Bug 1585719

Summary:	oc cluster up doesn't set appropriate pull policy for imagestreams for kube resources
Product:	OpenShift Container Platform	Reporter:	Erik M Jacobs <ejacobs>
Component:	oc	Assignee:	David Eads <deads>
Status:	CLOSED ERRATA	QA Contact:	Dongbo Yan <dyan>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	3.9.0	CC:	aos-bugs, bparees, ccoleman, jokerman, mfojtik, mmccomas, wzheng, xxia
Target Milestone:	---
Target Release:	3.10.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-07-30 19:16:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Erik M Jacobs 2018-06-04 13:50:32 UTC

oc cluster up currently doesn't create an admission controller / pull policy that lets imagestreams be used for k8s resources.

oc v3.9.0+191fece
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth GSSAPI Kerberos SPNEGO

Comment 2 Michal Fojtik 2018-06-05 08:35:31 UTC

Fix: https://github.com/openshift/origin/pull/19908

Comment 3 Dongbo Yan 2018-06-06 05:51:56 UTC

Verified
# oc version
oc v3.10.0-0.60.0
kubernetes v1.10.0+b81c8f8

# oc cluster up  --image='xxxx/openshift3/ose-${component}:${version}' --loglevel=8 --base-dir=dir

# docker exec 6dd070d8684fc74554af76bf0e00615ecc27ea4460d2f95cdc50fec9868ecc65 cat /etc/origin/master/master-config.yaml
admissionConfig:
  pluginConfig:
    openshift.io/ImagePolicy:
      configuration:
        apiVersion: v1
        executionRules:
        - matchImageAnnotations:
          - key: images.openshift.io/deny-execution
            value: "true"
          name: execution-denied
          onResources:
          - resource: pods
          - resource: builds
          reject: true
          skipOnResolutionFailure: true
        kind: ImagePolicyConfig
      location: ""

Comment 5 errata-xmlrpc 2018-07-30 19:16:54 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1816