Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-71195

Azure: image-registry is degraded on environment where allowSharedKeyAccess on storage account is always set to false

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.21, 4.22
    • Image Registry
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Moderate
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      On environment where Azure policy is applied to not allow key-based authentication, and the property "allowSharedKeyAccess" is always set to false, image-registry is degraded with below error when installing cluster on this environment.
      
      =========
        - lastTransitionTime: "2026-01-07T02:29:18Z"
          message: "Progressing: Unable to apply resources: unable to sync storage configuration:
            PUT https://imageregistryredhatdj7xn.blob.core.windows.net/redhatocp0107-c2mtn-image-registry-mnffliavjqgrihtmjxwxjbnityr\nProgressing:
            --------------------------------------------------------------------------------\nProgressing:
            RESPONSE 403: 403 Key based authentication is not permitted on this storage
            account.\nProgressing: ERROR CODE: KeyBasedAuthenticationNotPermitted\nProgressing:
            --------------------------------------------------------------------------------\nProgressing:
            \uFEFF<?xml version=\"1.0\" encoding=\"utf-8\"?><Error><Code>KeyBasedAuthenticationNotPermitted</Code><Message>Key
            based authentication is not permitted on this storage account.\nProgressing:
            RequestId:f0aef142-601e-0017-0297-7f96b6000000\nProgressing: Time:2026-01-07T05:38:20.9886636Z</Message></Error>\nProgressing:
            --------------------------------------------------------------------------------\nProgressing:
            \nNodeCADaemonProgressing: The daemon set node-ca is deployed"
          reason: Error
          status: "True"
          type: Progressing

      Version-Release number of selected component (if applicable):

          image built on 4.22 with installer PR https://github.com/openshift/installer/pull/9851

      How reproducible:

          always

      Steps to Reproduce:

          1. Create cluster on environment where policy is applied to enforce allowSharedKeyAccess to false on storage account
          2. 
          3.
          

      Actual results:

          image registry operator is degraded

      Expected results:

         cluster installation succeeded   

      Additional info:

      Installer hit same issue, and fix it in PR https://github.com/openshift/installer/pull/9851, change to use user delegated creds instead of key-based authentication 

              fmissi Flavian Missi
              jinyunma Jinyun Ma
              None
              None
              XiuJuan Wang XiuJuan Wang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: