Multiple pullSecrets for same registry does not work
- Dominant language
- Go
- Stars
- 6.1k
- Forks
- 1.2k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 2
Description
When having multiple pullSecrets for the same registry in the same Service Account, Knative fails to detect the correct set of credentials and fails at the first. The [kubelet has a loop build in that allows this setup](https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L59-L76).
## What version of Knative?
1.1.0
## Expected Behavior
To attempt each imagePullSecret in the associated Service Account when resolving the tag of an image and continue deploying the revision.
## Actual Behavior
It fails at the first pull secret, from which the credentials do not match and does not attempt the next pull secret.
## Steps to Reproduce the Problem
1. Create 2 `kubernetes.io/dockerconfigjson`-secrets for the same registry with different username/password.
2. Create a Service Account with both secrets.
3. Create a kservice with the above created Service Account, and include 2 containers in the pod whereby:
- The first container should only be allowed to be pulled from the first set of credentials (used in the first secret).
- The second container should only be allowed to be pulled from the registry using the second set of credentials (used in the second secret).
## Workaround
We disabled tag resolving by setting `registries-skipping-tag-resolving` in `config-deployment` to our registry.
Contributor guide
Assessment
This issue has not been assessed yet.