Fix oc image info auth for LVMS vcs-ref extraction - #82712
Conversation
Pass pull-secret credentials in connected mode so oc image info can authenticate to quay.io when following S3 blob redirects. Without auth, quay.io returns Forbidden on manifest list blob fetches. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WalkthroughThe LVMS catalog source step now extracts the catalog-image commit only for z-stream builds. It removes explicit disconnected-mode authentication flags from ChangesLVMS catalog source extraction
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-kubevirt-metal-conformance-cilium |
|
@kasturinarra: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kasturinarra, mgencur The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
The fix didn't help |
yup, i saw that.. working on it.. |
Remove the disconnected/connected auth branching that was added in the previous commit. The oc image info call now runs without auth flags, matching the upstream behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
New changes are detected. LGTM label has been removed. |
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-kubevirt-metal-conformance-cilium |
|
@kasturinarra: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh`:
- Around line 595-596: Update the local oc image info invocation in the commit
lookup to use the disconnected registry credentials from
/tmp/new-dockerconfigjson, either via -a or REGISTRY_AUTH_FILE. Do not add
--insecure, and leave the existing CA configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 10c59ad2-1bcc-49c7-92da-2fdc8731453e
📒 Files selected for processing (1)
ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh
| local commit | ||
| commit=$(oc image info --filter-by-os=linux/amd64 --output=json "${LVM_INDEX_IMAGE}" \ |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
script='ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh'
# Report option names only. Do not print credential contents.
for token in \
'oc image info' \
'new-dockerconfigjson' \
'REGISTRY_AUTH_FILE' \
'DOCKER_CONFIG' \
'--registry-config' \
'--insecure'
do
if rg -q -- "$token" "$script"; then
printf 'present: %s\n' "$token"
else
printf 'missing: %s\n' "$token"
fi
done
if command -v oc >/dev/null 2>&1; then
oc image info --help | rg -- '--registry-config|-a|--insecure'
else
printf 'oc is not installed; run this check in the step image\n' >&2
exit 2
fiRepository: openshift/release
Length of output: 360
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
script='ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh'
printf '%s\n' '--- authentication setup and image lookup ---'
sed -n '430,475p;580,615p' "$script"
printf '%s\n' '--- relevant variables and command references ---'
rg -n -C 2 -- \
'set_cluster_auth_disconnected|new-dockerconfigjson|LVM_INDEX_IMAGE|oc image info|DISCONNECTED|pull-secret|REGISTRY_AUTH_FILE|DOCKER_CONFIG' \
"$script"Repository: openshift/release
Length of output: 6879
🌐 Web query:
OpenShift oc image info --registry-config -a --insecure authentication behavior release-4.22 source
💡 Result:
In OpenShift 4.22, the oc image info command is used to retrieve metadata and manifests for container images [1][2][3]. When working with private or custom registries, authentication and connection security are handled via the following flags: --registry-config: This flag allows you to specify a path to a custom registry configuration file (often the standard Docker/Podman config.json format) containing authentication credentials [4]. When this flag is omitted, oc image info typically attempts to use credentials stored in the default configuration locations (such as ~/.docker/config.json or ${XDG_RUNTIME_DIR}/containers/auth.json) [4][5]. Providing this flag explicitly ensures the command uses the intended credentials, which is essential for avoiding unauthorized errors when querying private registries [4]. --insecure: This flag instructs the command to bypass TLS verification when communicating with the registry [6]. It is used when the registry uses self-signed certificates or is not configured with a trusted TLS certificate. Authentication Behavior: The command behaves similarly to other container tools (like Podman or Skopeo) that leverage the containers-image library. It resolves authentication by looking for credentials corresponding to the registry host in the provided (or default) configuration file [4][7]. If credentials are required but not found in the registry config, the command will fail with an authentication error [4]. Including --registry-config is a common pattern in automated environments or complex build pipelines to ensure consistent access to private repositories without relying on the environment's default user settings [4].
Citations:
- 1: https://manpages.opensuse.org/Tumbleweed/oc/
- 2: https://manpages.opensuse.org/Tumbleweed/src:oc/
- 3: https://github.com/openshift/origin/blob/v4.1.0/test/extended/images/info.go
- 4: thegreyd/art-tools@64ad9b3
- 5: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/cli_tools/openshift-cli-oc
- 6: https://github.com/openshift/oc/blob/e468aa68/pkg/cli/admin/verifyimagesignature/manifest.go
- 7: openshift/oc@6ac0669...9557cf3
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
script='ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh'
printf '%s\n' '--- script setup and registry variables ---'
sed -n '1,220p' "$script"
printf '%s\n' '--- command wrapper and disconnected flow ---'
rg -n -C 4 -- \
'function run|run\(\)|MIRROR_PROXY_REGISTRY_QUAY|MIRROR_REGISTRY_HOST|CLUSTER_PROFILE_DIR|pull-secret|authfile|registry-config|insecure|XDG_RUNTIME_DIR|DOCKER_CONFIG|REGISTRY_AUTH_FILE' \
"$script"Repository: openshift/release
Length of output: 15863
🌐 Web query:
site:github.com/openshift/release "MIRROR_PROXY_REGISTRY_QUAY" "lvms-catalogsource-commands.sh"
💡 Result:
The terms "MIRROR_PROXY_REGISTRY_QUAY" and "lvms-catalogsource-commands.sh" refer to components within the OpenShift CI release infrastructure repository [1][2]. MIRROR_PROXY_REGISTRY_QUAY is typically used as an environment variable or configuration key in OpenShift image mirroring workflows to define the destination Quay registry for mirrored images [3][2]. The OpenShift release repository manages image mirroring through automated jobs, where mirroring configurations are defined in mapping files (e.g., those with the prefix mapping_) [1][2][4]. Regarding lvms-catalogsource-commands.sh, this file is a shell script associated with the Logical Volume Manager Storage (LVMS) subsystem within the OpenShift CI step registry. It is used to execute commands required for setting up or managing CatalogSources in an OpenShift cluster for testing purposes, consistent with other naming conventions in the ci-operator/step-registry directory (e.g., enable-qe-catalogsource-commands.sh) [5][6][2]. These scripts are part of the broader framework for enabling OLM operators and catalog sources during Continuous Integration testing [5][6].
