Hide Forgot
Description of problem: After login integrated registry , try to use 'docker pull' command to pull the image through integrated registry, will met error: image not found Version-Release number of selected component (if applicable): oc v3.1.1.910 kubernetes v1.2.0-alpha.7-703-gbc4550d Docker 1.8.2-el7, build a01dc02/1.8.2 kernel 3.10.0-327.10.1.el7.x86_64 How reproducible: always Steps to Reproduce: 1. Login OpenShift and create project; 2. Use command to create a ImageStream: `oc tag busybox mysteam:latest` 3. Use the user token to login docker-registry: `docker login -u zhouy -p htUTWukEUXYl7apuzxWfXtHTju9eq7uyBSOkdaSKlwg -e yinzhou registry.dev-preview-int.openshift.com` 4. Try to pull the image through docker-registry; oc get is NAME DOCKER REPO TAGS UPDATED mystream 172.30.222.172:5000/zhouy/mystream latest 3 seconds ago `docker pull registry.dev-preview-int.openshift.com/zhouy/mystream:latest` Actual results: Failed to pull the image through docker-registry. docker pull registry.dev-preview-int.openshift.com/zhouy/mytest:latest Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/mytest ... latest: Pulling from zhouy/mytest c2ddbea624bd: Pulling fs layer f1e4b055fb65: Pulling fs layer not found Error: image zhouy/mytest:latest not found Expected results: Could pull the image through docker-registry. Additional info:
I was able to reproduce the problem on dev-preview-int earlier, but the cluster has since been recreated, moving from v3.1.1.910 to v3.2.0.6, and I can no longer reproduce the problem on dev-preview-int, or in a devenv.
QE: Was this issue always reproducible - as in, happened every time? If so, this should be easy to verify. However, we would still like to have this issue verified at different times to make sure.
Hi, Today, on the dev-preview-int , I can't reproduce the issue. oc get is NAME DOCKER REPO TAGS UPDATED mystream 172.30.60.197:5000/zhouy/mystream v1 About a minute ago recreate-example openshift/deployment-example latest,v1,v2 2 days ago docker login -u zhouy -p xxxxxxxxxxxxxx -e any registry.dev-preview-int.openshift.com WARNING: login credentials saved in /root/.docker/config.json Login Succeeded docker pull registry.dev-preview-int.openshift.com/zhouy/mystream:v1 Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/mystream ... v1: Pulling from zhouy/mystream 56ed16bd6310: Pull complete bc744c4ab376: Pull complete Digest: sha256:4a887a2326ec9e0fa90cce7b4764b0e627b5d6afcb81a3f73c85dc29cea00048 Status: Downloaded newer image for registry.dev-preview-int.openshift.com/zhouy/mystream:v1 will verify it.
Sorry to put this back on QE, but would you mind performing a few additional test runs on INT? The cluster has just been rebuilt, and we would like to verify that the problem is not intermittent and is still fixed in the latest cluster rebuild.
Just wanted to mention that INT is currently being rebuilt and Ops is targeting Friday for the cluster to be available.
On latest env , I reproduce the issue one time, but after that can pull successfully: oc tag busybox mysteam:latest docker pull registry.dev-preview-int.openshift.com/zhouy/mystream:latest Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/mystream ... not found Error: image zhouy/mystream:latest not found docker pull registry.dev-preview-int.openshift.com/zhouy/mysteam Using default tag: latest Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/mysteam ... latest: Pulling from zhouy/mysteam 56ed16bd6310: Already exists bc744c4ab376: Already exists Digest: sha256:4a887a2326ec9e0fa90cce7b4764b0e627b5d6afcb81a3f73c85dc29cea00048 Status: Downloaded newer image for registry.dev-preview-int.openshift.com/zhouy/mysteam:latest oc tag openshift/deployment-example mydeployment:v2 Tag mydeployment:v2 set to openshift/deployment-example. docker pull registry.dev-preview-int.openshift.com/zhouy/mydeployment:v2 Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/mydeployment ... v2: Pulling from zhouy/mydeployment 25efc604a513: Pull complete 6f30d56e74df: Pull complete c0b7d7d67427: Pull complete 698f4e45b36a: Pull complete 1c839d8c77c8: Pull complete Digest: sha256:ea9135488f323060cb18ab3ec06286cd49e4b3a611fce1a6a442651ecf421f99 Status: Downloaded newer image for registry.dev-preview-int.openshift.com/zhouy/mydeployment:v2
On latest env , I reproduce the issue occasionally, please see: [root@dhcp-136-93 ~]# docker pull registry.dev-preview-int.openshift.com/zhouy/my-fedora:v2 Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/my-fedora ... v2: Pulling from zhouy/my-fedora e25d8296e7b5: Already exists 7427c9af1454: Already exists 28ce03615351: Pulling fs layer not found Error: image zhouy/my-fedora:v2 not found [root@dhcp-136-93 ~]# docker pull registry.dev-preview-int.openshift.com/zhouy/my-fedora:v2 Trying to pull repository registry.dev-preview-int.openshift.com/zhouy/my-fedora ... v2: Pulling from zhouy/my-fedora e25d8296e7b5: Already exists 7427c9af1454: Already exists 28ce03615351: Pull complete Digest: sha256:849675938a1713ce3cf8f9ab6151edcac48f2bd94cc534a6c9d6801da6a6449e Status: Downloaded newer image for registry.dev-preview-int.openshift.com/zhouy/my-fedora:v2
It is expected behaviour that there will be some delay between when you create the tag and when you can use it because the image comes from a remote repository and the registry needs time to synchronise the image metadata. In my own testing, I see the failure if I tag and immediately pull (`oc tag busybox mysteam:latest && docker pull registry.dev-preview-int.openshift.com/mystream/mysteam:latest`). However, I consistently see that a subsequent `docker pull` will succeed. I also consistently see that `docker pull` will succeed if I insert a 1-second sleep (`oc tag busybox mysteam:latest && sleep 1 && docker pull registry.dev-preview-int.openshift.com/mystream/mysteam:latest`). For better UX or for use in scripts, it might make sense to have a flag (e.g., --synchronous or --wait or similar) to tell `oc tag` not to return until the tag is ready to use. Fabiano, what do you think?
Makes sense to me. No strong preference but I'd go with --wait which is already used by a couple commands. Must wait for completeness and exit with non-zero return code in case of failure.
Trello card for adding `oc tag --wait`: https://trello.com/c/NXfEsb4k/725-oc-tag-wait-flag I'm repurposing this Bugzilla report as a documentation issue. We need to document the fact that when using `oc tag` to tag an image from a remote repository into an imagestream, the metadata is not immediately updated and synched in the registry, which means that using `docker pull` to pull that imagestream from the registry immediately after `oc tag` returns (for example, in a script) may fail.