Bug 1883803
| Summary: | node pull secret feature is not working as expected | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Sahil thakare <sthakare> |
| Component: | Build | Assignee: | Adam Kaplan <adam.kaplan> |
| Status: | CLOSED ERRATA | QA Contact: | wewang <wewang> |
| Severity: | low | Docs Contact: | Rolfe Dlugy-Hegwer <rdlugyhe> |
| Priority: | medium | ||
| Version: | 4.5 | CC: | adam.kaplan, amdas, aos-bugs, apjagtap, dcaldwel, marcus.neumann.u443666, rdlugyhe, rheinzma, wzheng |
| Target Milestone: | --- | ||
| Target Release: | 4.7.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
* Previously, the node pull secret feature did not work: Node pull secrets were not used if `forcePull: true` was set in the Source and Docker strategy builds. As a result, builds failed to pull images that required the cluster-wide pull secret. The current release fixes this issue. Now node pull secrets are always merged with user-provided pull secrets. As a result, builds can pull images when `forcePull: true` is set and the source registry requires the cluster-wide pull secret.
(link:https://bugzilla.redhat.com/show_bug.cgi?id=1883803[*BZ#1883803*])
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-02-24 15:21:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Sahil thakare
2020-09-30 09:40:27 UTC
The build pod cannot access registry.redhat.io. Moving to Build. Root cause: Docker strategy options in the test build has the `forcePull: true` option. When forcePull: true is set, two pull actions happen: 1. An initial pull when builds detect that the base image is not present in buildah's image cache. This is always the case because at present builds do not have a caching mechanism. The initial pull has the node credentials merged in. 2. A secondary pull initiated by buildah. We are not including the node credentials here. Removing `forcePull: true` can work around the issue. THX! I can confirm, removing forcePull works as workaround. Verified in version: 4.7.0-0.nightly-2020-10-24-155529 Steps: [wewang@wangwen work]$ oc logs -f build/test-1 Receiving source from STDIN as file Dockerfile Caching blobs under "/var/cache/blobs". Pulling image registry.redhat.io/ubi8/nodejs-12:latest ... Getting image source signatures Copying blob sha256:35ad9b4fba1fa6b00a6f266303348dc0cf9a7c341616e800c2738030c0f64167 Copying blob sha256:da1cc572023a942fff15d59aefa5abbb59d2c24a03966db8074ef8f9bab277d4 Copying blob sha256:ec1681b6a383e4ecedbeddd5abc596f3de835aed6db39a735f62395c8edbff30 Copying blob sha256:5e2ae0c76e83847010202c40d0c7ebac953a6c7871efdea7602b41507b3d11f5 Copying blob sha256:c4d668e229cd131e0a8e4f8218dca628d9cf9697572875e355fe4b247b6aa9f0 Copying config sha256:8a961c0b3cbcc653bf39713aaf79a36d9921618e2a39fd7e5057cf70c203cf87 Writing manifest to image destination Storing signatures STEP 1: FROM registry.redhat.io/ubi8/nodejs-12:latest STEP 2: RUN echo "hello world" hello world *** Bug 1897577 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:5633 |