Bug 1494231 – oc import-image generates x509 error when trying to import an image

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1494231 - oc import-image generates x509 error when trying to import an image

Summary:	oc import-image generates x509 error when trying to import an image

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Image (Show other bugs)
Sub Component:
Version:	3.6.1
Hardware:	x86_64 Linux

Priority	unspecified Severity medium
Target Milestone:	---
Target Release:	3.7.0
Assigned To:	Oleg Bulatov
QA Contact:	Dongbo Yan
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-09-21 14:47 EDT by Rob Cernich
Modified:	2017-11-28 17:12 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Cause: importPolicy.insecure is ignored in `oc import-image <imagestream:tag>` Consequence: re-import from an insecure registry fails because it expects a valid SSL certificate. Fix: when the image stream tag exists, use its importPolicy.insecure Result: re-import succeed
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-11-28 17:12:03 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:3188	normal	SHIPPED_LIVE	Moderate: Red Hat OpenShift Container Platform 3.7 security, bug, and enhancement update	2017-11-28 21:34:54 EST

Groups: None (edit)

Description Rob Cernich 2017-09-21 14:47:42 EDT

Description of problem:


Version-Release number of selected component (if applicable):
OCP 3.6.1.

How reproducible:


Steps to Reproduce:
1. Create an image in an insecure registry
2. Create an image stream, with a tag definition pointing to the image (i.e. tag: from: ...) and importPolicy: { insecure: true }.
3. import the image tag, e.g. oc import-image image:tag.  notice the x509 error.  also notice that the import may have succeeded.
4. Successive imports appear to fail, but setting generation back to 0 sometimes allows the import to succeed.

Actual results:
import fails


Expected results:
import updates the tag


Additional info:

Comment 1 Rob Cernich 2017-09-21 14:49:05 EDT

Forgot to add, the import succeeds if you also add openshift.io/image.insecureRepository: true to the annotations on the image stream.

Comment 4 Ben Parees 2017-10-05 00:02:16 EDT

Alexey has a few blockers already, Oleg can you take a look at this one?

Comment 5 Oleg Bulatov 2017-10-09 08:16:53 EDT

> setting generation back to 0 sometimes allows the import to succeed.

Can you provide the exact path to the generation field? .metadata.generation or .spec.tags.generation?

Comment 6 Rob Cernich 2017-10-09 10:29:02 EDT

.metadata.generation

Comment 8 Oleg Bulatov 2017-10-10 11:29:19 EDT

https://github.com/openshift/origin/pull/16756

Comment 10 Dongbo Yan 2017-10-18 06:15:59 EDT

Verified
# oc version
oc v3.7.0-0.159.0
kubernetes v1.7.6+a08f5eeb62
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://:8443
openshift v3.7.0-0.153.0
kubernetes v1.7.6+a08f5eeb62

cannot reproduce this issue

Comment 14 errata-xmlrpc 2017-11-28 17:12:03 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188

Note You need to log in before you can comment on or make changes to this bug.