Bug 1560716

Description of problem:
Image pull secrets not being read by service accounts properly. This results in an inability for serviceaccounts to pull images from other projects other than the openshift project.


"rpc error: code = 2 desc = Error: image project1/example:v1 not found"

docker logs show:
OpenShift access denied: User \"system:anonymous\" cannot get imagestreams
error authorizing context: access denied

Version-Release number of selected component (if applicable):
3.7

How reproducible:
Confirmed

Steps to Reproduce:
1. Create two projects, "registry" and "prod"
2. Push an image into registry: docker-registry.default.svc:5000/registry/cyrax
3. Grant system:image-pullers role to the service accounts in prod:
# oc adm add-role-to-group system:image-pullers system:serviceaccount:prod -n registry
4. Try to docker pull using their token or oc new-app, both fail
5. Now give them docker pull secret (for a user which has access to both projects):

# oc login -u sektor
# docker login -u sektor -p $(oc whoami -t) https://docker-registry.default.svc:5000
Then pulling from ~/.docker/config.json to create a secret:

# oc secrets new my-secret .dockerconfigjson=config.json 
# oc secrets link builder my-secret 
# oc secrets link default my-secret 
# oc secrets link deployer my-secret 

# oc adm add-role-to-group system:image-pullers system:serviceaccount:prod -n registry

# docker login -u serviceaccount -p $(oc sa get-token deployer) https://docker-registry.default.svc:5000
# docker pull docker-registry.default.svc:5000/registry/cyrax:latest
^that works!

But oc new-app on that or other images in that project fails:
11s        11s         1         cyrax-1-5htvf    Pod                     spec.containers{cyrax}      Warning   Failed                  kubelet, infra-0.sektor.quicklab.example.com   Failed to pull image "docker-registry.default.svc:5000/registry/cyrax:latest": rpc error: code = 2 desc = Error: image registry/cyrax:latest not found


Additional info:
It appears this is reported here as well: https://github.com/openshift/origin/issues/17523