Bug 1442855

Typo in previous comment... It should read:

Issue is not seen when using an older version of OpenShift: "--version v3.3"

I can actually see the problem with version 3.3 as well

but only for last tag (latest is fine)

rhel7-test:7.3 (same image as in latest) shows 0 size
rhel7-test:7.2 is OK
rhel7-test:7.0-21 is OK
rhel7-test:7.0-23 is OK
rhel7-test:latest is OK

Manifest must contain correct layer sizes - at least manifest V2 schema 2. It's not OpenShift's fault that registry.access.redhat.com serves bad data.

This should be fixed on pulp's side or in our in build's infrastructure.

I wonder why the docker client doesn't fail in pulling such an image. I guess it's satisfied with just matching digests.

In OpenShift, we have a code that verifies/updates blob sizes if 0. Changing the code to handle 0 sizes for schema 2 would be trivial I guess. Nevertheless, I would consider it an low-priority bug for OpenShift if bug at all.

Keep in mind that size of 0 is merely a symptom. The real problem is that the image is actually not pulled from external registry into OpenShift's registry properly. 

Attempting to pull the image from OpenShift's internal registry causes an error:

$ docker pull 172.30.1.1:5000/myproject/rhel7-test:latest
Trying to pull repository 172.30.1.1:5000/myproject/rhel7-test ... 
manifest unknown: manifest unknown


Further inspection shows that tags have been populated as expected, but something is up with the manifests:

$ curl -H "Authorization: Bearer $(oc whoami -t)" -L http://172.30.1.1:5000/v2/myproject/rhel7-test/tags/list
{"name":"myproject/rhel7-test","tags":["7.2","7.0-21","7.0-23","latest","7.3"]}

$ curl -H "Authorization: Bearer $(oc whoami -t)" -L http://172.30.1.1:5000/v2/myproject/rhel7-test/manifests/latest
{"errors":[{"code":"MANIFEST_UNKNOWN","message":"manifest unknown","detail":{"Op":"Get","URL":"https://registry.access.redhat.com/v2/","Err":{"Op":"dial","Net":"tcp","Source":null,"Addr":null,"Err":{"Err":"read udp 172.17.0.4:59706-\u003e10.18.33.22:53: read: no route to host","Name":"registry.access.redhat.com","Server":"10.18.33.22:53","IsTimeout":false,"IsTemporary":false}}}}]}

This [1] and/or [2] should help.

- https://docs.openshift.com/container-platform/3.4/install_config/http_proxies.html#proxying-docker-pull
- https://docs.openshift.com/container-platform/3.4/install_config/http_proxies.html#configuring-hosts-for-proxies

The proxy config option you mention is indeed something else which shouldn't be touched.

https://github.com/openshift/origin/pull/14166

Commit pushed to master at https://github.com/openshift/origin

https://github.com/openshift/origin/commit/5e2c3f3073501b2de7a192a3496f6ad7b9c24de7
Set layer size whether it found in cache or not

Fixes bug 1442855

Signed-off-by: Oleg Bulatov <obulatov>

The code merged in Image: devenv-rhel7_6269 about 15 hours ago, and still could not find the image in aws:AMI.

Change to post status as no new puddles built out now

Let's use this track version 3.4.1 
PR not merged: https://github.com/openshift/ose/pull/762

There is not new 3.4 puddle ready for verify this bug, we will verify it after new puddle ready.

Verified in OCP
# openshift version
openshift v3.4.1.37
kubernetes v1.4.0+776c994
etcd 3.1.0-rc.0

1.# oc create -f /tmp/lg.yaml
imagestream "rhel7-test" created

2.# oc get is
NAME         DOCKER REPO                        TAGS                         UPDATED
rhel7-test   registry.access.redhat.com/rhel7   latest,7.3,7.2 + 2 more...   5 seconds ago

# oc get istag rhel7-test:latest -o json
{
    "kind": "ImageStreamTag",
    "apiVersion": "v1",
................................

"dockerImageLayers": [
            {
                "name": "sha256:4e5a7647df476dcb309aa02f6901239300e7103a914fd92acf540372c1dafe0c",
                "size": 72175335,
                "mediaType": "application/vnd.docker.container.image.rootfs.diff+x-gtar"
            },
            {
                "name": "sha256:0001a3087112018853b83f67ffc311dab755d14393a69852d5e2f4aa01b35361",
                "size": 1194,
                "mediaType": "application/vnd.docker.container.image.rootfs.diff+x-gtar"
            }
        ],
......................

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:3049

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days