v0.5.0: pkg: Pin to RHCOS 47.167 and quay.io/openshift-release-dev/ocp-release:4.0.0-3 #773
Conversation
openshift-ci-robot
added
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
approved
|
In case a graph is easier to understand, here's where I think we want to be post-release: Modulo any hash changes due to future rebasing of #772 or #773, and Tide generating the merge that is |
wking
force-pushed
the
version-0.5.0-pins
branch
from
54ba349 to
f8a93b3
Compare
|
e2e-aws included: Maybe a flake? Or due to pulling the payload from quay.io, @smarterclayton? |
|
Crap. That’s the but with cvo processing files. I’ll have to run the older release command (so this won’t be a valid Cincinnati release). Will push with an older binary shortly |
|
Bug |
|
I have to remirror, there's a bug in release publishing that didn't update
the references to the new location during a mirror.
…On Sun, Dec 2, 2018 at 11:30 AM W. Trevor King ***@***.***> wrote:
e2e-aws
<https://storage.googleapis.com/origin-ci-test/pr-logs/pull/openshift_installer/773/pull-ci-openshift-installer-master-e2e-aws/1859/artifacts/e2e-aws/junit/junit_2018-12-02T102046.xml>
included:
fail [github.com/openshift/origin/test/extended/operators/operators.go:78]: Dec 2 10:01:08.686: ClusterVersion never became available: Unable to apply 4.0.0-3: a required extension is not available to update
Maybe a flake? Or due to pulling the payload from quay.io, @smarterclayton
<https://github.com/smarterclayton>?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#773 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/ABG_p00W1cJXsWGDQq-n6FCpU6E0St94ks5u1AAmgaJpZM4Y9Tmq>
.
|
|
Remirrored.
/retest
…On Sun, Dec 2, 2018 at 1:43 PM Clayton Coleman ***@***.***> wrote:
I have to remirror, there's a bug in release publishing that didn't update
the references to the new location during a mirror.
On Sun, Dec 2, 2018 at 11:30 AM W. Trevor King ***@***.***>
wrote:
> e2e-aws
> <https://storage.googleapis.com/origin-ci-test/pr-logs/pull/openshift_installer/773/pull-ci-openshift-installer-master-e2e-aws/1859/artifacts/e2e-aws/junit/junit_2018-12-02T102046.xml>
> included:
>
> fail [github.com/openshift/origin/test/extended/operators/operators.go:78]: Dec 2 10:01:08.686: ClusterVersion never became available: Unable to apply 4.0.0-3: a required extension is not available to update
>
> Maybe a flake? Or due to pulling the payload from quay.io,
> @smarterclayton <https://github.com/smarterclayton>?
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <#773 (comment)>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABG_p00W1cJXsWGDQq-n6FCpU6E0St94ks5u1AAmgaJpZM4Y9Tmq>
> .
>
|
|
e2e-aws timed out waiting for I'm going to launch it again and see if I can grab the error from the CI nodes before they get torn down. /retest |
|
From this run's bootstrap node: [core@ip-10-0-10-189 ~]$ journalctl -n5 -u bootkube.service | cat
-- Logs begin at Mon 2018-12-03 06:54:37 UTC, end at Mon 2018-12-03 07:24:52 UTC. --
Dec 03 07:24:48 ip-10-0-10-189 bootkube.sh[696]: Trying to pull quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b...Failed
Dec 03 07:24:48 ip-10-0-10-189 bootkube.sh[696]: unable to pull quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b: unable to pull image: Error determining manifest MIME type for docker://quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b: Error reading manifest sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b in quay.io/openshift-release-dev/ocp-v4.0: unauthorized: access to the requested resource is not authorized
Dec 03 07:24:48 ip-10-0-10-189 systemd[1]: bootkube.service: main process exited, code=exited, status=125/n/a
Dec 03 07:24:48 ip-10-0-10-189 systemd[1]: Unit bootkube.service entered failed state.
Dec 03 07:24:48 ip-10-0-10-189 systemd[1]: bootkube.service failed.The secret in the bootstrap's $ podman pull --authfile path/to/ci-pull.json quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435bit works. I'll add the pull JSON (without any Kubernetes wrapping) to the bootstrap ignition and point |
Done in #775. I've cherry-picked that commit onto this branch so we can test it against protected content. Once both #775 and this branch are green, we can land #775 and rebase #772 and #773 on top. |
openshift-ci-robot
added
the
needs-rebase
There was a problem hiding this comment.
Last paragraph from f8a93b33f72fbd10e02d9a8688c48b97d62c34f5
wking
force-pushed
the
version-0.5.0-pins
branch
from
e8fe290 to
782da57
Compare
wking
force-pushed
the
version-0.5.0-pins
branch
from
782da57 to
e101389
Compare
openshift-ci-robot
removed
the
needs-rebase
We already provide /opt/tectonic/manifests/pull.json with a Kubernetes secret that contains the auth JSON, but the new file has the auth JSON without any wrapping. This resolves issues with auth-protected update payloads [1]: [core@ip-10-0-10-189 ~]$ journalctl -n5 -u bootkube.service -- Logs begin at Mon 2018-12-03 06:54:37 UTC, end at Mon 2018-12-03 07:24:52 UTC. -- Dec 03 07:24:48 ip-10-0-10-189 bootkube.sh[696]: Trying to pull quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b...Failed Dec 03 07:24:48 ip-10-0-10-189 bootkube.sh[696]: unable to pull quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b: unable to pull image: Error determining manifest MIME type for docker://quay.io/openshift-release-dev/ocp-v4.0@sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b: Error reading manifest sha256:69bae91f6a933045175170cebd1caf00b8216a096fd4d402c41957a99aa3435b in quay.io/openshift-release-dev/ocp-v4.0: unauthorized: access to the requested resource is not authorized Dec 03 07:24:48 ip-10-0-10-189 systemd[1]: bootkube.service: main process exited, code=exited, status=125/n/a Dec 03 07:24:48 ip-10-0-10-189 systemd[1]: Unit bootkube.service entered failed state. Dec 03 07:24:48 ip-10-0-10-189 systemd[1]: bootkube.service failed. I think the ~/.docker directory name is unfortunate, since we're not actually using Docker at all. But ~/.docker/config.json is an auth location shared by Podman [2], CRI-O [3], and the kubelet [4]. And it's the most generic on-disk location that will survive reboots (/run will not [5]). I've also renamed the manifest template variable to PullSecretBase64 to distinguish it from the unencoded PullSecret I'm adding to the bootstrap template parameters. These are different template parameter sets, but I think recycling the same name would be unnecessarily confusing. [1]: openshift#773 (comment) [2]: https://github.com/containers/libpod/blob/v0.11.1.1/docs/podman-pull.1.md#options [3]: https://github.com/kubernetes-sigs/cri-o/blob/master/vendor/github.com/containers/image/pkg/docker/config/config.go#L32 [4]: https://kubernetes.io/docs/concepts/containers/images/#configuring-nodes-to-authenticate-to-a-private-registry [5]: http://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s15.html#runPurpose
wking
force-pushed
the
version-0.5.0-pins
branch
from
e101389 to
03015bf
Compare
Through 6585f5d (Merge pull request openshift#775 from wking/pull-secret-for-bootkube.sh, 2018-12-03).
…e:4.0.0-3 That's the latest RHCOS release: $ curl -s https://releases-rhcos.svc.ci.openshift.org/storage/releases/maipo/builds.json | jq '{latest: .builds[0], timestamp}' { "latest": "47.165", "timestamp": "2018-12-02T06:41:22Z" } And Clayton just pushed 4.0.0-0.alpha-2018-12-02-020136 to quay.io/openshift-release-dev/ocp-release:4.0.0-3 [1]. Renaming OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE gets us CI testing of the pinned release despite openshift/release@60007df2 (Use RELEASE_IMAGE_LATEST for CVO payload, 2018-10-03, openshift/release#1793). [1]: openshift#772 (comment)
wking
force-pushed
the
version-0.5.0-pins
branch
from
03015bf to
43e1458
Compare
|
Rebased onto the current #772 tip, so now both are on top of master since #775 landed, and we're back to a target release graph like the original plan. |
|
@wking: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/retest |
|
v0.5.0 cut off this PR. /close |
|
@wking: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/test images @smarterclayton wanted fresh builds from this image |
4 participants
DO NOT MERGE!
That's the latest RHCOS release:
And @smarterclayton just pushed 4.0.0-0.alpha-2018-12-02-020136 to quay.io/openshift-release-dev/ocp-release:4.0.0-3.
This PR builds on #772. The CHANGELOG commit (also in #772) will be merged into master. The pin commit (unique to this PR) will get the v0.5.0 tag, but not be merged into master. I'm just targetting master with the PR because I want CI to pass on the pinned dependencies before we tag the release.
/hold