Bug 1384973

Summary:	Cannot use ImageStreamTag for Build custom strategy builder image
Product:	OpenShift Container Platform	Reporter:	Tim Waugh <twaugh>
Component:	Build	Assignee:	Martin Milata <mmilata>
Status:	CLOSED ERRATA	QA Contact:	Wang Haoran <haowang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.2.1	CC:	aos-bugs, bparees, shiywang, tdawson
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: When creating Build object through REST API, the type of the "from" image is not checked and is assumed to be DockerImage. Consequence: Creating Build object with custom strategy referencing an ImageStreamTag as its "from" image results in failure or, potentially, build using the wrong image. Fix: Type of builder image is checked when creating Build object and if it is not DockerImage the request is rejected as invalid. Result: Custom builds with builder image specified as ImageStreamTag are rejected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-18 12:42:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tim Waugh 2016-10-14 13:08:06 UTC

Description of problem:
When creating a BuildConfig using a custom build strategy that specifies the builder image using an ImageStreamTag, everything works as expected.

When creating a Build directly, instead of creating a BuildConfig and instantiating a Build from it, this does not work correctly and the name is used as though it is a DockerImage kind.

Version-Release number of selected component (if applicable):
3.2.1.15

How reproducible:
Happens every time

Actual results:
Pods fail to pull builder image

Expected results:
Pods discover builder image using ImageStreamTag and pull that.

Comment 1 Cesar Wong 2016-10-14 13:27:57 UTC

Tim, this is working as designed. A build will not resolve an ImageStreamTag, only a BuildConfig will. However, I think we have a bug in that we're allowing the Build object to be created as valid.

Comment 2 Tim Waugh 2016-10-14 14:01:52 UTC

That seems fine. We are resolving the ImageStreamTag to a DockerImage when creating the Build object now, so that seems like the correct approach.

Comment 3 Martin Milata 2016-10-18 14:21:09 UTC

Pull request: https://github.com/openshift/origin/pull/11398

Comment 4 shiyang.wang 2016-10-27 10:18:20 UTC

test on
oc v3.4.0.16+cc70b72
openshift v3.4.0.16+cc70b72
kubernetes v1.4.0+776c994

now return is 
"The Build "my-build" is invalid: spec.strategy.customStrategy.from.kind: Invalid value: "ImageStreamTag": only DockerImage references are supported for Builds "

change status to verified

Comment 6 errata-xmlrpc 2017-01-18 12:42:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0066