Bug 1435588
| Summary: | 'oc tag xxx' don't respect the option '--alias=true' | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | ge liu <geliu> |
| Component: | Image Registry | Assignee: | Maciej Szulik <maszulik> |
| Status: | CLOSED ERRATA | QA Contact: | ge liu <geliu> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.5.0 | CC: | aos-bugs, jokerman, maszulik, mfojtik, miminar, mmccomas, tdawson |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Cause:
Only aliases within single Image Stream are being resolved.
Consequence:
Cross Image Stream aliases are not resolved properly, pointing to the old image, if an update was done to the source image.
Fix:
Forbid creating cross Image Stream aliases.
Result:
User creating a cross Image Stream alias will get an error.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-10 05:20:02 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I I did following steps:
1. create new Image Stream (busybox1:0)
2. oc tag busybox:1.0 busybox:alias --alias=true
3. oc tag busybox:1.0 busybox:nonalias
4. update busybox:1.0 with newer version
Here's the output for that IS, after all the steps:
$ oc get is/busybox -o yaml
apiVersion: v1
kind: ImageStream
metadata:
creationTimestamp: 2017-03-27T12:28:55Z
generation: 3
name: busybox
namespace: test
resourceVersion: "880"
selfLink: /oapi/v1/namespaces/test/imagestreams/busybox
uid: f1b958fb-12e8-11e7-b6c7-525400f25e34
spec:
tags:
- annotations: null
from:
kind: ImageStreamTag
name: busybox:1.0
generation: 2
importPolicy: {}
name: alias
referencePolicy:
type: Source
- annotations: null
from:
kind: ImageStreamImage
name: busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
generation: 3
importPolicy: {}
name: nonalias
referencePolicy:
type: Source
status:
dockerImageRepository: 172.30.143.244:5000/test/busybox
tags:
- items:
- created: 2017-03-27T12:30:06Z
dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
generation: 3
image: sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
- created: 2017-03-27T12:28:55Z
dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
generation: 2
image: sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
tag: "1.0"
- items:
- created: 2017-03-27T12:30:06Z
dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
generation: 3
image: sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
- created: 2017-03-27T12:28:55Z
dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
generation: 2
image: sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
tag: alias
- items:
- created: 2017-03-27T12:29:31Z
dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
generation: 3
image: sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
tag: nonalias
Clearly the non-aliased tag is pointing specific ImageStreamImage, whereas the aliased one is pointing ImageStreamTag.
$ oc get istag/busybox:alias
NAME DOCKER REF UPDATED IMAGENAME
busybox:alias 172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a 6 minutes ago sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
$ oc get istag/busybox:1.0
NAME DOCKER REF UPDATED IMAGENAME
busybox:1.0 172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a 6 minutes ago sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
$ oc get istag/busybox:nonalias
NAME DOCKER REF UPDATED IMAGENAME
busybox:nonalias 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b 6 minutes ago sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
I did one more test with --source=imagestreamtag when oc tag'ing and the results are identical. To clarify the switch to NEW: the reproducer in comment 2 uses single image stream. However, the behavior can be reproduced only between two different image streams. This bug should be solved by adding a new controller that will maintain the links between image streams and update the status accordingly for them. Since this does not seems like a regression and still require some architectural discussion, I'm moving the target for this to 3.7. Based on discussion in https://github.com/openshift/origin/pull/13595#issuecomment-291122183 I've created a PR which forbids creating aliases across different image streams in https://github.com/openshift/origin/pull/13632 Commits pushed to master at https://github.com/openshift/origin https://github.com/openshift/origin/commit/b3b252aeac34dd8b69643439bf27bb44732e910a Bug 1435588 - Forbid creating aliases across different Image Streams. https://github.com/openshift/origin/commit/8a0537098fbb09be62b020739dd8a307a14f0246 Merge pull request #13632 from soltysh/bug1435588 Merged by openshift-bot @maszulik, the Image: devenv-rhel7_6119 have not ready in aws, so I could not tested it now, the newest image in aws, and the code have not merged into it, so pls upload the correct images at first. thanks. Commit pushed to master at https://github.com/openshift/openshift-docs https://github.com/openshift/openshift-docs/commit/752347dec68611cb2a2b98796c85049581b8e557 Merge pull request #4093 from soltysh/bug1435588 Forbid creating aliases across different Image Streams docs This has been merged into ocp and is in OCP v3.6.27 or newer. Verified in env:
openshift v3.6.0-alpha.1+2aff95e-12
kubernetes v1.5.2+43a9be4
etcd 3.1.0
# oc tag --source=imagestreamtag ruby-ex:latest mystream:tag1 --alias=true
error: cannot set alias across different Image Streams
# oc tag --source=imagestreamtag ruby-ex:latest ruby-ex:alias --alias=true
Tag ruby-ex:alias set up to track ruby-ex:latest.
# oc get is
NAME DOCKER REPO TAGS UPDATED
ruby-22-centos7 172.30.x.x:5000/lgproj/ruby-22-centos7 latest 13 minutes ago
ruby-ex 172.30.x.x:5000/lgproj/ruby-ex latest,alias 12 minutes ago
# oc tag --source=imagestreamtag ruby-ex:latest ruby-ex:noalias
Tag ruby-ex:noalias set to ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723.
# oc get is ruby-ex -o yaml
apiVersion: v1
kind: ImageStream
metadata:
annotations:
openshift.io/generated-by: OpenShiftNewBuild
...............
status:
dockerImageRepository: 172.30.242.47:5000/lgproj/ruby-ex
tags:
- items:
- created: 2017-04-13T09:46:36Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
generation: 2
image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
tag: latest
- items:
- created: 2017-04-13T09:46:36Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
generation: 2
image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
tag: alias
- items:
- created: 2017-04-13T09:59:06Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
generation: 3
image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
tag: noalias
update the source imagestream:
# oc tag --source=docker openshift/hello-openshift:latest lgproj/ruby-ex:latest
Tag ruby-ex:latest set to openshift/hello-openshift:latest.
check the alias and nonalias tag info:
# oc get is ruby-ex -o yaml
apiVersion: v1
......................
dockerImageRepository: 172.30.242.47:5000/lgproj/ruby-ex
tags:
- items:
- created: 2017-04-13T10:17:10Z
dockerImageReference: openshift/hello-openshift@sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
generation: 5
image: sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
- created: 2017-04-13T10:00:38Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
generation: 3
image: sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
- created: 2017-04-13T09:46:36Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
generation: 2
image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
tag: latest
- items:
- created: 2017-04-13T10:17:10Z
dockerImageReference: openshift/hello-openshift@sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
generation: 5
image: sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
- created: 2017-04-13T10:00:38Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
generation: 3
image: sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
- created: 2017-04-13T09:46:36Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
generation: 2
image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
tag: alias
- items:
- created: 2017-04-13T09:59:06Z
dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
generation: 3
image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
tag: noalias
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1716 |
# openshift version openshift v3.5.0.55 kubernetes v1.5.2+43a9be4 etcd 3.1.0 Description of problem: 'oc tag xxx' don't respect the option '--alias=true', after tag a imagestream with '--alias=true', then update the source tag, and found the target imagestream tag have not been upgated. option: --alias=false: Should the destination tag be updated whenever the source tag changes. Defaults to false. How reproducible: Always Steps to Reproduce: 1. check the source imagestream tag: # oc get is ruby-ex -o yaml apiVersion: v1 kind: ImageStream ....................... spec: {} status: dockerImageRepository: 172.x.x.x:5000/lgproj/ruby-ex tags: - items: - created: 2017-03-24T08:47:43Z dockerImageReference: 172.x.x.x:5000/lgproj/ruby-ex@sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529 generation: 1 image: sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529 tag: latest 2. oc tag a IS: # oc tag --source=imagestreamtag ruby-ex:latest mystream:tag1 --alias=true Tag mystream:tag1 set up to track ruby-ex:latest. 3. re-build source imagestream to produce the update tag # oc start-build ruby-ex build "ruby-ex-3" started 4. check the source is tag have been updated: # oc get is ruby-ex -o yaml apiVersion: v1 ........................ spec: {} status: dockerImageRepository: 172.x.x.x:5000/lgproj/ruby-ex tags: - items: - created: 2017-03-24T08:53:37Z dockerImageReference: 172.30.10.81:5000/lgproj/ruby-ex@sha256:62ed6c0e2a72b4fe7148b33664ab822a3e6d1736026314738bc3dd3623a2226e generation: 1 image: sha256:62ed6c0e2a72b4fe7148b33664ab822a3e6d1736026314738bc3dd3623a2226e - created: 2017-03-24T08:47:43Z dockerImageReference: 172.30.10.81:5000/lgproj/ruby-ex@sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529 generation: 1 image: sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529 tag: latest 5. check the target imagestream tag, it still keep the old version, and have not been updated # oc get is mystream -o yaml ........... spec: tags: - annotations: null from: kind: ImageStreamTag name: ruby-ex:latest generation: 1 importPolicy: {} name: tag1 referencePolicy: type: Source status: dockerImageRepository: 172.x.x.81:5000/lgproj/mystream tags: - items: - created: 2017-03-24T08:47:43Z dockerImageReference: 172.x.x.x:5000/lgproj/mystream@sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529 generation: 1 image: sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529 tag: tag1 Actual results: target image tag have not been updated whenever source tag updated Expected results: target image tag should update whenever source tag updated