Bug 1810920

Summary: Cannot use private image for binary build although pull secret is linked to builder sa
Product: OpenShift Container Platform Reporter: Wenjing Zheng <wzheng>
Component: DocumentationAssignee: Adam Kaplan <adam.kaplan>
Status: CLOSED CURRENTRELEASE QA Contact: Xiaoli Tian <xtian>
Severity: medium Docs Contact: Vikram Goyal <vigoyal>
Priority: medium    
Version: 4.4CC: adam.kaplan, anli, aos-bugs, bmcelvee, gmontero, jokerman, wewang, wzheng
Target Milestone: ---Keywords: Reopened
Target Release: 4.5.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-05-29 14:11:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Wenjing Zheng 2020-03-06 08:33:35 UTC
Description of problem:
When use private build in Dockerfile for binary build,it failed to pull builder image although secret for the image is created and have linked to builder SA:
$ oc logs builds/prune-3
Receiving source from STDIN as archive ...
Caching blobs under "/var/cache/blobs".

Pulling image docker.io/wzheng/ruby-22-centos7 ...
Warning: Pull failed, retrying in 5s ...
Warning: Pull failed, retrying in 5s ...
Warning: Pull failed, retrying in 5s ...
error: build error: failed to pull image: After retrying 2 times, Pull image still failed due to error: errors:
denied: requested access to the resource is denied
unauthorized: authentication required

Version-Release number of selected component (if applicable):
4.4.0-0.nightly-2020-03-05-194612

How reproducible:
Always

Steps to Reproduce:
1.oc new-project test
2.oc create secret generic pull --from-file=.dockerconfigjson=/Users/wzheng/.docker/config.json --type=kubernetes.io/dockerconfigjson
3.oc secrets link builder pull
4.Create build
oc  new-build --binary --name prune --to prune:latest
oc  start-build prune --from-dir ruby-hello-world -o=name

Actual results:
Build is failed for cannot pull builder image

Expected results:
Private image should be pulled

Additional info:
Under the same project with same pull secret created and linked, I can use the private image to do source/docker build
$ oc get sa builder -o yaml
apiVersion: v1
imagePullSecrets:
- name: builder-dockercfg-jvfsn
- name: pull
kind: ServiceAccount
metadata:
  creationTimestamp: "2020-03-06T07:43:07Z"
  name: builder
  namespace: wzheng1
  resourceVersion: "47907"
  selfLink: /api/v1/namespaces/wzheng1/serviceaccounts/builder
  uid: b3cd8d32-eff3-420f-b43a-a364f66d648b
secrets:
- name: builder-token-7fjw9
- name: builder-dockercfg-jvfsn
- name: pull