Bug 2058044 - operator-sdk 1.8-ocp: scorecard impacted by docker rate limit; switch to using ubi instead of busybox
Summary: operator-sdk 1.8-ocp: scorecard impacted by docker rate limit; switch to usin...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Operator SDK
Version: 4.8
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
: 4.8.z
Assignee: Jesus M. Rodriguez
QA Contact: xzha
URL:
Whiteboard:
Depends On: 2064408
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-02-24 11:02 UTC by diflores
Modified: 2022-10-11 12:45 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2064408 (view as bug list)
Environment:
Last Closed: 2022-04-27 11:46:15 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift ocp-release-operator-sdk pull 221 0 None Merged Bug 2058044: use ubi instead of busybox for untar image 2022-04-13 15:34:27 UTC
Red Hat Product Errata RHBA-2022:1427 0 None None None 2022-04-27 11:46:26 UTC

Description diflores 2022-02-24 11:02:14 UTC
Description of problem:
operator-sdk version 1.8-ocp does not contain option to --untar-image and --storage-image that is harcoded to docker.io/busybox
CU would like to override this setting and be able to use image from private repository instead of pulling from docker.io

Version-Release number of selected component (if applicable):
OCP 4.8
operator-sdk 1-8-ocp

How reproducible:
Pulling an image from docker.io fails with You have reached your pull rate limit

Steps to Reproduce:
1. operator-sdk scorecard <bundle-dir> -o text --selector=suite=olm -w 600 -x
2. scorecard pod events log:

Failed to pull image "docker.io/busybox:1.33.0": rpc error: code = Unknown desc = Error reading manifest 1.33.0 in docker.io/library/busybox: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit

Actual results:


Expected results:
Use scorecard without the need to pull images from docker.io to avoid pull rate limit issue

Additional info:

Comment 2 Jesus M. Rodriguez 2022-03-10 20:58:48 UTC
@diflores I believe we can easily add the --untar-image flag. I don't think storage-image is viable for 1.8-ocp since that is a feature that was not ready for this release of OCP.

Comment 3 diflores 2022-03-11 09:52:09 UTC
@jesusr ack --untar-image flag is of benefit for CU on 1.8-ocp

Comment 4 Jesus M. Rodriguez 2022-03-15 19:10:28 UTC
So the final solution for this bug was to use UBI as we did in a newer release of operator-sdk. Adding a new flag is effectively adding a new feature which for such an old release did not make sense. In OCP 4.10 with operator-sdk 1.16-ocp there is a flag that can solve this if you still have a problem.

Comment 6 Jesus M. Rodriguez 2022-04-07 02:47:26 UTC
this is currently blocked by a repo configuration that is causing e2e tests to fail. A PR to fix the test infrastructure has been posted. https://github.com/openshift/release/pull/27626

And it is also waiting on the 4.9 bugzilla to merge first.

Comment 7 xzha 2022-04-14 01:10:14 UTC
verify:
zhaoxia@xzha-mac memcached-operator % ./operator-sdk version
operator-sdk version: "v1.8.2-ocp", commit: "07ddfb76fa3341f7bc4a891fbf0e9b5713c33737", kubernetes version: "v1.20.2", go version: "go1.17.6", GOOS: "darwin", GOARCH: "amd64"

zhaoxia@xzha-mac memcached-operator % ./operator-sdk scorecard ./bundle -o text --selector=suite=olm -w 600s -x
--------------------------------------------------------------------------------
Image:      quay.io/operator-framework/scorecard-test:v1.10.1
Entrypoint: [scorecard-test olm-bundle-validation]
Labels:
	"suite":"olm"
	"test":"olm-bundle-validation-test"
....

zhaoxia@xzha-mac memcached-operator % oc get pod
NAME                  READY   STATUS      RESTARTS   AGE
scorecard-test-fdm2   0/1     Completed   0          2m15s
scorecard-test-lk85   0/1     Completed   0          2m15s
scorecard-test-m4bk   0/1     Completed   0          2m15s
scorecard-test-tbdx   0/1     Completed   0          2m15s
scorecard-test-xql6   0/1     Completed   0          2m15s

zhaoxia@xzha-mac memcached-operator % oc get pod scorecard-test-xql6 -o yaml
apiVersion: v1
kind: Pod
...
  initContainers:
  - args:
    - tar
    - xvzf
    - /scorecard/bundle.tar.gz
    - -C
    - /scorecard-bundle
    image: registry.access.redhat.com/ubi8/ubi:8.4
    imagePullPolicy: IfNotPresent
    name: scorecard-untar
...

zhaoxia@xzha-mac memcached-operator % oc get events | grep "Pulling image"  
2m38s       Normal   Pulling          pod/scorecard-test-fdm2   Pulling image "registry.access.redhat.com/ubi8/ubi:8.4"
2m9s        Normal   Pulling          pod/scorecard-test-fdm2   Pulling image "quay.io/operator-framework/scorecard-test:v1.10.1"
2m38s       Normal   Pulling          pod/scorecard-test-lk85   Pulling image "registry.access.redhat.com/ubi8/ubi:8.4"
2m8s        Normal   Pulling          pod/scorecard-test-lk85   Pulling image "quay.io/operator-framework/scorecard-test:v1.10.1"
2m38s       Normal   Pulling          pod/scorecard-test-m4bk   Pulling image "registry.access.redhat.com/ubi8/ubi:8.4"
2m9s        Normal   Pulling          pod/scorecard-test-m4bk   Pulling image "quay.io/operator-framework/scorecard-test:v1.10.1"
2m38s       Normal   Pulling          pod/scorecard-test-tbdx   Pulling image "registry.access.redhat.com/ubi8/ubi:8.4"
2m8s        Normal   Pulling          pod/scorecard-test-tbdx   Pulling image "quay.io/operator-framework/scorecard-test:v1.10.1"
2m37s       Normal   Pulling          pod/scorecard-test-xql6   Pulling image "registry.access.redhat.com/ubi8/ubi:8.4"
2m9s        Normal   Pulling          pod/scorecard-test-xql6   Pulling image "quay.io/operator-framework/scorecard-test:v1.10.1"


LGTM, verified.

Comment 10 errata-xmlrpc 2022-04-27 11:46:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.8.39 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1427


Note You need to log in before you can comment on or make changes to this bug.