-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cri-o cannot pull from internal registry with default image-puller role #16349
Comments
and/or cri-o is trying to do things it shouldn't have to do? (if docker doesn't need additional permissions, why does cri-o?) |
It looks like docker doesn't query signatures directly or querying for them in a different way |
Nope, we use containers/image in both afaict and the call to "get signatures" is the same :( |
is there any way to debug this in the live cluster? just remove cluster-admin and see what happens? |
/cc @mtrmac |
alright, I figured this, docker runs with |
@csrwng what was your workaround? I've |
(Substitute |
Or, if you want to test @mfojtik's latest fix, you can simply change the image ref in dc/docker-registry to cewong/origin-docker-registry:v3.6.0 |
@csrwng lovely, it works! |
On an OpenShift cluster running on cri-o, trying to run an pod with an image from the internal registry, I get the following event:
In the registry log, I see this:
The
default
service account already has the/system:image-puller
role. If I assign cluster-admin role to the same service account, then the pull succeeds.It seems that the image-puller role doesn't have sufficient permissions for cri-o to pull the image.
The text was updated successfully, but these errors were encountered: