Bug 1384973 - Cannot use ImageStreamTag for Build custom strategy builder image
Summary: Cannot use ImageStreamTag for Build custom strategy builder image
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Build
Version: 3.2.1
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Martin Milata
QA Contact: Wang Haoran
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-14 13:08 UTC by Tim Waugh
Modified: 2017-03-08 18:43 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: When creating Build object through REST API, the type of the "from" image is not checked and is assumed to be DockerImage. Consequence: Creating Build object with custom strategy referencing an ImageStreamTag as its "from" image results in failure or, potentially, build using the wrong image. Fix: Type of builder image is checked when creating Build object and if it is not DockerImage the request is rejected as invalid. Result: Custom builds with builder image specified as ImageStreamTag are rejected.
Clone Of:
Environment:
Last Closed: 2017-01-18 12:42:58 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0066 0 normal SHIPPED_LIVE Red Hat OpenShift Container Platform 3.4 RPM Release Advisory 2017-01-18 17:23:26 UTC

Description Tim Waugh 2016-10-14 13:08:06 UTC 
Description of problem:
When creating a BuildConfig using a custom build strategy that specifies the builder image using an ImageStreamTag, everything works as expected.

When creating a Build directly, instead of creating a BuildConfig and instantiating a Build from it, this does not work correctly and the name is used as though it is a DockerImage kind.

Version-Release number of selected component (if applicable):
3.2.1.15

How reproducible:
Happens every time

Actual results:
Pods fail to pull builder image

Expected results:
Pods discover builder image using ImageStreamTag and pull that.
Comment 1 Cesar Wong 2016-10-14 13:27:57 UTC 
Tim, this is working as designed. A build will not resolve an ImageStreamTag, only a BuildConfig will. However, I think we have a bug in that we're allowing the Build object to be created as valid.
Comment 2 Tim Waugh 2016-10-14 14:01:52 UTC 
That seems fine. We are resolving the ImageStreamTag to a DockerImage when creating the Build object now, so that seems like the correct approach.
Comment 3 Martin Milata 2016-10-18 14:21:09 UTC 
Pull request: https://github.com/openshift/origin/pull/11398
Comment 4 shiyang.wang 2016-10-27 10:18:20 UTC 
test on
oc v3.4.0.16+cc70b72
openshift v3.4.0.16+cc70b72
kubernetes v1.4.0+776c994

now return is 
"The Build "my-build" is invalid: spec.strategy.customStrategy.from.kind: Invalid value: "ImageStreamTag": only DockerImage references are supported for Builds "

change status to verified
Comment 6 errata-xmlrpc 2017-01-18 12:42:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0066
Note You need to log in before you can comment on or make changes to this bug.