Reference to image-stream not working anymore

[dkoci]

Hi.
I upgraded OKD cluster to version 4.7.0-0.okd-2021-08-22-163618.
I have some deployment-config which has a reference to some image-stream (image: my-image:latest).
Everything was ok until last upgrade. Now pod creation fails with an error:

"Failed to pull image "my-image:latest": rpc error: code = Unknown desc = Error reading manifest latest in docker.io/library/my-image: errors: denied: requested access to the resource is denied unauthorized: authentication required"

It looks that reference to image-stream not working anymore. Intsted it looks for image on docker.io/library...

I also have spec.lookupPolicy.local: true in my image-stream.

As I mentioned, everything was ok before upgrade.

[vrutkovs]

Please at least attach imagestream/deploymentconfig yamls?

[dkoci]

Image-stream:

apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
labels:
build: my-image-build
name: my-image
spec:
lookupPolicy:
local: true
tags:
- referencePolicy:
type: Local
name: latest

---

Deployment-config:

apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
name: xxxxxxxxx
spec:
selector:
app: xxxxxxxxx
replicas: 1
template:
metadata:
labels:
app: xxxxxxxxx
spec:
containers:
- name: xxxxxxxxx
imagePullPolicy: IfNotPresent
image: my-image:latest
ports:
- containerPort: 8080
name: http

[vrutkovs]

DeploymentConfig either needs imageChangeParams trigger or alpha.image.policy.openshift.io/resolve-names: '*' annotation needs to be added

[dkoci]

Not working, even with the annotation alpha.image.policy.openshift.io/resolve-names: '*'
Same error:
"Failed to pull image "my-image:latest": rpc error: code = Unknown desc = Error reading manifest latest in docker.io/library/my-image: errors: denied: requested access to the resource is denied unauthorized: authentication required"

It was working 100 % before upgrade.

[dkoci]

So it is not OKD issue?

[dkoci]

Again. This was working. I didnt change anything. I need no pull secret. The image is in OKD internal registry (same project as DeploymentConfig). I have a reference to an image stream in my Deployment config (see yamls attached above). But instead of getting image from internal registry, OKD wants to pull image from Dockerhub. It is not working even with annotation: alpha.image.policy.openshift.io/resolve-names: '*'

[LorbusChris]

Have you tried specifying the image tag (latest) on the the imagestream?

[dkoci]

I did. This is my ImageStream

apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
labels:
build: my-image-build
name: my-image
spec:
lookupPolicy:
local: true
tags:
- referencePolicy:
type: Local
name: latest

[LorbusChris]

Please indent the yaml properly. However it looks like tagsis empty.

[vrutkovs]

That indeed seems to be a regression - https://bugzilla.redhat.com/show_bug.cgi?id=2000216

[bparees]

also being investigated in https://bugzilla.redhat.com/show_bug.cgi?id=2000216