Bug 2000661

Summary: Wrong error message when importing from private registry with TLS certificate which is NOT signed by a trusted CA
Product: Container Native Virtualization (CNV) Reporter: Jenia Peimer <jpeimer>
Component: StorageAssignee: skagan
Status: CLOSED ERRATA QA Contact: Jenia Peimer <jpeimer>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 4.9.0CC: alitke, cnv-qe-bugs, yadu, ycui
Target Milestone: ---   
Target Release: 4.9.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: CNV v4.9.3-12, virt-cdi-controller v4.9.3-4, CNV-v4.10.0-617, virt-cdi-operator v4.10.0-81 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-02-22 21:54:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jenia Peimer 2021-09-02 16:22:33 UTC 
Description of problem:
Wrong error message when trying to import from private registry with TLS certificate which is NOT signed by a trusted CA

Version-Release number of selected component (if applicable):
4.9

How reproducible: 100%

Steps to Reproduce:
1. Create and add a docker image and upload it to the private registry.
2. Ensure your registry TLS certificate, which is NOT signed by a trusted CA, resides in a file named 'my-registry.crt'
3. Create a ConfigMap containing all certificates required to trust the registry. e.g 'kubectl create configmap my-registry-certs --from-file=my-registry.crt'
4. Import the image from the registry - Import should succeed
5. Remove the certificate previously added to the config map
6. Attempt to import the image again - Import should fail

Actual results:

	Containers:
	  importer:
	    ........
	    Args:
	      -v=1
	    State:          Waiting
	      Reason:       CrashLoopBackOff
	    Last State:     Terminated
	      Reason:       Error
	      Message:      /github.com/containers/image/v5/docker/docker_client.go:759 github.com/containers/image/v5/docker.(*dockerClient).makeRequest   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_client.go:421 github.com/containers/image/v5/docker.(*dockerImageSource).fetchManifest   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:189 github.com/containers/image/v5/docker.(*dockerImageSource).ensureManifestIsLoaded   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:223 github.com/containers/image/v5/docker.newImageSourceAttempt   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:127 github.com/containers/image/v5/docker.newImageSource   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:69 github.com/containers/image/v5/docker.dockerReference.NewImageSource   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_transport.go:144 kubevirt.io/containerized-data-importer/pkg/importer.readImageSource   /remote-source/app/pkg/importer/transport.go:73 kubevirt.io/containerized-data-importer/pkg/importer.copyRegistryImage   /remote-source/app/pkg/importer/transport.go:179 kubevirt.io/containerized-data-importer/pkg/importer.CopyRegistryImage   /remote-source/app/pkg/importer/transport.go:227 kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer   /remote-source/app/pkg/importer/registry-datasource.go:83 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374 Could not create image reference kubevirt.io/containerized-data-importer/pkg/importer.readImageSource   /remote-source/app/pkg/importer/transport.go:76 kubevirt.io/containerized-data-importer/pkg/importer.copyRegistryImage   /remote-source/app/pkg/importer/transport.go:179 kubevirt.io/containerized-data-importer/pkg/importer.CopyRegistryImage   /remote-source/app/pkg/importer/transport.go:227 kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer   /remote-source/app/pkg/importer/registry-datasource.go:83 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374 Failed to read registry image kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer   /remote-source/app/pkg/importer/registry-datasource.go:85 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374 Unable to transfer source data to scratch space kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:195 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374
	      Exit Code:    1
	      Started:      Wed, 01 Sep 2021 17:38:21 +0000
	      Finished:     Wed, 01 Sep 2021 17:38:22 +0000
	    Ready:          False


Expected results:

	Containers:
	  importer:
	    ........
	    Args:
	      -v=1
	    State:          Terminated
	      Reason:       Error
	      Message:      Unable to process data: Get "URL:8443/v2/": x509: certificate signed by unknown authority
	      Exit Code:    1
	      Started:      Wed, 01 Sep 2021 17:39:38 +0000
	      Finished:     Wed, 01 Sep 2021 17:39:39 +0000
	    Last State:     Terminated
	      Reason:       Error
	      Message:      Unable to process data: Get "URL:8443/v2/": x509: certificate signed by unknown authority
	      Exit Code:    1
	      Started:      Wed, 01 Sep 2021 17:39:12 +0000
	      Finished:     Wed, 01 Sep 2021 17:39:13 +0000
	    Ready:          False


Additional info:
Use this command to describe the importing pod and see the error message:
oc describe pod -n cdi-import-test-import-registr
Comment 1 Yan Du 2021-12-15 13:29:25 UTC 
Shelly, could you please take a look?
Comment 2 Jenia Peimer 2022-01-28 02:51:01 UTC 
Verified on CNV v4.9.3-12, virt-cdi-controller v4.9.3-4
Verified on CNV-v4.10.0-617, virt-cdi-operator v4.10.0-81

$ oc describe pod -n cdi-import-test-import-registr
Name:         importer-cnv-2352
Namespace:    cdi-import-test-import-registr
Containers:
  importer:
    State:          Terminated
      Reason:       Error
      Message:      Unable to process data: Unable to transfer source data to scratch space: Failed to read registry image: Could not create image reference: error pinging docker registry URL:8443: Get "URL:8443/v2/": x509: certificate signed by unknown authority
      Exit Code:    1
      Started:      Wed, 26 Jan 2022 19:17:48 +0000
      Finished:     Wed, 26 Jan 2022 19:17:50 +0000
    Last State:     Terminated
      Reason:       Error
      Message:      Unable to process data: Unable to transfer source data to scratch space: Failed to read registry image: Could not create image reference: error pinging docker registry URL:8443: Get "URL:8443/v2/": x509: certificate signed by unknown authority
      Exit Code:    1
      Started:      Wed, 26 Jan 2022 19:17:41 +0000
      Finished:     Wed, 26 Jan 2022 19:17:47 +0000
    Ready:          False
    Restart Count:  1
Comment 9 errata-xmlrpc 2022-02-22 21:54:59 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Virtualization 4.9.3 Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:0641