Bug 2060610

+++ This bug was initially created as a clone of Bug #2060605 +++

Bug 1902456's [1] seems to have broken access to public images.  Testing in a 4.10.0 cluster:

  $ oc get -o jsonpath='{.status.desired.version}{"\n"}' clusterversion version
  4.10.0

Exposing the registry, per [2]:

  $ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
  $ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

Grant public access to the openshift namespace (do we doc this somewhere):

  $ oc adm policy add-role-to-group system:image-puller system:unauthenticated --namespace openshift
  Warning: Group 'system:unauthenticated' not found
clusterrole.rbac.authorization.k8s.io/system:image-puller added: "system:unauthenticated"
  $ oc adm policy add-role-to-group system:image-puller system:authenticated --namespace openshift
Warning: Group 'system:authenticated' not found
clusterrole.rbac.authorization.k8s.io/system:image-puller added: "system:authenticated"

Try to fetch image metadata:

  $ oc image info --insecure "${HOST}/openshift/tools"
  Unable to connect to the server: no basic auth credentials


For comparison, here is a cluster-bot cluster built from [3] (reverting [1]):

  $ oc get -o jsonpath='{.status.desired.version}{"\n"}' clusterversion version
  4.10.0-0.ci.test-2022-03-03-194357-ci-ln-dmrzjkb-latest
  $ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
  $ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')
  $ oc adm policy add-role-to-group system:image-puller system:unauthenticated --namespace openshift
  $ oc adm policy add-role-to-group system:image-puller system:authenticated --namespace openshift
  $ oc image info --insecure "${HOST}/openshift/tools:latest"
  Name:        default-route-openshift-image-registry.apps.ci-ln-dmrzjkb-72292.origin-ci-int-gce.dev.rhcloud.com/openshift/tools:latest
  Digest:      sha256:3b5588eec3e985d73f246bc80dc618cff889da5ee652863fe750851e3e26dc09
  ...

[1]: https://github.com/openshift/image-registry/pull/291
[2]: https://docs.openshift.com/container-platform/4.9/registry/securing-exposing-registry.html#registry-exposing-default-registry-manually_securing-exposing-registry
[3]: https://github.com/openshift/image-registry/pull/315

--- Additional comment from wking on 2022-03-03 20:34:17 UTC ---

(In reply to W. Trevor King from comment #0)
>   $ oc adm policy add-role-to-group system:image-puller system:authenticated --namespace openshift

This grant is irrelevant for our unauthenticated test, and I get the same '' after rolling it back:

  $ oc adm policy remove-role-from-group system:image-puller system:unauthenticated --namespace openshift
  clusterrole.rbac.authorization.k8s.io/system:image-puller removed: "system:unauthenticated"
  $ oc image info --insecure "${HOST}/openshift/tools"
  Unable to connect to the server: no basic auth credentials

So simple reproducer is:

  oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
  oc adm policy add-role-to-group system:image-puller system:unauthenticated --namespace openshift
  sleep 4  # not sure, must need some time to let the registry operator create the Route
  HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')
  oc image info --insecure "${HOST}/openshift/tools"

And you should see a successful fetch, but instead 4.10.0 gives 'no basic auth credentials'

--- Additional comment from deads on 2022-03-03 20:38:52 UTC ---

Marking blocker+ for 4.10.0.

This bug prevents anonymous image pulls from the internal openshift image-registry.

1. This is a regression from 4.9 behavior.
2. There is no workaround.
3. We have no way of knowing if clusters are impacted before they upgrade
4. image-registry pulls are critical path on containerized workloads.  We don't have data on frequency of anonymous pulls, but we have no reason to believe it is rare.  Many (most?) images are not sensitive.