Bug 1880421

Summary:	OLM mirroring docs include "--filter-by-os="linux/amd64" parameter, which breaks mirror consistency
Product:	OpenShift Container Platform	Reporter:	Leonid Titov <ltitov>
Component:	Documentation	Assignee:	Alex Dellapenta <adellape>
Status:	CLOSED NOTABUG	QA Contact:	Jian Zhang <jiazha>
Severity:	low	Docs Contact:	Vikram Goyal <vigoyal>
Priority:	low
Version:	4.5	CC:	adellape, aos-bugs, jiazha, jokerman, jonwilli, jritter, krizza, ltitov, mharri
Target Milestone:	---	Flags:	ltitov: needinfo-
Target Release:	4.5.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-04-27 14:30:11 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Leonid Titov 2020-09-18 13:33:49 UTC

Document URL: https://docs.openshift.com/container-platform/4.5/operators/olm-restricted-networks.html#olm-restricted-networks-operatorhub_olm-restricted-networks

Section Number and Name: Configuring OperatorHub for restricted networks -> Procedure -> pt. 2

Describe the issue: 
[--filter-by-os="<os>/<arch>"] parameter is described without warning that it will change manifestlist digest in the target registry for multi-arch images, thus breaking catalog consistency. 

Suggestions for improvement: 
Add a warning that one shouldn't use this parameter for mirroring the whole OLM catalog, since it will alter ManifestList and operator won't find baked sha256 digests.

Additional information:

Comment 2 Jonquil Williams 2020-09-21 22:20:29 UTC

https://github.com/openshift/openshift-docs/pull/25653

QA review needed.

Comment 3 Jian Zhang 2020-09-22 08:57:39 UTC

Hi Leonid,

Sorry, could you help provide more details? Based on my understanding, the image digest depends on the arch/platfrom of the registry. That means, if you don't use the `--filter-by-os` flag, the image digest may be changed too. So, it's not related with this `--filter-by-os` flag. @Kevin, Correct me if I'm worng, thanks!

Comment 4 Jonquil Williams 2020-09-22 18:11:43 UTC

Hi, Jian, Kevin, and Leonid.

I also just got assigned this bug (https://bugzilla.redhat.com/show_bug.cgi?id=1879877), which is related or may be a duplicate. Please advise as to how to proceed and also provide edits for the updated documentation. Thank you. - Jonquil Williams

Comment 6 Jonquil Williams 2020-10-09 13:24:33 UTC

Hi, Leonid.

Please let me know if you can provide the details that Jian was asking. This is his original message:

"Could you help provide more details? Based on my understanding, the image digest depends on the arch/platfrom of the registry. That means, if you don't use the `--filter-by-os` flag, the image digest may be changed too. So, it's not related with this `--filter-by-os` flag."


My proposed changes to the doc are:

CAUTION: Do not use `--filter-by-os` to mirror the entire OLM catalog because it changes the ManifestList digest in the target registry for multi-arch images and breaks the catalog consistency. Specifically, the Operator will not be able to find sha256 digests.


But these changes have been rejected and Jian is asking for more information to correct this statement.


Thank you,

Jonquil

Comment 7 Jonquil Williams 2021-04-27 14:30:11 UTC

I never got SME feedback to satisfy QE for this BZ. But it looks like it has been addressed in this BZ instead: https://bugzilla.redhat.com/show_bug.cgi?id=1890951

Here is the current 4.5 published output: https://docs.openshift.com/container-platform/4.5/operators/admin/olm-restricted-networks.html#olm-restricted-networks-operatorhub_olm-restricted-networks

I am closing this because I believe it is fixed.

Comment 8 Red Hat Bugzilla 2023-09-15 00:48:23 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days