Cannot create an Image Steam with import-image from private registry (ignores secret).
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 8.7k
- Forks
- 4.8k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 53
Description
Trying to create an Image-Stream linked to an image held within a private registry. The registry is contained within IBM's Cloud based container registry (uk.icr.io). I have been able to create an image pull secret, and used this successfully to deploy the image onto the cluster, as a container. Wanted to create via the image-stream a mechanism to re-deploy the container when the image changes in the registry. However when I try and create the Image-Stream resource via the command line its fails due to not being authenticated. i.e. It's not managing to find the correct image-pull secret that works for this registry.
I have ready a number of suggestions, including naming the pull-secret the same name as the registry (still fails), adding the registry to the global pull-secret default (fails). Adding the pull-secret to the default, builder etc services accounts.
But so far nothing has managed to get a working Image-Stream.
Command Utilised:
$ oc import-image bowi:travis-ci --from=uk.icr.io/boaa-uk/bowi:travis-ci --confirm --scheduled
error: tag travis-ci failed: Internal error occurred: uk.icr.io/boaa-uk/bowi:travis-ci: denied: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied
imagestream.image.openshift.io/bowi imported with errors
Name: bowi
Namespace: boaas1-dev
Created: Less than a second ago
Labels: <none>
Annotations: openshift.io/image.dockerRepositoryCheck=2023-05-25T13:02:54Z
Image Repository: image-registry.openshift-image-registry.svc:5000/boaas1-dev/bowi
Image Lookup: local=false
Unique Images: 0
Tags: 1
travis-ci
updates automatically from registry uk.icr.io/boaa-uk/bowi:travis-ci
! error: Import failed (InternalError): Internal error occurred: uk.icr.io/boaa-uk/bowi:travis-ci: denied: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied
Less than a second ago
I have also tried the --all flag, and --insecure flag, also no success.
I have read issues #17238, #18449, #20084, #19762 and #9584
But cannot see any help, and no secondary authentication host for the IBM Cloud Container Registry.
Looking at the number of people who have issues creating Image-Streams with the import-image command, it could be a recommendation / suggestion to add the capability of a pull-image secret flag to the command, allowing users to attach a particular pull-secret to the command.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported oc import-image bowi:travis-ci --from=uk.icr.io/boaa-uk/bowi:travis-ci --confirm --scheduled command and trace how image import credentials are selected. Compare this path with the working image-pull-secret deployment behavior; done means a scheduled import from the private registry authenticates successfully using the intended secret.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- cli, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100