Bug 2000661 - Wrong error message when importing from private registry with TLS certificate which is NOT signed by a trusted CA
Summary: Wrong error message when importing from private registry with TLS certificate...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Container Native Virtualization (CNV)
Classification: Red Hat
Component: Storage
Version: 4.9.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.9.3
Assignee: skagan
QA Contact: Jenia Peimer
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-09-02 16:22 UTC by Jenia Peimer
Modified: 2022-02-22 21:55 UTC (History)
4 users (show)

Fixed In Version: CNV v4.9.3-12, virt-cdi-controller v4.9.3-4, CNV-v4.10.0-617, virt-cdi-operator v4.10.0-81
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-02-22 21:54:59 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github kubevirt containerized-data-importer pull 2111 0 None Merged Fix error message to be without trace 2022-01-23 08:51:25 UTC
Github kubevirt containerized-data-importer pull 2123 0 None Merged [release-v1.38] Fix error message to be without trace 2022-01-25 13:02:35 UTC
Github kubevirt containerized-data-importer pull 2124 0 None Merged [release-v1.43] Fix error message to be without trace 2022-01-25 13:02:38 UTC
Red Hat Product Errata RHBA-2022:0641 0 None None None 2022-02-22 21:55:14 UTC

Description Jenia Peimer 2021-09-02 16:22:33 UTC
Description of problem:
Wrong error message when trying to import from private registry with TLS certificate which is NOT signed by a trusted CA

Version-Release number of selected component (if applicable):
4.9

How reproducible: 100%

Steps to Reproduce:
1. Create and add a docker image and upload it to the private registry.
2. Ensure your registry TLS certificate, which is NOT signed by a trusted CA, resides in a file named 'my-registry.crt'
3. Create a ConfigMap containing all certificates required to trust the registry. e.g 'kubectl create configmap my-registry-certs --from-file=my-registry.crt'
4. Import the image from the registry - Import should succeed
5. Remove the certificate previously added to the config map
6. Attempt to import the image again - Import should fail

Actual results:

	Containers:
	  importer:
	    ........
	    Args:
	      -v=1
	    State:          Waiting
	      Reason:       CrashLoopBackOff
	    Last State:     Terminated
	      Reason:       Error
	      Message:      /github.com/containers/image/v5/docker/docker_client.go:759 github.com/containers/image/v5/docker.(*dockerClient).makeRequest   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_client.go:421 github.com/containers/image/v5/docker.(*dockerImageSource).fetchManifest   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:189 github.com/containers/image/v5/docker.(*dockerImageSource).ensureManifestIsLoaded   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:223 github.com/containers/image/v5/docker.newImageSourceAttempt   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:127 github.com/containers/image/v5/docker.newImageSource   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:69 github.com/containers/image/v5/docker.dockerReference.NewImageSource   /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_transport.go:144 kubevirt.io/containerized-data-importer/pkg/importer.readImageSource   /remote-source/app/pkg/importer/transport.go:73 kubevirt.io/containerized-data-importer/pkg/importer.copyRegistryImage   /remote-source/app/pkg/importer/transport.go:179 kubevirt.io/containerized-data-importer/pkg/importer.CopyRegistryImage   /remote-source/app/pkg/importer/transport.go:227 kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer   /remote-source/app/pkg/importer/registry-datasource.go:83 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374 Could not create image reference kubevirt.io/containerized-data-importer/pkg/importer.readImageSource   /remote-source/app/pkg/importer/transport.go:76 kubevirt.io/containerized-data-importer/pkg/importer.copyRegistryImage   /remote-source/app/pkg/importer/transport.go:179 kubevirt.io/containerized-data-importer/pkg/importer.CopyRegistryImage   /remote-source/app/pkg/importer/transport.go:227 kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer   /remote-source/app/pkg/importer/registry-datasource.go:83 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374 Failed to read registry image kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer   /remote-source/app/pkg/importer/registry-datasource.go:85 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374 Unable to transfer source data to scratch space kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause   /remote-source/app/pkg/importer/data-processor.go:195 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData   /remote-source/app/pkg/importer/data-processor.go:165 main.main   /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main   /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit   /usr/lib/golang/src/runtime/asm_amd64.s:1374
	      Exit Code:    1
	      Started:      Wed, 01 Sep 2021 17:38:21 +0000
	      Finished:     Wed, 01 Sep 2021 17:38:22 +0000
	    Ready:          False


Expected results:

	Containers:
	  importer:
	    ........
	    Args:
	      -v=1
	    State:          Terminated
	      Reason:       Error
	      Message:      Unable to process data: Get "URL:8443/v2/": x509: certificate signed by unknown authority
	      Exit Code:    1
	      Started:      Wed, 01 Sep 2021 17:39:38 +0000
	      Finished:     Wed, 01 Sep 2021 17:39:39 +0000
	    Last State:     Terminated
	      Reason:       Error
	      Message:      Unable to process data: Get "URL:8443/v2/": x509: certificate signed by unknown authority
	      Exit Code:    1
	      Started:      Wed, 01 Sep 2021 17:39:12 +0000
	      Finished:     Wed, 01 Sep 2021 17:39:13 +0000
	    Ready:          False


Additional info:
Use this command to describe the importing pod and see the error message:
oc describe pod -n cdi-import-test-import-registr

Comment 1 Yan Du 2021-12-15 13:29:25 UTC
Shelly, could you please take a look?

Comment 2 Jenia Peimer 2022-01-28 02:51:01 UTC
Verified on CNV v4.9.3-12, virt-cdi-controller v4.9.3-4
Verified on CNV-v4.10.0-617, virt-cdi-operator v4.10.0-81

$ oc describe pod -n cdi-import-test-import-registr
Name:         importer-cnv-2352
Namespace:    cdi-import-test-import-registr
Containers:
  importer:
    State:          Terminated
      Reason:       Error
      Message:      Unable to process data: Unable to transfer source data to scratch space: Failed to read registry image: Could not create image reference: error pinging docker registry URL:8443: Get "URL:8443/v2/": x509: certificate signed by unknown authority
      Exit Code:    1
      Started:      Wed, 26 Jan 2022 19:17:48 +0000
      Finished:     Wed, 26 Jan 2022 19:17:50 +0000
    Last State:     Terminated
      Reason:       Error
      Message:      Unable to process data: Unable to transfer source data to scratch space: Failed to read registry image: Could not create image reference: error pinging docker registry URL:8443: Get "URL:8443/v2/": x509: certificate signed by unknown authority
      Exit Code:    1
      Started:      Wed, 26 Jan 2022 19:17:41 +0000
      Finished:     Wed, 26 Jan 2022 19:17:47 +0000
    Ready:          False
    Restart Count:  1

Comment 9 errata-xmlrpc 2022-02-22 21:54:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Virtualization 4.9.3 Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:0641


Note You need to log in before you can comment on or make changes to this bug.