feat: linking mounted certificates from '/var/run/secrets/kubernetes.io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login #851

ibuziuk · 2023-07-03T13:18:40Z

What does this PR do?

Linking mounted certificates from '/var/run/secrets/kubernetes.io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login

What issues does this PR fix or reference?

eclipse-che/che#22140

Is it tested? How?

Install Eclipse Che and replace the dashboard image related to the PR

spec:
  components:
    dashboard:
      deployment:
        containers:
          - image: quay.io/eclipse/che-dashboard:pr-851

Create an empty workspace, open the terminal, and execute podman pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest

N.B. symbolic links for ca.crt and service-ca.crt are in the $HOME/.config/containers/certs.d/image-registry.openshift-image-registry.svc:5000 folder

Release Notes

Docs PR

Related info - https://manpages.ubuntu.com/manpages/impish/man5/containers-certs.d.5.html

che-bot · 2023-07-03T13:18:53Z

Click here to review and test in web IDE:

che-bot · 2023-07-03T14:09:22Z

Click here to review and test in web IDE:

che-bot · 2023-07-03T14:10:26Z

Click here to review and test in web IDE:

github-actions · 2023-07-03T14:28:52Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

github-actions · 2023-07-03T14:29:12Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

che-bot · 2023-07-04T13:25:44Z

Click here to review and test in web IDE:

github-actions · 2023-07-04T13:44:20Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

tolusha · 2023-07-05T08:30:19Z

Strange, I can't pull the image

$ podman pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest...
Error: initializing source docker://image-registry.openshift-image-registry.svc:5000/openshift/cli:latest: reading manifest latest in image-registry.openshift-image-registry.svc:5000/openshift/cli: authentication required

$ ls $HOME/.config/containers/certs.d/image-registry.openshift-image-registry.svc:5000 -l
total 0
lrwxrwxrwx. 1 user root 52 Jul  5 08:29 ca.crt -> /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
lrwxrwxrwx. 1 user root 60 Jul  5 08:29 service-ca.crt -> /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt

 % oc describe -n eclipse-che deployments.apps che-dashboard | grep Image    
    Image:      quay.io/eclipse/che-dashboard:pr-851

tolusha · 2023-07-05T08:32:59Z

$ podman login -u $(oc whoami) -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000
Error: logging into "image-registry.openshift-image-registry.svc:5000": invalid username/password
$ oc whoami
kube:admin
$ oc whoami -t
<REDACTED  TOKEN>
projects $ podman login -u kubeadmin -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000
Login Succeeded!

…io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login Signed-off-by: Ilya Buziuk <[email protected]>

che-bot · 2023-07-05T10:43:42Z

Click here to review and test in web IDE:

ibuziuk · 2023-07-05T10:44:28Z

@tolusha nice catch, handling special case for kube:admin as part of the script

github-actions · 2023-07-05T11:01:47Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

tolusha · 2023-07-05T12:02:49Z

I spotted another problem while testing with ClusterBot

$ podman pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest...
Getting image source signatures
Copying blob f76613a56453 done  
Copying blob 97da74cc6d8f done  
Copying blob fd8b2f4b006c done  
Copying blob d8190195889e done  
Copying blob 34a8ab31a72c done  
ERRO[0003] While applying layer: ApplyLayer stdout:  stderr: potentially insufficient UIDs or GIDs available in user namespace (requested 0:5 for /usr/bin/write): Check /etc/subuid and /etc/subgid if configured locally and run podman-system-migrate: lchown /usr/bin/write: invalid argument exit status 1 
Error: writing blob: adding layer with blob "sha256:97da74cc6d8fa5d1634eb1760fd1da5c6048619c264c23e62d75f3bf6b8ef5c4": ApplyLayer stdout:  stderr: potentially insufficient UIDs or GIDs available in user namespace (requested 0:5 for /usr/bin/write): Check /etc/subuid and /etc/subgid if configured locally and run podman-system-migrate: lchown /usr/bin/write: invalid argument exit status 1

ibuziuk · 2023-07-05T12:03:17Z

hmm, did a test on a fresh hypershift cluster and with kube:admin got the following error during image pulling:

Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest...
Getting image source signatures
Copying blob 97da74cc6d8f done  
Copying blob f76613a56453 done  
Copying blob 97da74cc6d8f done  
Copying blob f76613a56453 done  
Copying blob d8190195889e done  
Copying blob fd8b2f4b006c done  
Copying blob 34a8ab31a72c done  
Error: writing blob: adding layer with blob "sha256:97da74cc6d8fa5d1634eb1760fd1da5c6048619c264c23e62d75f3bf6b8ef5c4": ApplyLayer stdout:  stderr: potentially insufficient UIDs or GIDs available in user namespace (requested 0:5 for /usr/bin/write): Check /etc/subuid and /etc/subgid if configured locally and run podman-system-migrate: lchown /usr/bin/write: invalid argument exit status 1

podman system migrate [1] helps and we can technically add it to the script @l0rd @benoitf wdyt? I have not seen this error before

cpp-hello-world $ podman system migrate
cpp-hello-world $ podman pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/cli:latest...
Getting image source signatures
Copying blob f76613a56453 done  
Copying blob d8190195889e done  
Copying blob fd8b2f4b006c done  
Copying blob 34a8ab31a72c done  
Copying blob 97da74cc6d8f done  
Copying config e549ba58b9 done  
Writing manifest to image destination
Storing signatures
e549ba58b9b7399c7ad652a904174db32f02ed5105fde374c9ac377643ef1ea3
cpp-hello-world $ podman images
REPOSITORY                                                      TAG         IMAGE ID      CREATED     SIZE
image-registry.openshift-image-registry.svc:5000/openshift/cli  latest      e549ba58b9b7  8 days ago  539 MB
cpp-hello-world $

[1] https://docs.podman.io/en/latest/markdown/podman-system-migrate.1.html

…gin' Signed-off-by: Ilya Buziuk <[email protected]>

che-bot · 2023-07-05T15:17:51Z

Click here to review and test in web IDE:

github-actions · 2023-07-05T15:38:21Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

ibuziuk · 2023-07-06T10:07:59Z

@tolusha with the recent changes the image pulling should work with both hypershift / aws, and rosa. I believe the previous issue was related to $USER env var.

che-bot · 2023-07-06T11:37:00Z

Click here to review and test in web IDE:

github-actions · 2023-07-06T11:55:15Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

…'podman login' Signed-off-by: Ilya Buziuk <[email protected]>

che-bot · 2023-07-06T12:01:31Z

Click here to review and test in web IDE:

github-actions · 2023-07-06T12:21:36Z

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-851

openshift-ci · 2023-07-06T13:18:38Z

@ibuziuk: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v11-dashboard-happy-path	`a768d3b`	link	true	`/test v11-dashboard-happy-path`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

dmytro-ndp

Checked with Eclipse Che Next + quay.io/eclipse/che-dashboard:pr-851

Following test scenario from PR description, image-registry.openshift-image-registry.svc:5000/openshift/cli:latest had been pulled correctly from within Empty workspace and spring-petclinic workspace using tools container, being logged into the Eclipse Che as user with and without cluster admin rights:

IMHO, with that results PR has satisfied DoD of fixing issue eclipse-che/che#22140

Well done, @ibuziuk !

openshift-ci · 2023-07-07T14:18:01Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dmytro-ndp, ibuziuk, l0rd, tolusha

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

devstudio-release · 2023-07-09T08:41:22Z

Build 3.8 :: dashboard_3.x/284: Console, Changes, Git Data

devstudio-release · 2023-07-09T08:50:16Z

Build 3.8 :: sync-to-downstream_3.x/3745: Console, Changes, Git Data

ibuziuk requested review from akurinnoy and olexii4 as code owners July 3, 2023 13:18

ibuziuk force-pushed the che-22140 branch from 4a0444d to 7743d99 Compare July 3, 2023 14:09

ibuziuk force-pushed the che-22140 branch from 7743d99 to 8a7fc03 Compare July 3, 2023 14:10

ibuziuk force-pushed the che-22140 branch from 8a7fc03 to bbf602e Compare July 4, 2023 13:25

ibuziuk mentioned this pull request Jul 4, 2023

Unable to pull container images from the OpenShift internal registry eclipse-che/che#22140

