knative / knative/serving

Multiple pullSecrets for same registry does not work

Open
#13,126 8 comments 0 reactions 1 assignee Claimed by @jwcesign View on GitHub
kind/bug triage/accepted
Dominant language
Go
Stars
6.1k
Forks
1.2k
Avg merge
2d 7h
Merged PRs (30d)
2

Description

When having multiple pullSecrets for the same registry in the same Service Account, Knative fails to detect the correct set of credentials and fails at the first. The [kubelet has a loop build in that allows this setup](https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L59-L76).

## What version of Knative?

1.1.0

## Expected Behavior

To attempt each imagePullSecret in the associated Service Account when resolving the tag of an image and continue deploying the revision.

## Actual Behavior

It fails at the first pull secret, from which the credentials do not match and does not attempt the next pull secret.

## Steps to Reproduce the Problem

1. Create 2 `kubernetes.io/dockerconfigjson`-secrets for the same registry with different username/password.
2. Create a Service Account with both secrets.
3. Create a kservice with the above created Service Account, and include 2 containers in the pod whereby:
- The first container should only be allowed to be pulled from the first set of credentials (used in the first secret).
- The second container should only be allowed to be pulled from the registry using the second set of credentials (used in the second secret).

## Workaround
We disabled tag resolving by setting `registries-skipping-tag-resolving` in `config-deployment` to our registry.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.