Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1475989

Summary: Cant list all images in the OCP internal registry with cluster-admin role.
Product: OpenShift Container Platform Reporter: Ryan Howe <rhowe>
Component: Image RegistryAssignee: Michal Fojtik <mfojtik>
Status: CLOSED NOTABUG QA Contact: ge liu <geliu>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 3.5.0CC: aos-bugs, pweil
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-07-27 18:02:43 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Ryan Howe 2017-07-27 17:39:38 UTC 
Description of problem:

Using a tokened user that is bound to the cluster-admin role. I can not list all images in the registry. 


Version-Release number of selected component (if applicable):
openshift3/ose-docker-registry:v3.5


How reproducible:
100%

Steps to Reproduce:
1. Log in as a user that has cluster-admin role bound
2. # curl -k -XGET -H "Authorization: Bearer `oc whoami -t`" -H "Content-Type: application/json" https://172.30.80.65:5000/v2/_catalog -v

Actual results:
HTTP/1.1 400 Bad Request

Expected results:
List of all images. 


Additional info:




Logs from registry 

time="2017-07-27T17:28:07.717979562Z" level=debug msg="authorizing request" go.version=go1.7.6 http.request.contenttype="application/json" http.request.host="172.30.80.65:5000" http.request.id=9184b4f5-b3a1-488d-8e50-94c831d78fa8 http.request.method=GET http.request.remoteaddr="10.131.0.1:55906" http.request.uri="/v2/_catalog" http.request.useragent="curl/7.29.0" instance.id=a0c1e404-40f8-47d8-8a42-fba22e663cac 
time="2017-07-27T17:28:07.718118279Z" level=debug msg="Origin auth: checking for access to registry:catalog:*" go.version=go1.7.6 http.request.contenttype="application/json" http.request.host="172.30.80.65:5000" http.request.id=9184b4f5-b3a1-488d-8e50-94c831d78fa8 http.request.method=GET http.request.remoteaddr="10.131.0.1:55906" http.request.uri="/v2/_catalog" http.request.useragent="curl/7.29.0" instance.id=a0c1e404-40f8-47d8-8a42-fba22e663cac 
time="2017-07-27T17:28:07.718145599Z" level=error msg="error checking authorization: unsupported resource" go.version=go1.7.6 http.request.contenttype="application/json" http.request.host="172.30.80.65:5000" http.request.id=9184b4f5-b3a1-488d-8e50-94c831d78fa8 http.request.method=GET http.request.remoteaddr="10.131.0.1:55906" http.request.uri="/v2/_catalog" http.request.useragent="curl/7.29.0" instance.id=a0c1e404-40f8-47d8-8a42-fba22e663cac 
time="2017-07-27T17:28:07.718167717Z" level=error msg="error authorizing context: unsupported resource" go.version=go1.7.6 http.request.contenttype="application/json" http.request.host="172.30.80.65:5000" http.request.id=9184b4f5-b3a1-488d-8e50-94c831d78fa8 http.request.method=GET http.request.remoteaddr="10.131.0.1:55906" http.request.uri="/v2/_catalog" http.request.useragent="curl/7.29.0" instance.id=a0c1e404-40f8-47d8-8a42-fba22e663cac
Comment 1 Paul Weil 2017-07-27 18:02:43 UTC 
The /v2/_catalog endpoint is not implemented in the OpenShift integrated registry.  We are tracking this feature in trello: https://trello.com/c/AZINw5qI/964-8-registry-implement-catalog-api-call 

Please note that the catalog api specification allows a registry to fully control the output of the response so implementation is registry specific: https://docs.docker.com/registry/spec/api/#listing-repositories.

An alternative here would be listing the imagestreams or, if you're trying to search, oc new-app --search may be an option:

--search=false: Search all templates, image streams, and Docker images that match the arguments provided.