Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Cannot create an Image Steam with import-image from private registry (ignores secret). #27952

Open
donovat opened this issue May 30, 2023 · 3 comments
Labels
lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness.

Comments

@donovat
Copy link

donovat commented May 30, 2023

Trying to create an Image-Stream linked to an image held within a private registry. The registry is contained within IBM's Cloud based container registry (uk.icr.io). I have been able to create an image pull secret, and used this successfully to deploy the image onto the cluster, as a container. Wanted to create via the image-stream a mechanism to re-deploy the container when the image changes in the registry. However when I try and create the Image-Stream resource via the command line its fails due to not being authenticated. i.e. It's not managing to find the correct image-pull secret that works for this registry.
I have ready a number of suggestions, including naming the pull-secret the same name as the registry (still fails), adding the registry to the global pull-secret default (fails). Adding the pull-secret to the default, builder etc services accounts.
But so far nothing has managed to get a working Image-Stream.

Command Utilised:

$ oc import-image bowi:travis-ci --from=uk.icr.io/boaa-uk/bowi:travis-ci --confirm --scheduled
error: tag travis-ci failed: Internal error occurred: uk.icr.io/boaa-uk/bowi:travis-ci: denied: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied
imagestream.image.openshift.io/bowi imported with errors

Name:			bowi
Namespace:		boaas1-dev
Created:		Less than a second ago
Labels:			<none>
Annotations:		openshift.io/image.dockerRepositoryCheck=2023-05-25T13:02:54Z
Image Repository:	image-registry.openshift-image-registry.svc:5000/boaas1-dev/bowi
Image Lookup:		local=false
Unique Images:		0
Tags:			1

travis-ci
  updates automatically from registry uk.icr.io/boaa-uk/bowi:travis-ci

  ! error: Import failed (InternalError): Internal error occurred: uk.icr.io/boaa-uk/bowi:travis-ci: denied: You are not authorized to access the specified resource. See https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied
      Less than a second ago

I have also tried the --all flag, and --insecure flag, also no success.

I have read issues #17238, #18449, #20084, #19762 and #9584
But cannot see any help, and no secondary authentication host for the IBM Cloud Container Registry.

Looking at the number of people who have issues creating Image-Streams with the import-image command, it could be a recommendation / suggestion to add the capability of a pull-image secret flag to the command, allowing users to attach a particular pull-secret to the command.

@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 29, 2023
@donovat
Copy link
Author

donovat commented Aug 29, 2023

/remove-lifecycle stale

@openshift-ci openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 29, 2023
@donovat
Copy link
Author

donovat commented Aug 29, 2023

/lifecycle frozen

@openshift-ci openshift-ci bot added the lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. label Aug 29, 2023
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness.
Projects
None yet
Development

No branches or pull requests

2 participants