Description of problem:
oc-mirror v2 (OCP 4.21) fails when running in containerized environments with arbitrary user IDs, specifically OpenShift CI. The failure occurs during the sigstore signature preparation phase with the following error: `[Executor] error getting the default registryd config path : unable to determine the current user : user: unknown userid 1003650000`
Version-Release number of selected component (if applicable):
Starting from Feb 04's (OCP v4.21 GA'd): https://mirror.openshift.com/pub/openshift-v4/amd64/clients/ocp/latest/oc-mirror.tar.gz
How reproducible:
Always
Steps to Reproduce:
In Prow CI environment, follow steps: https://github.com/openshift/release/blob/93e8fa82775a0ab6a81e85acccbd2e32e332360e/ci-operator/step-registry/cert-manager/install/catalog/cert-manager-install-catalog-commands.sh#L103-L128
See job runs history: https://prow.ci.openshift.org/job-history/gs/test-platform-results/logs/periodic-ci-openshift-kueue-operator-release-1.2-test-e2e-disconnected
Example logs:
- https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-kueue-operator-release-1.2-test-e2e-disconnected/2023926586687885312/artifacts/test-e2e-disconnected/cert-manager-install-catalog/build-log.txt
- https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-kueue-operator-release-1.2-test-e2e-disconnected/2018852900784050176/artifacts/test-e2e-disconnected/cert-manager-install-catalog/build-log.txt
Actual results:
oc-mirror fails immediately with "unknown userid" error when the process UID doesn't exist in `/etc/passwd`, which is common in containerized environments where processes run with dynamically assigned UIDs for security purposes.
Expected results:
oc-mirror should work in containerized environments regardless of the UID, falling back to ENV variables and system defaults when user database lookups fail.
Additional info:
This edge case has been introduced as part of the registriesd module for sigstore support since OCP v4.19:
- https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ocp-4-19-release-notes#ocp-release-notes-openshift-cli-sign-mirroring_release-notes
- https://github.com/openshift/oc-mirror/pull/1119
It has been enabled by default since OCP v4.21:
- https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ocp-4-21-release-notes#ocp-release-notes-ocp-cli_release-notes
- https://github.com/openshift/oc-mirror/pull/1290
- https://mirror.openshift.com/pub/openshift-v4/amd64/clients/ocp/latest-4.21/
- https://mirror.openshift.com/pub/openshift-v4/amd64/clients/ocp/latest/
Ideally the fix should be backported to 4.21.z as this is a regression.
- blocks
-
OCPBUGS-77222 oc-mirror v2 fails with "unknown userid" error in containerized environments
-
- New
-
- is cloned by
-
OCPBUGS-77222 oc-mirror v2 fails with "unknown userid" error in containerized environments
-
- New
-
- links to