Bug 1292963 - [RFE] You can't import images from authenticated repos today without pushing them into OpenShift.
[RFE] You can't import images from authenticated repos today without pushing ...
Status: CLOSED CURRENTRELEASE
Product: OpenShift Container Platform
Classification: Red Hat
Component: Image Registry (Show other bugs)
3.1.0
Unspecified Unspecified
unspecified Severity low
: ---
: ---
Assigned To: Michal Minar
Wei Sun
:
Depends On:
Blocks: 1267746 1278974 1289343 1292962
  Show dependency treegraph
 
Reported: 2015-12-18 16:22 EST by Ryan Howe
Modified: 2016-09-07 17:02 EDT (History)
14 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1278974
Environment:
Last Closed: 2016-09-07 17:02:10 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 3 Ben Parees 2016-01-07 22:26:51 EST
Trello'd to devex board here: https://trello.com/c/PZ4tdndo
Comment 4 Michal Minar 2016-02-01 07:04:02 EST
If I'm not mistaken, this has been fixed by https://github.com/openshift/origin/pull/6288.

Clayton, can you please confirm?
Comment 5 Michal Minar 2016-02-04 11:39:38 EST
Fixed by PRs #6288 #6800.
Comment 6 weiwei jiang 2016-02-19 03:51:41 EST
Checked with devenv-rhel7_3467, private image on secure v2 registry  work well now.

Since we are not allowing insecure TLS connections due to https://bugzilla.redhat.com/show_bug.cgi?id=1302549#c3 ,
and also v1 registry due to https://bugzilla.redhat.com/show_bug.cgi?id=1308818#c1.

So just have a check on secure TLS v2 registry, dockerhub.

# oc secrets new-dockercfg hub  --docker-username=wjiang --docker-password=xxxxxx --docker-email=wjiang@redhat.com
# oc secrets add serviceaccount/default secrets/hub --for=pull
# oc new-app wjiang/node:latest
# oc get pod -n wjiang 
NAME            READY     STATUS             RESTARTS   AGE
node-1-s9qaa    1/1       Running            0          3m
Comment 7 weiwei jiang 2016-02-19 05:35:50 EST
https://bugzilla.redhat.com/show_bug.cgi?id=1310052 block this on OSE.
Will have a check in OSE after the bug has been fixed.
Comment 8 zhou ying 2016-02-24 13:40:22 EST
On OSE env :
openshift v3.1.1.905
kubernetes v1.2.0-alpha.7-703-gbc4550d
etcd 2.2.5


The issue still exist:
[root@zhouy roottest]# oc describe serviceaccount 
Name:		builder
Namespace:	zhouy
Labels:		<none>

Mountable secrets: 	builder-token-offls
                   	builder-dockercfg-wy2eu
                   	hubyinzhou1

Tokens:            	builder-token-fitue
                   	builder-token-offls

Image pull secrets:	builder-dockercfg-wy2eu



Name:		default
Namespace:	zhouy
Labels:		<none>

Image pull secrets:	default-dockercfg-ktza7
                   	hubyinzhou1

Mountable secrets: 	default-token-cda1p
                   	default-dockercfg-ktza7

Tokens:            	default-token-269cp
                   	default-token-cda1p



Name:		deployer
Namespace:	zhouy
Labels:		<none>

Image pull secrets:	deployer-dockercfg-8dyy7

Mountable secrets: 	deployer-token-6kad3
                   	deployer-dockercfg-8dyy7

Tokens:            	deployer-token-6kad3
                   	deployer-token-ehgp5



[root@zhouy roottest]# oc describe secret hubyinzhou1
Name:		hubyinzhou1
Namespace:	zhouy
Labels:		<none>
Annotations:	<none>

Type:	kubernetes.io/dockercfg

Data
====
.dockercfg:	{"https://auth.docker.io":{"username":"zhouying7780","password":"xxxxxx","email":"yinzhou@redhat.com","auth":"emhvdXlpbmc3NzgwOmFuZHlsdnU5OQ=="}}



[root@zhouy roottest]# oc new-app --loglevel=5 docker.io/zhouying7780/deployment-example:latest
I0225 02:25:01.629951   24451 newapp.go:430] Docker client did not respond to a ping: Get http://unix.sock/_ping: dial unix /var/run/docker.sock: no such file or directory
I0225 02:25:01.630199   24451 imagestreamlookup.go:29] image streams must be of the form [<namespace>/]<name>[:<tag>|@<digest>], term "docker.io/zhouying7780/deployment-example:latest" did not qualify
I0225 02:25:06.610114   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610135   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610142   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610148   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610154   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610160   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610166   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610172   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610178   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610184   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610190   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610196   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610202   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610207   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610213   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610219   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610225   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610231   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610237   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610243   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610249   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610255   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610261   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610267   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610273   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610279   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610285   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610291   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610297   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610303   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610309   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610812   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610838   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610864   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610872   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610885   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610892   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610898   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610904   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610911   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610917   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610923   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610929   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610935   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610941   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610947   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610953   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610959   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610966   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610972   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610978   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610985   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610991   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.610997   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.611002   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.611008   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.611015   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.611021   24451 templatelookup.go:57] checking for term docker.io/zhouying7780/deployment-example:latest in namespace openshift
I0225 02:25:06.611087   24451 dockerimagelookup.go:72] checking remote registry for "docker.io/zhouying7780/deployment-example:latest"
I0225 02:25:08.836425   24451 dockerimagelookup.go:238] Adding Docker image "docker.io/zhouying7780/deployment-example:latest" (tag "latest"), dda30c8, from docker.io, 5.503mb, author Clayton Coleman <ccoleman@redhat.com> as component match for "docker.io/zhouying7780/deployment-example:latest" with score 0
I0225 02:25:08.836477   24451 dockerimagelookup.go:78] Found remote match docker.io/zhouying7780/deployment-example:latest
I0225 02:25:08.836518   24451 newapp.go:1010] Code []
I0225 02:25:08.836537   24451 newapp.go:1011] Components [docker.io/zhouying7780/deployment-example:latest]
I0225 02:25:08.836569   24451 newapp.go:653] found group: docker.io/zhouying7780/deployment-example:latest
I0225 02:25:08.836583   24451 newapp.go:673] will include "docker.io/zhouying7780/deployment-example:latest"
--> Found Docker image dda30c8 (11 days old) from docker.io for "docker.io/zhouying7780/deployment-example:latest"

    * An image stream will be created as "deployment-example:latest" that will track this image
    * This image will be deployed in deployment config "deployment-example"
    * Port 8080/tcp will be load balanced by service "deployment-example"
      * Other containers can access this service through the hostname "deployment-example"
    * WARNING: Image "deployment-example" runs as the 'root' user which may not be permitted by your cluster administrator

--> Creating resources with label app=deployment-example ...
    imagestream "deployment-example" created
    deploymentconfig "deployment-example" created
    service "deployment-example" created
--> Success
    Run 'oc status' to view your app.


[root@zhouy roottest]# oc get pods
NAME                          READY     STATUS              RESTARTS   AGE
deployment-example-1-deploy   1/1       Running             0          12h
deployment-example-1-xb5pj    0/1       ContainerCreating   0          12h
[root@zhouy roottest]# oc describe pod deployment-example-1-xb5pj
Name:		deployment-example-1-xb5pj
Namespace:	zhouy
Image(s):	docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6
Node:		openshift-149.lab.sjc.redhat.com/10.14.6.149
Start Time:	Wed, 24 Feb 2016 13:27:11 -0500
Labels:		app=deployment-example,deployment=deployment-example-1,deploymentconfig=deployment-example
Status:		Pending
Reason:		
Message:	
IP:		10.2.1.9
Controllers:	ReplicationController/deployment-example-1
Containers:
  deployment-example:
    Container ID:	
    Image:		docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6
    Image ID:		
    QoS Tier:
      cpu:		BestEffort
      memory:		BestEffort
    State:		Waiting
      Reason:		ImagePullBackOff
    Ready:		False
    Restart Count:	0
    Environment Variables:
Conditions:
  Type		Status
  Ready 	False 
Volumes:
  default-token-cda1p:
    Type:	Secret (a secret that should populate this volume)
    SecretName:	default-token-cda1p
Events:
  FirstSeen	LastSeen	Count	From						SubobjectPath				Type		Reason		Message
  ---------	--------	-----	----						-------------				--------	------		-------
  12h		12h		1	{default-scheduler }									Normal		Scheduled	Successfully assigned deployment-example-1-xb5pj to openshift-149.lab.sjc.redhat.com
  12h		12h		1	{kubelet openshift-149.lab.sjc.redhat.com}	spec.containers{deployment-example}	Normal		BackOff		Back-off pulling image "docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6"
  12h		12h		1	{kubelet openshift-149.lab.sjc.redhat.com}						Warning		FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "deployment-example" with ImagePullBackOff: "Back-off pulling image \"docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6\""

