1435588 – 'oc tag xxx' don't respect the option '--alias=true'

Bug 1435588 - 'oc tag xxx' don't respect the option '--alias=true'

Summary: 'oc tag xxx' don't respect the option '--alias=true'

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Image Registry
Sub Component:
Version:	3.5.0
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	medium
Target Milestone:	---
Target Release:	---
Assignee:	Maciej Szulik
QA Contact:	ge liu
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2017-03-24 10:14 UTC by ge liu
Modified:	2017-08-16 19:51 UTC (History)
CC List:	7 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Cause: Only aliases within single Image Stream are being resolved. Consequence: Cross Image Stream aliases are not resolved properly, pointing to the old image, if an update was done to the source image. Fix: Forbid creating cross Image Stream aliases. Result: User creating a cross Image Stream alias will get an error.
Clone Of:
Environment:
Last Closed:	2017-08-10 05:20:02 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHEA-2017:1716	0	normal	SHIPPED_LIVE	Red Hat OpenShift Container Platform 3.6 RPM Release Advisory	2017-08-10 09:02:50 UTC

Description ge liu 2017-03-24 10:14:57 UTC

# openshift version
openshift v3.5.0.55
kubernetes v1.5.2+43a9be4
etcd 3.1.0


Description of problem:

'oc tag xxx' don't respect the option '--alias=true', after tag a imagestream with  '--alias=true', then update the source  tag, and found the target imagestream tag have not been upgated.

option:

--alias=false: Should the destination tag be updated whenever the source tag changes. Defaults to false.

How reproducible:
Always

Steps to Reproduce:
1.  check the source imagestream tag:

# oc get is ruby-ex -o yaml
apiVersion: v1
kind: ImageStream
.......................
spec: {}
status:
  dockerImageRepository: 172.x.x.x:5000/lgproj/ruby-ex
  tags:
  - items:
    - created: 2017-03-24T08:47:43Z
      dockerImageReference: 172.x.x.x:5000/lgproj/ruby-ex@sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529
      generation: 1
      image: sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529
    tag: latest

2. oc tag a IS: 
# oc tag --source=imagestreamtag ruby-ex:latest mystream:tag1  --alias=true
Tag mystream:tag1 set up to track ruby-ex:latest.

3. re-build source imagestream to produce the update tag

# oc start-build ruby-ex
build "ruby-ex-3" started

4. check the source is tag have been updated:

# oc get is ruby-ex -o yaml
apiVersion: v1
........................
spec: {}
status:
  dockerImageRepository: 172.x.x.x:5000/lgproj/ruby-ex
  tags:
  - items:
    - created: 2017-03-24T08:53:37Z
      dockerImageReference: 172.30.10.81:5000/lgproj/ruby-ex@sha256:62ed6c0e2a72b4fe7148b33664ab822a3e6d1736026314738bc3dd3623a2226e
      generation: 1
      image: sha256:62ed6c0e2a72b4fe7148b33664ab822a3e6d1736026314738bc3dd3623a2226e
    - created: 2017-03-24T08:47:43Z
      dockerImageReference: 172.30.10.81:5000/lgproj/ruby-ex@sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529
      generation: 1
      image: sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529
    tag: latest

5. check the target imagestream tag, it still keep the old version, and have not been updated

# oc get is mystream -o yaml
...........
spec:
  tags:
  - annotations: null
    from:
      kind: ImageStreamTag
      name: ruby-ex:latest
    generation: 1
    importPolicy: {}
    name: tag1
    referencePolicy:
      type: Source
status:
  dockerImageRepository: 172.x.x.81:5000/lgproj/mystream
  tags:
  - items:
    - created: 2017-03-24T08:47:43Z
      dockerImageReference: 172.x.x.x:5000/lgproj/mystream@sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529
      generation: 1
      image: sha256:32d825ff8bcd09f5898040fd7c06277cc68d83f6d12693d0360a7a5f357db529
    tag: tag1


Actual results:

target image tag have not been updated whenever source tag updated
Expected results:
target image tag should update whenever source tag updated

