Bug 2148813

Summary: Inspecting an image with skopeo no longer works on Capsules
Product: Red Hat Satellite Reporter: matt jia <mjia>
Component: Capsule - ContentAssignee: Ian Ballou <iballou>
Status: CLOSED ERRATA QA Contact: Vladimír Sedmík <vsedmik>
Severity: high Docs Contact:
Priority: high    
Version: 6.10.7CC: ahumbe, amasolov, avnkumar, cyao, dalley, egolov, iballou, ipanova, jpasqual, onerleka, osousa, pcreech, sadas, tasano, vcojot, wclark
Target Milestone: 6.13.0Keywords: Regression, Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: smart_proxy_container_gateway-1.0.7.gem Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2150123 2166756 (view as bug list) Environment:
Last Closed: 2023-05-03 13:23:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Hotfix RPM for Capsule 6.11.4 on RHEL7
none
Hotfix RPM for Capsule 6.11.4 on RHEL8 none

Description matt jia 2022-11-28 04:22:54 UTC 
Description of problem:

`skopeo --debug inspect  docker://satellite.example.com/default-organization-development-cv-rhel7-openstack-13-osp13_containers-openstack-gnocchi-api:latest` failed with:

DEBU[0001] GET https://satellite.example.com/v2/default-organization-development-cv-rhel7-openstack-13-osp13_containers-openstack-gnocchi-api/tags/list
FATA[0001] Error determining repository tags: invalid status code from registry 404 (Not Found)

whereas the command is working against Satellite. 


Version-Release number of selected component (if applicable):

6.11

How reproducible:

Easy


Steps to Reproduce:
1. sync a OSP13 container image, add it to a content view and promote it to a lifecycle environment
2. make sure the LE has Unauthorized pull image checked
3. attach the LE to a capsule and sync

Actual results:

the inspect command does not work work.

Expected results:

the inspect command should work.


Additional info:

This is kind of blocking the OSP13 upgrade which is fetching images from a Capsule
Comment 8 cyao 2022-11-28 22:29:04 UTC 
Customer replies

They shall have the latest rhel7 version of skopeo already installed.
 

[root@caplovh0d ~]# rpm -qa|grep skopeo

skopeo-0.1.40-12.el7_9.x86_64

[root@caplovh0d ~]#

 

Our capsules are all at 6.10.7:
[root@cwplovh01 ~]# rpm -qa|grep capsule

satellite-capsule-6.10.7.1-1.el7sat.noarch


There doesn’t appear to be a –no-flags (-n) option available in skopeo version 0.1.40.

 

[root@caplovh0d ~]# skopeo --no-tags inspect  docker://cwplovh01.telecom.tcnz.net/spark_new_zealand-development-cv-rhel7-openstack-13-osp13_containers-openstack-gnocchi-api:latest

Incorrect Usage. flag provided but not defined: -no-tags

 

NAME:

   skopeo - Various operations with container images and container image registries

 

USAGE:

   skopeo [global options] command [command options] [arguments...]

 

VERSION:

   0.1.40

 

COMMANDS:

     copy               Copy an IMAGE-NAME from one location to another

     inspect            Inspect image IMAGE-NAME

     delete             Delete image IMAGE-NAME

     manifest-digest    Compute a manifest digest of a file

     standalone-sign    Create a signature using local files

     standalone-verify  Verify a signature using local files

     help, h            Shows a list of commands or help for one command

 

GLOBAL OPTIONS:

   --debug                  enable debug output

   --policy value           Path to a trust policy file

   --insecure-policy        run the tool without any policy check

   --registries.d DIR       use registry configuration files in DIR (e.g. for container signature storage)

   --override-arch ARCH     use ARCH instead of the architecture of the machine for choosing images

   --override-os OS         use OS instead of the running OS for choosing images

   --command-timeout value  timeout for the command execution (default: 0s)

   --help, -h               show help

   --version, -v            print the version

FATA[0000] flag provided but not defined: -no-tags

[root@caplovh0d ~]#
Comment 9 Ina Panova 2022-11-28 22:45:50 UTC 
The order is wrong:

$ skopeo --notags inspect
FATA[0000] unknown flag: --notags 

vs
                      
$ skopeo inspect --no-tags
FATA[0000] Exactly one argument expected
Comment 11 Ian Ballou 2022-11-29 16:50:43 UTC 
Created redmine issue https://projects.theforeman.org/issues/35801 from this bug
Comment 16 Vladimír Sedmík 2022-12-16 18:35:08 UTC 
Was not cherry-picked in 6.13.0 snap 3:

[root@capsule ~]# rpm -qa | grep gateway
rubygem-smart_proxy_container_gateway-1.0.6-1.el8sat.noarch
Comment 21 Evgeni Golov 2023-01-03 13:09:49 UTC 
(In reply to Vladimír Sedmík from comment #16)
> Was not cherry-picked in 6.13.0 snap 3:
> 
> [root@capsule ~]# rpm -qa | grep gateway
> rubygem-smart_proxy_container_gateway-1.0.6-1.el8sat.noarch

https://github.com/theforeman/foreman-packaging/pull/8881 for the upstream pick
Comment 30 wclark 2023-01-16 14:01:05 UTC 
Created attachment 1938362 [details]
Hotfix RPM for Capsule 6.11.4 on RHEL7

INSTALL INSTRUCTIONS:

1. Take a complete backup or snapshot of Capsule 6.11.4 server

2. Download the hotfix RPM matching your Capsule and RHEL version and copy it to the affected Capsule server

3. # yum install ./tfm-rubygem-smart_proxy_container_gateway-1.0.6-2.HOTFIXRHBZ2148813.el7sat.noarch.rpm --disableplugin=foreman-protector

4. # systemctl restart foreman-proxy
Comment 31 wclark 2023-01-16 14:04:51 UTC 
Created attachment 1938363 [details]
Hotfix RPM for Capsule 6.11.4 on RHEL8

INSTALL INSTRUCTIONS:

1. Take a complete backup or snapshot of Capsule 6.11.4 server

2. Download the hotfix RPM matching your Capsule and RHEL version and copy it to the affected Capsule server

3. # dnf install ./rubygem-smart_proxy_container_gateway-1.0.6-2.HOTFIXRHBZ2148813.el8sat.noarch.rpm --disableplugin=foreman-protector

4. # systemctl restart foreman-proxy
Comment 32 wclark 2023-02-01 02:27:11 UTC 
If a Hotfix is desired for this bug on Capsule 6.10.7, the same hotfix RPM already delivered for Capsule 6.11.4 for RHEL7 can be used for Capsule 6.10.7 as well -- it is fully compatible and the installation instructions are the same.
Comment 33 Vladimír Sedmík 2023-02-08 12:50:36 UTC 
Verified in 6.13.0 snap 9 (rubygem-smart_proxy_container_gateway-1.0.7-1.el8sat.noarch) using the steps from comment 0:

[root@capsule ~]# skopeo --debug inspect docker://$(hostname)/default_organization-development-cv-rhel7-openstack-13-osp13-rhosp13_openstack-gnocchi-api:latest
DEBU[0000] Using registries.d directory /etc/containers/registries.d 
DEBU[0000] Loading registries configuration "/etc/containers/registries.conf" 
...
DEBU[0000] Increasing token expiration to: 60 seconds   
DEBU[0000] GET https://capsule.redhat.com/v2/default_organization-development-cv-rhel7-openstack-13-osp13-rhosp13_openstack-gnocchi-api/tags/list 
{
    "Name": "capsule.redhat.com/default_organization-development-cv-rhel7-openstack-13-osp13-rhosp13_openstack-gnocchi-api",
    "Digest": "sha256:8e9b910f9b79d97db3e444d3d52749aba13421e7f639f692867452bd014cc74f",
    "RepoTags": [
        "13.0",
        "13.0-101",
        "13.0-101.1579183757",
        "13.0-101.1580118213",
        "13.0-101.1582098588",
        "13.0-110",
        "13.0-116",
        "13.0-116.1587469245",
        "13.0-116.1590695892",
        "13.0-121",
        "13.0-126",
        "13.0-131",
        "13.0-132",
        "13.0-132.1604505197",
        "13.0-136",
        "13.0-136.1608225913",
        "13.0-136.1611769586",
        "13.0-139",
        "13.0-140",
        "13.0-143",
        "13.0-143.1620299687",
        "13.0-146",
        "13.0-147",
        "13.0-148",
        "13.0-152",
        "13.0-155",
        "13.0-155.1634207010",
        "13.0-155.1638432270",
        "13.0-160",
        "13.0-160.1642411464",
        "13.0-160.1645819013",
        "13.0-163",
        "13.0-163.1650365241",
        "13.0-163.1652313025",
        "13.0-164",
        "13.0-164.1661385922",
        "13.0-164.1665064129",
        "13.0-166",
        "13.0-166.1669644902",
        "13.0-166.1674469451",
        "13.0-38",
        "13.0-45",
        "13.0-53",
        "13.0-54",
        "13.0-59",
        "13.0-60",
        "13.0-61",
        "13.0-61.1543534135",
        "13.0-63",
        "13.0-66",
        "13.0-68",
        "13.0-68.1554788855",
        "13.0-72",
        "13.0-72.1557945124",
        "13.0-76",
        "13.0-83",
        "13.0-85",
        "13.0-86",
        "13.0-87",
        "13.0-97",
        "latest"
    ],
    "Created": "2023-01-23T10:32:50.497243846Z",
    "DockerVersion": "",
    "Labels": {
        "architecture": "x86_64",
        "batch": "20221102.1",
        "build-date": "2023-01-23T10:30:34",
        "com.redhat.component": "openstack-gnocchi-api-container",
        "com.redhat.license_terms": "https://www.redhat.com/agreements",
        "description": "Red Hat OpenStack Platform 13.0 gnocchi-api",
        "distribution-scope": "public",
        "io.buildah.version": "1.27.3",
        "io.k8s.description": "Red Hat OpenStack Platform 13.0 gnocchi-api",
        "io.k8s.display-name": "Red Hat OpenStack Platform 13.0 gnocchi-api",
        "io.openshift.tags": "rhosp osp openstack osp-13.0",
        "name": "rhosp13/openstack-gnocchi-api",
        "release": "166.1674469451",
        "summary": "Red Hat OpenStack Platform 13.0 gnocchi-api",
        "url": "https://access.redhat.com/containers/#/registry.access.redhat.com/rhosp13/openstack-gnocchi-api/images/13.0-166.1674469451",
        "vcs-ref": "90c557bcef900606a4258112639c35b234e5baee",
        "vcs-type": "git",
        "vendor": "Red Hat, Inc.",
        "version": "13.0"
    },
    "Architecture": "amd64",
    "Os": "linux",
    "Layers": [
        "sha256:42d1ac50daa7f3b8b14a7ff16ab2786b50364211676e0b3138a86d236527d84b",
        "sha256:6151993ea1832a9f0effcb926fcafa7e1bf3a2bb1251bc1f407533eac856df05",
        "sha256:6066257dbd93093895ebb72c97542f48f337501d3791091c54e2f9b64517f11d",
        "sha256:7c67e16d11ec004433c33664a596ff16a675cbf1e22835aa3e5478e1baee23b5",
        "sha256:b7cfde6289f930c539e1febcbb7e5c23f310f57aefd9adf1325da82362b3316f"
    ],
    "Env": [
        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "container=oci",
        "KOLLA_BASE_DISTRO=rhel",
        "KOLLA_INSTALL_TYPE=binary",
        "KOLLA_INSTALL_METATYPE=rhos",
        "PS1=$(tput bold)($(printenv KOLLA_SERVICE_NAME))$(tput sgr0)[$(id -un)@$(hostname -s) $(pwd)]$ "
    ]
}
Comment 36 errata-xmlrpc 2023-05-03 13:23:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.13 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2097