  12h	12h	2	{kubelet openshift-149.lab.sjc.redhat.com}	spec.containers{deployment-example}	Normal	Pulling		pulling image "docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6"
  12h	12h	2	{kubelet openshift-149.lab.sjc.redhat.com}	spec.containers{deployment-example}	Warning	Failed		Failed to pull image "docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6": image pull failed for docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6, this may be because there are no credentials on this request.  details: (unauthorized: access to the requested resource is not authorized)
  12h	12h	2	{kubelet openshift-149.lab.sjc.redhat.com}						Warning	FailedSync	Error syncing pod, skipping: failed to "StartContainer" for "deployment-example" with ErrImagePull: "image pull failed for docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6, this may be because there are no credentials on this request.  details: (unauthorized: access to the requested resource is not authorized)"
Comment 9 Michal Minar 2016-02-29 08:21:43 EST
See my comment [1] in related bz#1278974.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1278974#c16
Comment 10 zhou ying 2016-02-29 22:03:05 EST
Confirmed on latest puddle:
[root@openshift-107 ~]# openshift version
openshift v3.1.1.908
kubernetes v1.2.0-alpha.7-703-gbc4550d
etcd 2.2.5

The issue has fixed.
[root@zhouy ~]# oc get pods
NAME                         READY     STATUS    RESTARTS   AGE
deployment-example-1-94qfs   1/1       Running   0          12h
[root@zhouy ~]# oc describe pod deployment-example-1-94qfs
Name:		deployment-example-1-94qfs
Namespace:	zhouy
Image(s):	docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6
Node:		openshift-106.lab.sjc.redhat.com/10.14.6.106
Start Time:	Mon, 29 Feb 2016 21:59:39 -0500
Labels:		app=deployment-example,deployment=deployment-example-1,deploymentconfig=deployment-example
Status:		Running
Reason:		
Message:	
IP:		10.1.0.4
Controllers:	ReplicationController/deployment-example-1
Containers:
  deployment-example:
    Container ID:	docker://29610407d262421e5e80d314d32b92031ea2fc96f5f1b64b8af624e7e460a75f
    Image:		docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6
    Image ID:		docker://4081774424e9315432a46596c26ad3ccba86ceb14c71f2090784a9770194f230
    QoS Tier:
      cpu:		BestEffort
      memory:		BestEffort
    State:		Running
      Started:		Mon, 29 Feb 2016 21:59:50 -0500
    Ready:		True
    Restart Count:	0
    Environment Variables:
Conditions:
  Type		Status
  Ready 	True 
Volumes:
  default-token-v96fk:
    Type:	Secret (a secret that should populate this volume)
    SecretName:	default-token-v96fk
Events:
  FirstSeen	LastSeen	Count	From						SubobjectPath				Type		Reason		Message
  ---------	--------	-----	----						-------------				--------	------		-------
  12h		12h		1	{default-scheduler }									Normal		Scheduled	Successfully assigned deployment-example-1-94qfs to openshift-106.lab.sjc.redhat.com
  12h		12h		1	{kubelet openshift-106.lab.sjc.redhat.com}	spec.containers{deployment-example}	Normal		Pulling		pulling image "docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6"
  12h		12h		1	{kubelet openshift-106.lab.sjc.redhat.com}	spec.containers{deployment-example}	Normal		Pulled		Successfully pulled image "docker.io/zhouying7780/deployment-example@sha256:4bdbf0092bc568bb0107bcd37895e58f7028edd371c68c5c0a6160a91c248af6"
  12h		12h		1	{kubelet openshift-106.lab.sjc.redhat.com}	spec.containers{deployment-example}	Normal		Created		Created container with docker id 29610407d262
  12h		12h		1	{kubelet openshift-106.lab.sjc.redhat.com}	spec.containers{deployment-example}	Normal		Started		Started container with docker id 29610407d262

Note You need to log in before you can comment on or make changes to this bug.