Bug 2054787
| Summary: | SRO controller goes to CrashLoopBackOff status when the pull-secret does not have the correct permissions | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Dahir Osman <dosman> |
| Component: | Special Resource Operator | Assignee: | Pablo Acevedo <pacevedo> |
| Status: | CLOSED ERRATA | QA Contact: | Udi Kalifon <ukalifon> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 4.9 | ||
| Target Milestone: | --- | ||
| Target Release: | 4.11.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-08-10 10:49:51 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Verified. I see this error in the build pod: STEP 1/22: FROM quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8705564ee52c5b655529860687f73db78daef4eaa54f5fdd3160cfbfc4aac438 Trying to pull quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8705564ee52c5b655529860687f73db78daef4eaa54f5fdd3160cfbfc4aac438... error: build error: error creating build container: initializing source docker://quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:8705564ee52c5b655529860687f73db78daef4eaa54f5fdd3160cfbfc4aac438: reading manifest sha256:8705564ee52c5b655529860687f73db78daef4eaa54f5fdd3160cfbfc4aac438 in quay.io/openshift-release-dev/ocp-v4.0-art-dev: unauthorized: access to the requested resource is not authorized Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: OpenShift Container Platform 4.11.0 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:5069 |
Description of problem: If one's quay.io credentials do not have correct permissions to pull the driver toolkit image, the SRO controller goes to a CrashLoopBackOff status. How reproducible: 100% Steps to Reproduce: 1. Deploy SRO from the 4.9 channel 2. Set the quay.io pull secret to one that does not have permissions to pull the DTK Images. 3. Apply the simple-kmod SR Actual results: 2022-02-15T17:00:27.863Z INFO filter CREATE IsSpecialResource (reflect) {"Name": "simple-kmod", "Type": "*v1beta1.SpecialResource"} 2022-02-15T17:00:27.863Z INFO preamble Controller Request {"Name": "simple-kmod", "Namespace": ""} 2022-02-15T17:00:27.867Z INFO cache Nodes cached {"name": "cnfde9.ptp.lab.eng.bos.redhat.com"} 2022-02-15T17:00:27.867Z INFO cache Node list: {"length": 1} 2022-02-15T17:00:27.867Z INFO cache Nodes {"num": 1} 2022-02-15T17:00:27.872Z INFO upgrade History {"entry": "quay.io/openshift-release-dev/ocp-release@sha256:5c55be02e32e688ec5a404858a08cf533ba15b50b6f0e028089635b47db5866e"} 2022-02-15T17:00:30.298Z INFO warning OnError: Cannot extract manifest: GET https://quay.io/v2/openshift-release-dev/ocp-v4.0-art-dev/manifests/sha256:65369b6ccff0f3dcdaa8685ce4d765b8eba0438a506dad5d4221770a6ac1960a: UNAUTHORIZED: access to the requested resource is not a uthorized; map[] 2022-02-15T17:00:30.298Z INFO exit OnError: upgrade.DriverToolkitVersion[upgrade.go:170] Cannot extract last layer for DTK from: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:65369b6ccff0f3dcdaa8685ce4d765b8eba0438a506dad5d4221770a6ac1960a Expected results: A valid BuildConfig Additional info: There is an typo where the LastLayer function returns a 'nil' error where it should have returned the err. This causes the calling function to think there was no error and de-reference the nil result. https://github.com/openshift-psap/special-resource-operator/blob/master/pkg/registry/registry.go#L103 Patch to fix: diff --git a/pkg/registry/registry.go b/pkg/registry/registry.go index d937e663..2acfe305 100644 --- a/pkg/registry/registry.go +++ b/pkg/registry/registry.go @@ -101,7 +101,7 @@ func (r *registry) LastLayer(entry string) (v1.Layer, error) { manifest, err := crane.Manifest(entry, options) if err != nil { warn.OnError(fmt.Errorf("cannot extract manifest: %v", err)) - return nil, nil + return nil, err } release := unstructured.Unstructured{}