Closed

feat: linking mounted certificates from '/var/run/secrets/kubernetes.…

27bf41e

…io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login Signed-off-by: Ilya Buziuk <[email protected]>

ibuziuk force-pushed the che-22140 branch from bbf602e to eee6575 Compare July 5, 2023 10:43

ibuziuk requested review from l0rd, benoitf and tolusha July 5, 2023 12:03

fix: Handling a special case for the 'kube:admin' user for 'podman lo…

a8beb13

…gin' Signed-off-by: Ilya Buziuk <[email protected]>

ibuziuk force-pushed the che-22140 branch from eee6575 to a8beb13 Compare July 5, 2023 15:17

tolusha approved these changes Jul 6, 2023

View reviewed changes

openshift-ci bot assigned tolusha Jul 6, 2023

openshift-ci bot added lgtm and removed lgtm labels Jul 6, 2023

l0rd approved these changes Jul 6, 2023

View reviewed changes

openshift-ci bot assigned l0rd Jul 6, 2023

openshift-ci bot added the lgtm label Jul 6, 2023

fix: Adding check for 'oc' and '/home/ibuziuk' which are pre-req for …

a768d3b

…'podman login' Signed-off-by: Ilya Buziuk <[email protected]>

ibuziuk force-pushed the che-22140 branch from 9f5879b to a768d3b Compare July 6, 2023 12:01

openshift-ci bot removed the lgtm label Jul 6, 2023

ibuziuk requested a review from dmytro-ndp July 6, 2023 13:34

dmytro-ndp approved these changes Jul 7, 2023

View reviewed changes

openshift-ci bot assigned dmytro-ndp Jul 7, 2023

openshift-ci bot added the lgtm label Jul 7, 2023

ibuziuk merged commit bb522b3 into main Jul 7, 2023

ibuziuk deleted the che-22140 branch July 7, 2023 14:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: linking mounted certificates from '/var/run/secrets/kubernetes.io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login #851

feat: linking mounted certificates from '/var/run/secrets/kubernetes.io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login #851

ibuziuk commented Jul 3, 2023 •

edited

Loading

che-bot commented Jul 3, 2023

che-bot commented Jul 3, 2023

che-bot commented Jul 3, 2023

github-actions bot commented Jul 3, 2023

github-actions bot commented Jul 3, 2023

che-bot commented Jul 4, 2023

github-actions bot commented Jul 4, 2023

tolusha commented Jul 5, 2023

tolusha commented Jul 5, 2023 •

edited

Loading

che-bot commented Jul 5, 2023

ibuziuk commented Jul 5, 2023

github-actions bot commented Jul 5, 2023

tolusha commented Jul 5, 2023

ibuziuk commented Jul 5, 2023

che-bot commented Jul 5, 2023

github-actions bot commented Jul 5, 2023

ibuziuk commented Jul 6, 2023

che-bot commented Jul 6, 2023

github-actions bot commented Jul 6, 2023

che-bot commented Jul 6, 2023

github-actions bot commented Jul 6, 2023

openshift-ci bot commented Jul 6, 2023

dmytro-ndp left a comment •

edited

Loading

openshift-ci bot commented Jul 7, 2023

devstudio-release commented Jul 9, 2023

devstudio-release commented Jul 9, 2023

feat: linking mounted certificates from '/var/run/secrets/kubernetes.io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login #851

feat: linking mounted certificates from '/var/run/secrets/kubernetes.io/serviceaccount' to '/$HOME/.config/containers/certs.d' before podman login #851

Conversation

ibuziuk commented Jul 3, 2023 • edited Loading

What does this PR do?

What issues does this PR fix or reference?

Is it tested? How?

Release Notes

Docs PR

che-bot commented Jul 3, 2023

che-bot commented Jul 3, 2023

che-bot commented Jul 3, 2023

github-actions bot commented Jul 3, 2023

github-actions bot commented Jul 3, 2023

che-bot commented Jul 4, 2023

github-actions bot commented Jul 4, 2023

tolusha commented Jul 5, 2023

tolusha commented Jul 5, 2023 • edited Loading

che-bot commented Jul 5, 2023

ibuziuk commented Jul 5, 2023

github-actions bot commented Jul 5, 2023

tolusha commented Jul 5, 2023

ibuziuk commented Jul 5, 2023

che-bot commented Jul 5, 2023

github-actions bot commented Jul 5, 2023

ibuziuk commented Jul 6, 2023

che-bot commented Jul 6, 2023

github-actions bot commented Jul 6, 2023

che-bot commented Jul 6, 2023

github-actions bot commented Jul 6, 2023

openshift-ci bot commented Jul 6, 2023

dmytro-ndp left a comment • edited Loading

Choose a reason for hiding this comment

openshift-ci bot commented Jul 7, 2023

devstudio-release commented Jul 9, 2023

devstudio-release commented Jul 9, 2023

ibuziuk commented Jul 3, 2023 •

edited

Loading

tolusha commented Jul 5, 2023 •

edited

Loading

dmytro-ndp left a comment •

edited

Loading