-
Bug
-
Resolution: Done-Errata
-
Normal
-
None
-
4.20.0
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
When using a disconnected environment it's not possible to pull images from mirror repos, after a ClusterImagePolicy is created.
Version-Release number of selected component (if applicable):
4.20.0
How reproducible:
Create a disconnected environment with a ClusterImagePolicy, try to pull an image from original/main repo, signature is going to be validated and image is pulled successfully. After this, try to pull the same image from mirror repo. Signature is going to error out and image is not going to be pulled.
Pre-requirements (mirroring image)
1. Change local /etc/containers/registries.d to accept sigstore attachments 2. Execute skopeo copy to copy the image + signature 3. Execute skopeo inspect to verify that the image + signature were copied 4. (Additional) Execute cosign verify to double-check that signature was stored All these steps are in the file "mirror_execution.txt"
Steps to Reproduce:
1. Enable featureGate TechPreviewNoUpgrade 2. Create a ContainerRuntimeConfig and ImageTagMirrorSet CRs 3. Create a ClusterImagePolicy for the Original and Mirror Repos "clusterImagePolicy_disconnected.yaml" 4. Create a pod pulling the image from mirror repo, an SignatureValidationError will happen "d_log1.txt", "success_fail.png" (mirror repo pod is on the left side) 5. Create a pod pulling the image from main/original repo, image is going to be pulled successfully "d_log2.txt", "success_fail.png" (original repo pod is on the right side)
Actual results:
Mirror repo image fails to be created due to a SignatureValidationError, even after checking with skopeo and cosign that the signature is in there, copied (pre-requirements steps).
Expected results:
Signature should be validated successfully.
Additional info:
Step-by-step to create a disconnected environment here.
- relates to
-
OCPNODE-3513 post-merge testing: ClusterImagePolicy and ImagePolicy to v1
-
- Closed
-