Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use credentials from providers for docker sandbox image #51870

Merged
merged 1 commit into from
Sep 12, 2017
Merged

Use credentials from providers for docker sandbox image #51870

merged 1 commit into from
Sep 12, 2017
+31 −54

Conversation

feiskyer
Copy link
Member

@feiskyer feiskyer commented Sep 3, 2017

What this PR does / why we need it:

Sandbox image lookup uses creds from docker config only; other credential providers are ignored. This is a regression introduced in dockershim.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #51293

Special notes for your reviewer:

Should also cherry-pick this to release-1.6 and release-1.7.

Release note:

Fix credentials providers for docker sandbox image.

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Sep 3, 2017
@k8s-github-robot k8s-github-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Sep 3, 2017
@feiskyer
Copy link
Member Author

feiskyer commented Sep 3, 2017

/cc @alena1108 @yujuhong @Random-Liu

@k8s-ci-robot
Copy link
Contributor

@feiskyer: GitHub didn't allow me to request PR reviews from the following users: alena1108.

Note that only kubernetes members can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @alena1108 @yujuhong @Random-Liu

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@feiskyer feiskyer mentioned this pull request Sep 3, 2017
Closed
@feiskyer
Copy link
Member Author

feiskyer commented Sep 6, 2017

/assign @yujuhong

@feiskyer
Copy link
Member Author

feiskyer commented Sep 7, 2017

ping @yujuhong @Random-Liu @derekwaynecarr

yujuhong
yujuhong reviewed Sep 7, 2017
View reviewed changes
pkg/credentialprovider/provider.go Outdated
d.expiration = time.Now().Add(-1 * time.Hour)
}

// ResetDefaultDockerProviderExpiration resets .dockercfg provider's expiration.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here. This function is not used outside testing...

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yujuhong yep, but the timeout is set at init(), there is no easy way to set it outside the package. Any suggestions of a gentle way?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think dockershim should be testing the internals of the CachingDockerConfigProvider.
One option is to decouple the testing of credential provider by mocking it in dockershim. The other is to export defaultDockerConfigProvider and use that.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, will remove this test case.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we may add a docker config test in pkg/credentialprovider package later.

pkg/credentialprovider/provider.go Outdated

// Reset expiration so that the provider will get configure from real provider instead of cache.
// This is useful in testings.
func (d *CachingDockerConfigProvider) resetExpiration() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding a function just for testing is strange.

pkg/kubelet/dockershim/helpers.go Outdated

err := client.PullImage(image, dockertypes.AuthConfig{}, dockertypes.ImagePullOptions{})
if err != nil {
return fmt.Errorf("error of pulling image %q: %v", image, err)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/error of pulling image/failed pulling image

@yujuhong yujuhong added this to the v1.8 milestone Sep 7, 2017
@yujuhong yujuhong added kind/bug Categorizes issue or PR as related to a bug. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels Sep 7, 2017
@feiskyer
Copy link
Member Author

feiskyer commented Sep 8, 2017

@yujuhong Addressed comments. PTAL

@yujuhong
Copy link
Contributor

yujuhong commented Sep 8, 2017

PR looks good. @feiskyer do we have a node e2e test for this? I'd like to make sure the fix works before cherrypicking.

@feiskyer
Copy link
Member Author

feiskyer commented Sep 8, 2017

do we have a node e2e test for this?

I think no.

@feiskyer
Copy link
Member Author

feiskyer commented Sep 8, 2017

Let me add a credential e2e tests before cherry-picking to old branches.

@feiskyer feiskyer mentioned this pull request Sep 11, 2017
Merged
@yujuhong
Copy link
Contributor

/retest
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 11, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: feiskyer, yujuhong

Associated issue: 51293

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 11, 2017
@dchen1107
Copy link
Member

We should cherrypick the fix to 1.7 at least.

@feiskyer
Copy link
Member Author

No outputs of all failed tests, try the tests again.

@feiskyer
Copy link
Member Author

/test all

@yujuhong
Copy link
Contributor

No outputs of all failed tests, try the tests again.

The submit queue is blocked by #52307

@feiskyer
Copy link
Member Author

/retest

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 52264, 51870)

@k8s-github-robot k8s-github-robot merged commit 01154dd into kubernetes:master Sep 12, 2017
@feiskyer feiskyer deleted the sandbox-creds branch September 12, 2017 09:13
This was referenced Sep 12, 2017
Merged
Merged
@wojtek-t wojtek-t modified the milestones: v1.7, v1.8 Sep 13, 2017
@wojtek-t wojtek-t added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Sep 13, 2017
k8s-github-robot pushed a commit that referenced this pull request Sep 13, 2017
Merge pull request #52329 from feiskyer/automated-cherry-pick-of-#518…
c6afea9 
…70-upstream-release-1.7

Automatic merge from submit-queue

Automated cherry pick of #51870 on release-1.7

Cherry pick of #51870 on release-1.7.

#51870: Use credentials from providers for docker sandbox image
@k8s-cherrypick-bot
Copy link

Commit found in the "release-1.7" branch appears to be this PR. Removing the "cherrypick-candidate" label. If this is an error find help to get your PR picked.

k8s-github-robot pushed a commit that referenced this pull request Sep 15, 2017
Merge pull request #52340 from feiskyer/automated-cherry-pick-of-#518…
fae9ed8 
…70-upstream-release-1.6

Automatic merge from submit-queue.

Automated cherry pick of #51870 on release-1.6

Cherry pick of #51870 on release-1.6.

#51870: Use credentials from providers for docker sandbox image
k8s-github-robot pushed a commit that referenced this pull request Oct 28, 2017
Merge pull request #52256 from feiskyer/credential-provider-test
eff1a84 
Automatic merge from submit-queue (batch tested with PRs 49762, 52256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add node e2e tests for pulling images from credential providers

**What this PR does / why we need it**:

Add node e2e tests for pulling images from credential providers.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

Refer #51870 (comment)

**Special notes for your reviewer**:

/assign @yujuhong @Random-Liu 

1. We still need to add ResetDefaultDockerProviderExpiration for facilitating tests
2. Do we need a separate image for pulling private image from credential provider?
3. Any suggestion of also adding this for sandbox images? the pause image is a global config of kubelet, but we only need to set a private one for just one test case. 

**Release note**:

```release-note
NONE
```
@claudiubelu claudiubelu mentioned this pull request May 13, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yujuhong yujuhong yujuhong left review comments

@Random-Liu Random-Liu Awaiting requested review from Random-Liu

Assignees

@derekwaynecarr derekwaynecarr

@dchen1107 dchen1107

@yujuhong yujuhong

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
v1.7
Development

Successfully merging this pull request may close these issues.

Sandbox image lookup uses creds from docker config only; other credential providers are ignored
8 participants
@feiskyer @k8s-ci-robot @yujuhong @k8s-github-robot @dchen1107 @k8s-cherrypick-bot @derekwaynecarr @wojtek-t