Citations:
- 1: https://github.com/openshift/release/blob/main/ci-operator/jobs/infra-image-mirroring.yaml
- 2: https://github.com/openshift/release/blob/master/ci-operator/jobs/infra-image-mirroring.yaml
- 3: https://github.com/openshift/release/blob/main/core-services/image-mirroring/_config.yaml
- 4: https://github.com/openshift/release/blob/master/core-services/image-mirroring/openshift/mapping_origin_v3_11_quay
- 5: https://github.com/openshift/release/blob/main/ci-operator/step-registry/enable-qe-catalogsource/enable-qe-catalogsource-ref.yaml
- 6: https://github.com/openshift/release/blob/main/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-ref.yaml
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- catalogsource step files ---'
git ls-files 'ci-operator/step-registry/lvms/catalogsource/*' \
'ci-operator/step-registry/lvms/catalogsource/**/*' \
| sort
printf '%s\n' '--- step and job references ---'
rg -n -C 3 -- \
'lvms/catalogsource|lvms-catalogsource|LVM_INDEX_IMAGE|MIRROR_REGISTRY_CREDS|REGISTRY_AUTH_FILE|DOCKER_CONFIG|dockerconfigjson' \
ci-operator/step-registry ci-operator/jobs 2>/dev/null \
| head -n 300Repository: openshift/release
Length of output: 43032
🌐 Web query:
OpenShift oc image info source release-4.22 registry-config flag default authentication file
💡 Result:
The oc image info command in OpenShift 4.22 includes the --registry-config flag, which allows you to specify a custom path to your registry credentials file [1][2]. Alternatively, you can specify the credentials file using the REGISTRY_AUTH_FILE environment variable [1][2]. If neither the --registry-config flag nor the REGISTRY_AUTH_FILE environment variable is provided, the command searches for authentication credentials in the following default locations, in order [1][2]: 1. ${XDG_RUNTIME_DIR}/containers/auth.json 2. /run/containers/${UID}/auth.json 3. ${XDG_CONFIG_HOME}/containers/auth.json 4. ${DOCKER_CONFIG} 5. ~/.docker/config.json 6. ~/.dockercfg Additionally, the REGISTRY_AUTH_PREFERENCE environment variable (which is deprecated) can be used to set a "docker" value, which prioritizes Docker credentials over Podman's [1][2].
Citations:
- 1: https://github.com/openshift/oc/blob/e468aa68/pkg/cli/image/manifest/manifest.go
- 2: https://manpages.opensuse.org/Tumbleweed/oc/oc-image-info.1.en.html
Pass the disconnected registry credentials to oc image info.
set_cluster_auth_disconnected writes credentials to /tmp/new-dockerconfigjson, but the local oc image info call does not use that file. Pass -a /tmp/new-dockerconfigjson or set REGISTRY_AUTH_FILE for the lookup. Do not add --insecure; set_CA_for_nodes configures the mirror CA.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh`
around lines 595 - 596, Update the local oc image info invocation in the commit
lookup to use the disconnected registry credentials from
/tmp/new-dockerconfigjson, either via -a or REGISTRY_AUTH_FILE. Do not add
--insecure, and leave the existing CA configuration unchanged.
Only run oc image info for vcs-ref when ZSTREAM_VERSION is set. Non-z-stream tests use pre-built images and don't need lvm_source_commit. This avoids quay.io S3 Forbidden errors in tests that don't require the commit hash. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-kubevirt-metal-conformance-cilium |
|
[REHEARSALNOTIFIER]
A total of 484 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh`:
- Around line 597-598: The oc image info command at line 597 lacks registry
authentication for both connected and disconnected modes. Add conditional logic
to pass --insecure -a /tmp/new-dockerconfigjson flags when in disconnected mode
and pass the connected pull-secret when in connected mode to the oc image info
invocation. This mirrors the authentication pattern used elsewhere in the script
to ensure quay.io redirect and disconnected registry access succeeds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 57fcdbcd-de57-49c7-9f1d-174dd9b56f59
📒 Files selected for processing (1)
ci-operator/step-registry/lvms/catalogsource/lvms-catalogsource-commands.sh
|
@kasturinarra: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@kasturinarra: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
oc image infoin connected mode so it can authenticate to quay.io when following S3 blob redirectsForbiddenwhenoc image infotries to fetch image configuration from a manifest listlvms-catalogsource-commands.sh(reported in OCPBUGS-54574: Cilium on management cluster with KubeVirt #81307)Test plan
Forbiddenfrom quay.io S3--insecure -a /tmp/new-dockerconfigjson🤖 Generated with Claude Code
Summary by CodeRabbit
The LVMS catalog source CI test now runs VCS-ref extraction only when
ZSTREAM_VERSIONis set. Non-z-stream tests use pre-built images and no longer attempt to extract the source commit, which prevents failures from missingvcs-reflabels. Theoc image infocommand and its authentication configuration remain unchanged.