Fix MCD image pull failure with mirrored releases#1865
Fix MCD image pull failure with mirrored releases#1865honza wants to merge 1 commit intoopenshift-metal3:masterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
I tried this locally and while it does fix the image pull problem, it also leaves MCO in a degraded state such that the deployment never officially completes. Maybe we need to talk to them about handling this, since they "own" this file? |
RHCOS 9.6+ ships a default /etc/containers/policy.json that requires sigstoreSigned verification for quay.io/openshift-release-dev images. When deploying mirrored non-GA releases (nightly/CI), images are not sigstore-signed. The policy check uses the original image name even when pulling from a mirror, causing signature verification to fail for both the initial MCD pull and all CRI-O pod image pulls. Fix by adding a MachineConfig manifest (when MIRROR_IMAGES is set and OPENSHIFT_RELEASE_TYPE is not "ga") with: - A permissive /etc/containers/policy.json file that accepts all images. Since MCO renders this as part of the MachineConfig, it expects the permissive version on disk — no drift detection. - A systemd dropin on machine-config-daemon-pull.service that forces --signature-policy to use the permissive policy for the initial MCD image pull (before Ignition applies the MachineConfig files). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
honza
force-pushed
the
mirror-sig-policy
branch
from
8064430 to
0b523d1
Compare
|
I just did a couple of loops with Claude and this new fix seems to work better. No MCO degradation. |
|
@honza: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
RHCOS 9.6 ships a default /etc/containers/policy.json that requires sigstoreSigned verification for quay.io/openshift-release-dev images. When deploying mirrored non-GA releases (nightly/CI), images are not sigstore-signed. Even though registries.conf redirects pulls to the local mirror, the policy check is evaluated against the original image name (quay.io/...), causing signature verification to fail.
This affects two services during node firstboot:
The existing generate_podman_policy_args.sh only applies a permissive
--signature-policyfor podman < 4.4.1, but current RHCOS ships podman 5.x. The MCO also internally regenerates the restrictive policy.json during MachineConfig rendering, overriding any file-level MachineConfig entries.Fix by adding a MachineConfig manifest with:
--signature-policyto use the permissivepolicy-for-old-podman.jsonOnly activated when
MIRROR_IMAGESis set andOPENSHIFT_RELEASE_TYPEis not "ga".