Bug 1969599

Summary:	images without registry are being prefixed with registry.hub.docker.com instead of docker.io
Product:	OpenShift Container Platform	Reporter:	Jesus M. Rodriguez <jesusr>
Component:	Node	Assignee:	Urvashi Mohnani <umohnani>
Node sub component:	CRI-O	QA Contact:	Sunil Choudhary <schoudha>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	urgent
Priority:	unspecified	CC:	aos-bugs, nagrawal, umohnani
Version:	4.8
Target Milestone:	---
Target Release:	4.8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-27 23:12:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jesus M. Rodriguez 2021-06-08 18:17:17 UTC

Description of problem:
try to run nginx image and getting "Error reading manifest 1.16 in registry.hub.docker.com/nginx: unauthorized: authentication required".


result
Version-Release number of selected component (if applicable):
$ oc version
Client Version: 4.7.9
Server Version: 4.8.0-0.nightly-2021-06-08-034312
Kubernetes Version: v1.21.0-rc.0+fec6fbc


How reproducible:

Every time



Steps to Reproduce:
1. oc run --image nginx:1.16 nginx
2. oc describe pod nginx-sample-7d765fb9cf-k4xf8

Actual results:
  Warning  Failed          13s                kubelet            Failed to pull image "nginx:1.16": rpc error: code = Unknown desc = Error reading manifest 1.16 in registry.hub.docker.com/ng
inx: unauthorized: authentication required


Expected results:
 oc get pods -n default
NAME                           READY   STATUS    RESTARTS   AGE
nginx-sample-6c5db7fcd-9xkvk   1/1     Running   0          4m18s


Additional info:

Comment 2 Urvashi Mohnani 2021-06-08 18:19:50 UTC

Have opened https://github.com/cri-o/cri-o/pull/4984 to disable the short name alias feature for now.

Comment 4 Urvashi Mohnani 2021-06-09 13:45:26 UTC

PR has been merged, moving to modified.

Comment 6 Sunil Choudhary 2021-06-11 09:19:54 UTC

Verified on 4.8.0-0.nightly-2021-06-10-224448.

The image is now being pulled from docker.io.

$ oc get clusterversion
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.8.0-0.nightly-2021-06-10-224448   True        False         3h27m   Cluster version is 4.8.0-0.nightly-2021-06-10-224448

$ oc run --image nginx:1.16 nginx
pod/nginx created

$ oc describe pod nginx
Name:         nginx
Namespace:    bz
Priority:     0
Node:         ip-10-0-150-119.ap-south-1.compute.internal/10.0.150.119
Start Time:   Fri, 11 Jun 2021 14:46:36 +0530
Labels:       run=nginx
Annotations:  k8s.v1.cni.cncf.io/network-status:
                [{
                    "name": "openshift-sdn",
                    "interface": "eth0",
                    "ips": [
                        "10.129.2.43"
                    ],
                    "default": true,
                    "dns": {}
                }]
              k8s.v1.cni.cncf.io/networks-status:
                [{
                    "name": "openshift-sdn",
                    "interface": "eth0",
                    "ips": [
                        "10.129.2.43"
                    ],
                    "default": true,
                    "dns": {}
                }]
              openshift.io/scc: anyuid
Status:       Running
IP:           10.129.2.43
IPs:
  IP:  10.129.2.43
Containers:
  nginx:
    Container ID:   cri-o://2c3d5962a92a08812b70c45fcd85057804c82b57de97a97bc857215490089e87
    Image:          nginx:1.16
    Image ID:       docker.io/library/nginx@sha256:2963fc49cc50883ba9af25f977a9997ff9af06b45c12d968b7985dc1e9254e4b
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Fri, 11 Jun 2021 14:46:52 +0530
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-dh6tp (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  kube-api-access-dh6tp:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
    ConfigMapName:           openshift-service-ca.crt
    ConfigMapOptional:       <nil>
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason          Age   From               Message
  ----    ------          ----  ----               -------
  Normal  Scheduled       35s   default-scheduler  Successfully assigned bz/nginx to ip-10-0-150-119.ap-south-1.compute.internal
  Normal  AddedInterface  33s   multus             Add eth0 [10.129.2.43/23] from openshift-sdn
  Normal  Pulling         33s   kubelet            Pulling image "nginx:1.16"
  Normal  Pulled          19s   kubelet            Successfully pulled image "nginx:1.16" in 13.921015286s
  Normal  Created         19s   kubelet            Created container nginx
  Normal  Started         19s   kubelet            Started container nginx

Comment 9 errata-xmlrpc 2021-07-27 23:12:15 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438