Description of problem:

Node Problem Detector try to pull images from registry.access.redhat.com even when it's blocked on /etc/containers/registries.conf and /etc/sysconfig/docker on an Openshift installation using only internal registry through oreg_url

Version-Release number of selected component (if applicable):

v3.10.72

How reproducible:
Install Openshift using an external registry then use playbook to deploy node-problem-detector.

You will see a pull image error on each pod once deployed

NAME                          READY     STATUS             RESTARTS   AGE
node-problem-detector-dqtwn   0/1       ImagePullBackOff   0          19h
node-problem-detector-phpw8   0/1       ImagePullBackOff   0          19h
node-problem-detector-qh249   0/1       ImagePullBackOff   0          19h
node-problem-detector-t5b6t   0/1       ImagePullBackOff   0          19h
node-problem-detector-t5p4b   0/1       ImagePullBackOff   0          19h


Steps to Reproduce:
1. Install Openshift using external registry:
# Registries
my_registry=registry.mytest.internal
oreg_url={{ my_registry }}/openshift3/ose-${component}:${version}
openshift_examples_modify_imagestreams=true

In addition, configure the following:
#Docker
openshift_docker_additional_registries={{ my_registry }}
openshift_docker_blocked_registries=["registry.access.redhat.com","docker.io"]
openshift_docker_disable_push_dockerhub=True

2. Ensure /var/containers/registries.conf have the following format:
[registries.block]
registries = ['docker.io','registry.access.redhat.com']

Also ensure /var/sysconfig/docker
BLOCK_REGISTRY='--block-registry registry.access.redhat.com --block-registry docker.io'

3. Once installed, using the same inventory, add the node-problem-detector section:
# Node Problem Detector
openshift_node_problem_detector_install=true

3. ps -ef | grep docker and look for the following:
--block-registry docker.io --block-registry registry.access.redhat.com

Actual results:
problem detector pods will be unable to be pulled because they're pointing to the wrong registry even when it should be blocked

Normal   BackOff  25m (x5130 over 20h)  kubelet, hostname1  Back-off pulling image "registry.access.redhat.com/openshift3/ose-node-problem-detector:v3.10.72"
Warning  Failed   18s (x5240 over 20h)  kubelet, hostname1  Error: ImagePullBackOff

Expected results:
Openshift will be able to understand the external registries has been blocked and look for the problem detector image into the internal ones.


Additional info:
After take a look deeper into the playbooks I found the following:
/usr/share/ansible/openshift-ansible/roles/openshift_node_problem_detector/defaults/main.yaml

penshift_node_problem_detector_image_dict:
  origin:
    prefix: "docker.io/openshift/"
    version: "{{ openshift_image_tag }}"
  openshift-enterprise:
    prefix: "registry.access.redhat.com/openshift3/ose-"
    version: "{{ openshift_image_tag }}"

openshift_node_problem_detector_image_prefix: "{{ openshift_node_problem_detector_image_dict[openshift_deployment_type]['prefix'] }}"                                                                          
openshift_node_problem_detector_image_version: "{{ openshift_node_problem_detector_image_dict[openshift_deployment_type]['version'] }}"

As you can see there, there's a hardcoded registry into the main.yml file, maybe it should be changed to oreg_url or even l_osm_registry_url


Thank you.
Regards,