Comment 1 Maciej Szulik 2017-03-27 12:33:05 UTC

Comment 2 Maciej Szulik 2017-03-27 12:37:12 UTC

I did following steps:
1. create new Image Stream (busybox1:0)
2. oc tag busybox:1.0 busybox:alias --alias=true
3. oc tag busybox:1.0 busybox:nonalias
4. update busybox:1.0 with newer version

Here's the output for that IS, after all the steps:

$ oc get is/busybox -o yaml
apiVersion: v1
kind: ImageStream
metadata:
  creationTimestamp: 2017-03-27T12:28:55Z
  generation: 3
  name: busybox
  namespace: test
  resourceVersion: "880"
  selfLink: /oapi/v1/namespaces/test/imagestreams/busybox
  uid: f1b958fb-12e8-11e7-b6c7-525400f25e34
spec:
  tags:
  - annotations: null
    from:
      kind: ImageStreamTag
      name: busybox:1.0
    generation: 2
    importPolicy: {}
    name: alias
    referencePolicy:
      type: Source
  - annotations: null
    from:
      kind: ImageStreamImage
      name: busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
    generation: 3
    importPolicy: {}
    name: nonalias
    referencePolicy:
      type: Source
status:
  dockerImageRepository: 172.30.143.244:5000/test/busybox
  tags:
  - items:
    - created: 2017-03-27T12:30:06Z
      dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
      generation: 3
      image: sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
    - created: 2017-03-27T12:28:55Z
      dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
      generation: 2
      image: sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
    tag: "1.0"
  - items:
    - created: 2017-03-27T12:30:06Z
      dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
      generation: 3
      image: sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a
    - created: 2017-03-27T12:28:55Z
      dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
      generation: 2
      image: sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
    tag: alias
  - items:
    - created: 2017-03-27T12:29:31Z
      dockerImageReference: 172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
      generation: 3
      image: sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b
    tag: nonalias


Clearly the non-aliased tag is pointing specific ImageStreamImage, whereas the aliased one is pointing ImageStreamTag. 

$ oc get istag/busybox:alias
NAME            DOCKER REF                                                                                                 UPDATED         IMAGENAME
busybox:alias   172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a   6 minutes ago   sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a

$ oc get istag/busybox:1.0
NAME          DOCKER REF                                                                                                 UPDATED         IMAGENAME
busybox:1.0   172.30.143.244:5000/test/busybox@sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a   6 minutes ago   sha256:718b22c12af2ede95f8b11651a276171b837fb72fe6a29d4a6c9ce03699cda2a

$ oc get istag/busybox:nonalias
NAME               DOCKER REF                                                                                                 UPDATED         IMAGENAME
busybox:nonalias   172.30.143.244:5000/test/busybox@sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b   6 minutes ago   sha256:d58a47742d6ae6c4a0316c26eda0a17466fe4b70badcb119de8b39fc535c769b

Comment 3 Maciej Szulik 2017-03-27 12:41:30 UTC

I did one more test with --source=imagestreamtag when oc tag'ing and the results are identical.

Comment 5 Michal Minar 2017-03-27 13:18:07 UTC

To clarify the switch to NEW: the reproducer in comment 2 uses single image stream. However, the behavior can be reproduced only between two different image streams.

Comment 6 Michal Fojtik 2017-03-30 08:54:41 UTC

This bug should be solved by adding a new controller that will maintain the links between image streams and update the status accordingly for them.

Since this does not seems like a regression and still require some architectural discussion, I'm moving the target for this to 3.7.

Comment 7 Maciej Szulik 2017-04-05 11:53:05 UTC

Based on discussion in https://github.com/openshift/origin/pull/13595#issuecomment-291122183 I've created a PR which forbids creating aliases across different image streams in https://github.com/openshift/origin/pull/13632

Comment 8 openshift-github-bot 2017-04-06 00:19:48 UTC

Commits pushed to master at https://github.com/openshift/origin

https://github.com/openshift/origin/commit/b3b252aeac34dd8b69643439bf27bb44732e910a
Bug 1435588 - Forbid creating aliases across different Image Streams.

https://github.com/openshift/origin/commit/8a0537098fbb09be62b020739dd8a307a14f0246
Merge pull request #13632 from soltysh/bug1435588

Merged by openshift-bot

Comment 9 Maciej Szulik 2017-04-06 07:31:10 UTC

Docs PR is https://github.com/openshift/openshift-docs/pull/4093.

Comment 10 ge liu 2017-04-06 09:40:15 UTC

@maszulik, the Image: devenv-rhel7_6119 have not ready in aws, so I could not tested it now, the newest image in aws, and the code have not merged into it, so pls upload the correct images at first. thanks.

Comment 11 openshift-github-bot 2017-04-10 19:29:35 UTC

Commit pushed to master at https://github.com/openshift/openshift-docs

https://github.com/openshift/openshift-docs/commit/752347dec68611cb2a2b98796c85049581b8e557
Merge pull request #4093 from soltysh/bug1435588

Forbid creating aliases across different Image Streams docs

Comment 12 Troy Dawson 2017-04-11 21:22:42 UTC

This has been merged into ocp and is in OCP v3.6.27 or newer.

Comment 14 ge liu 2017-04-13 10:25:02 UTC

Verified in env:
openshift v3.6.0-alpha.1+2aff95e-12
kubernetes v1.5.2+43a9be4
etcd 3.1.0


# oc tag --source=imagestreamtag ruby-ex:latest mystream:tag1  --alias=true
error: cannot set alias across different Image Streams
# oc tag --source=imagestreamtag ruby-ex:latest ruby-ex:alias --alias=true
Tag ruby-ex:alias set up to track ruby-ex:latest.
# oc get is
NAME              DOCKER REPO                                 TAGS           UPDATED
ruby-22-centos7   172.30.x.x:5000/lgproj/ruby-22-centos7   latest         13 minutes ago
ruby-ex           172.30.x.x:5000/lgproj/ruby-ex           latest,alias   12 minutes ago
# oc tag --source=imagestreamtag ruby-ex:latest ruby-ex:noalias 
Tag ruby-ex:noalias set to ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723.


#  oc get is ruby-ex -o yaml
apiVersion: v1
kind: ImageStream
metadata:
  annotations:
    openshift.io/generated-by: OpenShiftNewBuild
  ...............
status:
  dockerImageRepository: 172.30.242.47:5000/lgproj/ruby-ex
  tags:
  - items:
    - created: 2017-04-13T09:46:36Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
      generation: 2
      image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
    tag: latest
  - items:
    - created: 2017-04-13T09:46:36Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
      generation: 2
      image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
    tag: alias
  - items:
    - created: 2017-04-13T09:59:06Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
      generation: 3
      image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
    tag: noalias


update the source imagestream:

# oc tag  --source=docker openshift/hello-openshift:latest lgproj/ruby-ex:latest
Tag ruby-ex:latest set to openshift/hello-openshift:latest.


check the alias and nonalias tag info:

# oc get is ruby-ex -o yaml
apiVersion: v1
......................
  dockerImageRepository: 172.30.242.47:5000/lgproj/ruby-ex
  tags:
  - items:
    - created: 2017-04-13T10:17:10Z
      dockerImageReference: openshift/hello-openshift@sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
      generation: 5
      image: sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
    - created: 2017-04-13T10:00:38Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
      generation: 3
      image: sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
    - created: 2017-04-13T09:46:36Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
      generation: 2
      image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
    tag: latest
  - items:
    - created: 2017-04-13T10:17:10Z
      dockerImageReference: openshift/hello-openshift@sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
      generation: 5
      image: sha256:3a1269366e40449e862160fd20f35dddc02a6794fb0691a1adfa3c4789913c10
    - created: 2017-04-13T10:00:38Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
      generation: 3
      image: sha256:1f77c8198e85d34319e28f91b8673f93855e2220517c74f54f2e5e59531551ee
    - created: 2017-04-13T09:46:36Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
      generation: 2
      image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
    tag: alias
  - items:
    - created: 2017-04-13T09:59:06Z
      dockerImageReference: 172.30.242.47:5000/lgproj/ruby-ex@sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
      generation: 3
      image: sha256:b4e933beca0c3c8b3b61d40cfc5c26c386da97ffeccf29a5f72e9c52c8b68723
    tag: noalias

Comment 16 errata-xmlrpc 2017-08-10 05:20:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1716

Note You need to log in before you can comment on or make changes to this bug.