce:
1. Create a secret which is used to pull images from private registry
$ oc secrets new pull .dockerconfigjson=~/.docker/config.json
2. Update service account "builder" and secret "pull" to make sure service account reference the secret
$ oc secrets add serviceaccount/builder secrets/pull
3. Modify the STI strategy application tempate json files to add pull secret
$wget https://raw.githubusercontent.com/openshift/origin/master/examples/sample-app/application-template-stibuild.json
$vim application-template-stibuild.json
{
  "strategy": {
    "stiStrategy": {
      "from": {
        "kind": "DockerImage",
        "name": "docker.io/wzheng/ruby-22-centos7:latest"
       },
       "pullSecret": {"name" : "pull"}
    },
    "type": "STI"
  }
}
4. Create app
5. Check build status and log

Actual results:
Failed to get the image

Expected results:
Should work well like using old authentication file: ~/.dockercfg

Additional info:
Only failed for source build
Comment 1 Ben Parees 2016-02-26 14:35:17 UTC 
Can you provide the full build log w/ level 5 logging?
Comment 2 Wenjing Zheng 2016-02-29 05:50:59 UTC 
Here is the full build log:
[wzheng@openshiftqe test]$ oc logs builds/ruby-sample-build-1 --loglevel=5
I0229 00:39:41.231629       1 builder.go:46] $BUILD env var is {"kind":"Build","apiVersion":"v1","metadata":{"name":"ruby-sample-build-1","namespace":"wzheng1","selfLink":"/oapi/v1/namespaces/wzheng1/builds/ruby-sample-build-1","uid":"d37229f9-dea6-11e5-83b3-fa163e279877","resourceVersion":"127421","creationTimestamp":"2016-02-29T05:39:39Z","labels":{"app":"ruby-sample-build","buildconfig":"ruby-sample-build","name":"ruby-sample-build","openshift.io/build-config.name":"ruby-sample-build","template":"application-template-stibuild"},"annotations":{"openshift.io/build.number":"1"}},"spec":{"serviceAccount":"builder","source":{"type":"Git","git":{"uri":"https://github.com/openshift/ruby-hello-world.git"},"secrets":null},"strategy":{"type":"Source","sourceStrategy":{"from":{"kind":"DockerImage","name":"docker.io/wzheng/ruby-22-centos7:latest"},"pullSecret":{"name":"pull"},"env":[{"name":"EXAMPLE","value":"sample-app"}]}},"output":{"to":{"kind":"DockerImage","name":"172.31.89.196:5000/wzheng1/origin-ruby-sample:latest"},"pushSecret":{"name":"builder-dockercfg-3b7zb"}},"resources":{},"postCommit":{"args":["bundle","exec","rake","test"]}},"status":{"phase":"New","outputDockerImageReference":"172.31.89.196:5000/wzheng1/origin-ruby-sample:latest","config":{"kind":"BuildConfig","namespace":"wzheng1","name":"ruby-sample-build"}}}
 
