Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-1899

MCO erroneously allows tagged pull spec, should only allow digest

XMLWordPrintable

    • Low
    • None
    • Rejected
    • False
    • Hide

      None

      Show
      None

      Description of problem:

      When we create a new MC deploying a new osImage the worker pool becomes degraded.

      Version-Release number of selected component (if applicable):

      4.12.0-0.nightly-2022-09-28-204419

      How reproducible:

      Always

      Steps to Reproduce:

      1. Get the base osImage
      
      $ oc adm release info --pullspecs 2> /dev/null| grep rhel
         rhel-coreos-8                                  quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1fb581c9bb638471be0f647d5ced2a16dcbc23c6923398066baf62cb6c7149c6
      
      2. Use the base osImage to create a new one using this docker file
      
      FROM base_image_found_in_step_1
      
       RUN mkdir /etc/tc_54085 && chmod 3770 /etc/tc_54085 && ostree container commit
      
      
       RUN echo 'Test case 54085 test file' > /etc/tc54085.txt && 
      chmod 5400 /etc/tc54085.txt && ostree container commit
      
       
      RUN echo 'echo "Hello world"' > /usr/bin/tc54085_helloworld 
      && chmod 5770 /usr/bin/tc54085_helloworld && ostree 
      container commit
      
       RUN cd /etc/yum.repos.d/ && curl -LO https://pkgs.tailscale.com/stable/fedora/tailscale.repo && \
           rpm-ostree install tailscale && rpm-ostree cleanup -m && \
           systemctl enable tailscaled && \
           ostree container commit
      
      3.Push the resulting image to a docker registry
      
      4. Create a new MC to deploy this osImage
      
      cat <<EOF | oc create -f -
       kind: MachineConfig
       apiVersion: machineconfiguration.openshift.io/v1
       metadata:
         labels:
           machineconfiguration.openshift.io/role: "worker"
         name: "tc-54085-new-os-image"
       spec:
         osImageURL: "quay.io/sregidor/sregidor-os:mco_layering" << USE YOUR IMAGE HERE
       EOF

      Actual results:

      The worker pool becomes degraded:
      
      $ oc get mcp worker
      NAME     CONFIG                                             UPDATED   UPDATING   DEGRADED   MACHINECOUNT   READYMACHINECOUNT   UPDATEDMACHINECOUNT   DEGRADEDMACHINECOUNT   AGE
      worker   rendered-worker-24231b9ff533afe05c7ad3de11b52db9   False     True       True       3              2                   2                     1                      124m
      
      $ oc get mcp worker -o yaml
      ...
        - lastTransitionTime: "2022-09-30T10:34:15Z"
          message: 'Node ip-10-0-157-128.us-east-2.compute.internal is reporting: "failed
            to update OS to quay.io/mcoqe/layering : error running rpm-ostree rebase --experimental
            ostree-unverified-registry:quay.io/mcoqe/layering: \x1b[0m\x1b[31merror: \x1b[0mOld
            and new refs are equal: ostree-unverified-registry:quay.io/mcoqe/layering\n:
            exit status 1"'
          reason: 1 nodes are reporting degraded status on sync
          status: "True"
          type: NodeDegraded
      

      Expected results:

      The MC should apply the new osImage without problems and the worker pool should never be degraded.

      Additional info:

      The cluster is an IPI AWS cluster with OVN 

       

       

              dkhater@redhat.com Dalia Khater
              sregidor@redhat.com Sergio Regidor de la Rosa
              Sergio Regidor de la Rosa Sergio Regidor de la Rosa
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: