openshift / openshift/origin

Cannot create an Image Steam with import-image from private registry (ignores secret).

Open
#27,952 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

lifecycle/frozen
Dominant language
Go
Stars
8.7k
Forks
4.8k
Avg merge
4d 10h
Merged PRs (30d)
53

Description

Trying to create an Image-Stream linked to an image held within a private registry. The registry is contained within IBM's Cloud based container registry (uk.icr.io). I have been able to create an image pull secret, and used this successfully to deploy the image onto the cluster, as a container. Wanted to create via the image-stream a mechanism to re-deploy the container when the image changes in the registry. However when I try and create the Image-Stream resource via the command line its fails due to not being authenticated. i.e. It's not managing to find the correct image-pull secret that works for this registry.
I have ready a number of suggestions, including naming the pull-secret the same name as the registry (still fails), adding the registry to the global pull-secret default (fails). Adding the pull-secret to the default, builder etc services accounts.
But so far nothing has managed to get a working Image-Stream.

Command Utilised:

$ oc import-image bowi:travis-ci --from=uk.icr.io/boaa-uk/bowi:travis-ci --confirm --scheduled
error: tag travis-ci failed: Internal error occurred: uk.icr.io/boaa-uk/bowi:travis-ci: denied: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied
imagestream.image.openshift.io/bowi imported with errors

Name:			bowi
Namespace:		boaas1-dev
Created:		Less than a second ago
Labels:			<none>
Annotations:		openshift.io/image.dockerRepositoryCheck=2023-05-25T13:02:54Z
Image Repository:	image-registry.openshift-image-registry.svc:5000/boaas1-dev/bowi
Image Lookup:		local=false
Unique Images:		0
Tags:			1

travis-ci
  updates automatically from registry uk.icr.io/boaa-uk/bowi:travis-ci

  ! error: Import failed (InternalError): Internal error occurred: uk.icr.io/boaa-uk/bowi:travis-ci: denied: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied
      Less than a second ago

I have also tried the --all flag, and --insecure flag, also no success.

I have read issues #17238, #18449, #20084, #19762 and #9584
But cannot see any help, and no secondary authentication host for the IBM Cloud Container Registry.

Looking at the number of people who have issues creating Image-Streams with the import-image command, it could be a recommendation / suggestion to add the capability of a pull-image secret flag to the command, allowing users to attach a particular pull-secret to the command.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported oc import-image bowi:travis-ci --from=uk.icr.io/boaa-uk/bowi:travis-ci --confirm --scheduled command and trace how image import credentials are selected. Compare this path with the working image-pull-secret deployment behavior; done means a scheduled import from the private registry authenticates successfully using the intended secret.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
cli, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.