I0229 00:39:41.232539       1 builder.go:57] Master version "v3.1.1.907-1-g0755947", Builder version "v3.1.1.907-1-g0755947"
I0229 00:39:41.233186       1 builder.go:145] Running build with cgroup limits: api.CGroupLimits{MemoryLimitBytes:9223372036854775807, CPUShares:2, CPUPeriod:100000, CPUQuota:-1, MemorySwap:9223372036854775807}
I0229 00:39:41.234084       1 sti.go:183] With force pull false, setting policies to if-not-present
I0229 00:39:41.234123       1 sti.go:189] The value of ALLOWED_UIDS is [1-]
I0229 00:39:41.234147       1 cfg.go:45] Locating docker auth for image docker.io/wzheng/ruby-22-centos7:latest and type PULL_DOCKERCFG_PATH
I0229 00:39:41.234169       1 cfg.go:111] Using Docker authentication configuration in '/var/run/secrets/openshift.io/pull/.dockerconfigjson'
I0229 00:39:41.234227       1 cfg.go:45] Locating docker auth for image 172.31.89.196:5000/wzheng1/origin-ruby-sample:latest and type PUSH_DOCKERCFG_PATH
I0229 00:39:41.234261       1 cfg.go:111] Using Docker authentication configuration in '/var/run/secrets/openshift.io/push/.dockercfg'
I0229 00:39:41.234449       1 cfg.go:83] Using serviceaccount user for Docker authentication for image 172.31.89.196:5000/wzheng1/origin-ruby-sample:latest
I0229 00:39:41.235963       1 docker.go:299] error inspecting image docker.io/wzheng/ruby-22-centos7:latest: no such image
I0229 00:39:41.235990       1 docker.go:286] Image "docker.io/wzheng/ruby-22-centos7:latest" not available locally, pulling ...
I0229 00:39:41.235999       1 docker.go:308] Pulling Docker image docker.io/wzheng/ruby-22-centos7:latest ...
I0229 00:39:43.034219       1 docker.go:311] An error was received from the PullImage call: Error: image wzheng/ruby-22-centos7:latest not found
I0229 00:39:43.035391       1 sti.go:211] Creating a new S2I builder with build config: "Builder Image:\t\tdocker.io/wzheng/ruby-22-centos7:latest\nSource:\t\t\tfile:///tmp/s2i-build538782659/upload/src\nOutput Image Tag:\twzheng1/ruby-sample-build-1:0cde398a\nEnvironment:\t\tOPENSHIFT_BUILD_SOURCE=https://github.com/openshift/ruby-hello-world.git,EXAMPLE=sample-app,OPENSHIFT_BUILD_NAME=ruby-sample-build-1,OPENSHIFT_BUILD_NAMESPACE=wzheng1\nIncremental Build:\tdisabled\nRemove Old Build:\tdisabled\nBuilder Pull Policy:\tif-not-present\nQuiet:\t\t\tdisabled\nLayered Build:\t\tdisabled\nWorkdir:\t\t/tmp/s2i-build538782659\nDocker NetworkMode:\tcontainer:0417e7eedf52c03bd115c4a2f5527c3a445a38ac578e34681e4c223fab958f52\nDocker Endpoint:\tunix:///var/run/docker.sock\nDocker Pull Config:\t/var/run/secrets/openshift.io/pull\nDocker Pull User:\t\n"
I0229 00:39:43.036613       1 docker.go:299] error inspecting image docker.io/wzheng/ruby-22-centos7:latest: no such image
I0229 00:39:43.036658       1 docker.go:286] Image "docker.io/wzheng/ruby-22-centos7:latest" not available locally, pulling ...
I0229 00:39:43.036670       1 docker.go:308] Pulling Docker image docker.io/wzheng/ruby-22-centos7:latest ...
I0229 00:39:44.757240       1 docker.go:311] An error was received from the PullImage call: Error: image wzheng/ruby-22-centos7:latest not found
F0229 00:39:44.758307       1 builder.go:204] Error: build error: unable to get docker.io/wzheng/ruby-22-centos7:latest
Comment 3 Ben Parees 2016-02-29 13:52:30 UTC 
I0229 00:39:41.234147       1 cfg.go:45] Locating docker auth for image docker.io/wzheng/ruby-22-centos7:latest and type PULL_DOCKERCFG_PATH
I0229 00:39:41.234169       1 cfg.go:111] Using Docker authentication configuration in '/var/run/secrets/openshift.io/pull/.dockerconfigjson'

Seems like we found the right file, can you confirm the docker config file you're using is in the right format for a "dockerconfigjson" (as opposed to dockercfg) file, and contains the expected auth credentials?
Comment 4 Wenjing Zheng 2016-03-01 05:09:55 UTC 
Cannot reproduce this bug now with below version, so closing it now:
openshift v3.1.1.908
kubernetes v1.2.0-alpha.7-703-gbc4550d
etcd 2.2.5