Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-77141

oc-mirror v2 fails with "unknown userid" error in containerized environments

    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • Yes
    • All
    • Production
    • None
    • CLID Sprint 284
    • 1
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

          oc-mirror v2 (OCP 4.21) fails when running in containerized environments with arbitrary user IDs, specifically OpenShift CI. The failure occurs during the sigstore signature preparation phase with the following error: `[Executor] error getting the default registryd config path : unable to determine the current user : user: unknown userid 1003650000`

      Version-Release number of selected component (if applicable):

          Starting from Feb 04's (OCP v4.21 GA'd): https://mirror.openshift.com/pub/openshift-v4/amd64/clients/ocp/latest/oc-mirror.tar.gz

      How reproducible:

          Always

      Steps to Reproduce:

          In Prow CI environment, follow steps: https://github.com/openshift/release/blob/93e8fa82775a0ab6a81e85acccbd2e32e332360e/ci-operator/step-registry/cert-manager/install/catalog/cert-manager-install-catalog-commands.sh#L103-L128
          
          See job runs history: https://prow.ci.openshift.org/job-history/gs/test-platform-results/logs/periodic-ci-openshift-kueue-operator-release-1.2-test-e2e-disconnected
      
          Example logs:
          - https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-kueue-operator-release-1.2-test-e2e-disconnected/2023926586687885312/artifacts/test-e2e-disconnected/cert-manager-install-catalog/build-log.txt
          - https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-kueue-operator-release-1.2-test-e2e-disconnected/2018852900784050176/artifacts/test-e2e-disconnected/cert-manager-install-catalog/build-log.txt

      Actual results:

          oc-mirror fails immediately with "unknown userid" error when the process UID doesn't exist in `/etc/passwd`, which is common in containerized environments where processes run with dynamically assigned UIDs for security purposes.

      Expected results:

          oc-mirror should work in containerized environments regardless of the UID, falling back to ENV variables and system defaults when user database lookups fail.

      Additional info:

      This edge case has been introduced as part of the registriesd module for sigstore support since OCP v4.19:

      It has been enabled by default since OCP v4.21:

      Ideally the fix should be backported to 4.21.z as this is a regression.

              rh-ee-aguidi Alex Guidi
              rh-ee-yuewu Yuedong Wu
              None
              None
              Nidan Gavali Nidan Gavali
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: