openshift-controller-manager doesn't seem to respect MirrorSet and pull secret configs #269
Description
The "openshift-controller-manager" doesn't seem to respect cluster MirrorSet and pull secret configs.
Steps to reproduce:
- Provision a new cluster using one of the supported methods.
- Observe egress traffic of the cluster. Several HTTP requests to "docker.io" are made every hour.
- Create a
ImageDigestMirrorSetandImageTagMirrorSetresource to prevent direct requests to "docker.io" and instead proxy them over a specified mirror. See the YAML definitions [0] and [1]. - Again observe egress traffic of the cluster. Even with these resources applied, requests to "docker.io" are still made every hour.
This gets us to a rate-limit on docker.io rather quickly. We even tried to configure a cluster pull secret for docker.io, although this secret doesn't seem to be used for authenticating those specific requests.
The behavior of periodic pulls (or, more precisely, manifest fetches) has also been observed here by another user: https://serverfault.com/questions/1116219/openshift-docker-rate-limit-and-regular-pulls
The requests to docker.io are made due to the community samples operator adding several sample images from docker.io to the cluster (see the output of oc get images | grep docker.io).
To stop those requests from occurring, the community samples operator needs to be disabled (via oc patch OperatorHub/cluster --type=merge --patch='{"spec":{"sources":[{"name":"community-operators","disabled":true}]}}) and all image references to docker.io removed (via oc get images | grep docker.io | cut -d " " -f1 | xargs --verbose -I{} oc delete image "{}").
[0]:
apiVersion: config.openshift.io/v1
kind: ImageDigestMirrorSet
metadata:
name: dockerio-digest-mirror
spec:
imageDigestMirrors:
- mirrorSourcePolicy: NeverContactSource
mirrors:
- your-docker-proxy.com
source: docker.io[1]:
apiVersion: config.openshift.io/v1
kind: ImageTagMirrorSet
metadata:
name: dockerio-tag-mirror
spec:
imageTagMirrors:
- mirrorSourcePolicy: NeverContactSource
mirrors:
- your-docker-proxy.com
source: docker.io