Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Wrong error message when trying to import from private registry with TLS certificate which is NOT signed by a trusted CA Version-Release number of selected component (if applicable): 4.9 How reproducible: 100% Steps to Reproduce: 1. Create and add a docker image and upload it to the private registry. 2. Ensure your registry TLS certificate, which is NOT signed by a trusted CA, resides in a file named 'my-registry.crt' 3. Create a ConfigMap containing all certificates required to trust the registry. e.g 'kubectl create configmap my-registry-certs --from-file=my-registry.crt' 4. Import the image from the registry - Import should succeed 5. Remove the certificate previously added to the config map 6. Attempt to import the image again - Import should fail Actual results: Containers: importer: ........ Args: -v=1 State: Waiting Reason: CrashLoopBackOff Last State: Terminated Reason: Error Message: /github.com/containers/image/v5/docker/docker_client.go:759 github.com/containers/image/v5/docker.(*dockerClient).makeRequest /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_client.go:421 github.com/containers/image/v5/docker.(*dockerImageSource).fetchManifest /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:189 github.com/containers/image/v5/docker.(*dockerImageSource).ensureManifestIsLoaded /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:223 github.com/containers/image/v5/docker.newImageSourceAttempt /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:127 github.com/containers/image/v5/docker.newImageSource /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_image_src.go:69 github.com/containers/image/v5/docker.dockerReference.NewImageSource /remote-source/app/vendor/github.com/containers/image/v5/docker/docker_transport.go:144 kubevirt.io/containerized-data-importer/pkg/importer.readImageSource /remote-source/app/pkg/importer/transport.go:73 kubevirt.io/containerized-data-importer/pkg/importer.copyRegistryImage /remote-source/app/pkg/importer/transport.go:179 kubevirt.io/containerized-data-importer/pkg/importer.CopyRegistryImage /remote-source/app/pkg/importer/transport.go:227 kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer /remote-source/app/pkg/importer/registry-datasource.go:83 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData /remote-source/app/pkg/importer/data-processor.go:165 main.main /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit /usr/lib/golang/src/runtime/asm_amd64.s:1374 Could not create image reference kubevirt.io/containerized-data-importer/pkg/importer.readImageSource /remote-source/app/pkg/importer/transport.go:76 kubevirt.io/containerized-data-importer/pkg/importer.copyRegistryImage /remote-source/app/pkg/importer/transport.go:179 kubevirt.io/containerized-data-importer/pkg/importer.CopyRegistryImage /remote-source/app/pkg/importer/transport.go:227 kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer /remote-source/app/pkg/importer/registry-datasource.go:83 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData /remote-source/app/pkg/importer/data-processor.go:165 main.main /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit /usr/lib/golang/src/runtime/asm_amd64.s:1374 Failed to read registry image kubevirt.io/containerized-data-importer/pkg/importer.(*RegistryDataSource).Transfer /remote-source/app/pkg/importer/registry-datasource.go:85 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause /remote-source/app/pkg/importer/data-processor.go:190 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData /remote-source/app/pkg/importer/data-processor.go:165 main.main /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit /usr/lib/golang/src/runtime/asm_amd64.s:1374 Unable to transfer source data to scratch space kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessDataWithPause /remote-source/app/pkg/importer/data-processor.go:195 kubevirt.io/containerized-data-importer/pkg/importer.(*DataProcessor).ProcessData /remote-source/app/pkg/importer/data-processor.go:165 main.main /remote-source/app/cmd/cdi-importer/importer.go:189 runtime.main /usr/lib/golang/src/runtime/proc.go:204 runtime.goexit /usr/lib/golang/src/runtime/asm_amd64.s:1374 Exit Code: 1 Started: Wed, 01 Sep 2021 17:38:21 +0000 Finished: Wed, 01 Sep 2021 17:38:22 +0000 Ready: False Expected results: Containers: importer: ........ Args: -v=1 State: Terminated Reason: Error Message: Unable to process data: Get "URL:8443/v2/": x509: certificate signed by unknown authority Exit Code: 1 Started: Wed, 01 Sep 2021 17:39:38 +0000 Finished: Wed, 01 Sep 2021 17:39:39 +0000 Last State: Terminated Reason: Error Message: Unable to process data: Get "URL:8443/v2/": x509: certificate signed by unknown authority Exit Code: 1 Started: Wed, 01 Sep 2021 17:39:12 +0000 Finished: Wed, 01 Sep 2021 17:39:13 +0000 Ready: False Additional info: Use this command to describe the importing pod and see the error message: oc describe pod -n cdi-import-test-import-registr
Shelly, could you please take a look?
Verified on CNV v4.9.3-12, virt-cdi-controller v4.9.3-4 Verified on CNV-v4.10.0-617, virt-cdi-operator v4.10.0-81 $ oc describe pod -n cdi-import-test-import-registr Name: importer-cnv-2352 Namespace: cdi-import-test-import-registr Containers: importer: State: Terminated Reason: Error Message: Unable to process data: Unable to transfer source data to scratch space: Failed to read registry image: Could not create image reference: error pinging docker registry URL:8443: Get "URL:8443/v2/": x509: certificate signed by unknown authority Exit Code: 1 Started: Wed, 26 Jan 2022 19:17:48 +0000 Finished: Wed, 26 Jan 2022 19:17:50 +0000 Last State: Terminated Reason: Error Message: Unable to process data: Unable to transfer source data to scratch space: Failed to read registry image: Could not create image reference: error pinging docker registry URL:8443: Get "URL:8443/v2/": x509: certificate signed by unknown authority Exit Code: 1 Started: Wed, 26 Jan 2022 19:17:41 +0000 Finished: Wed, 26 Jan 2022 19:17:47 +0000 Ready: False Restart Count: 1
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Virtualization 4.9.3 Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:0641