Istio_v0.7.1 chart can't pull image from default image repository defined in value.yaml

[morvencao]

env:

centos: 7.2
istio version: 0.7.1
kubenetes version: v1.9.1

install command:
Before install, we need to add templates _helpers.tpl to workaround issue: #3895
And then:

helm install --name istio --namespace istio-system istio-0.7.1/install/kubernetes/helm/istio

problem:
We can see the problem from pod creating events:

Events:
  Type     Reason                 Age               From                    Message
  ----     ------                 ----              ----                    -------
  Normal   Scheduled              1m                default-scheduler       Successfully assigned istio-ca-6dfffc69bd-fmnjt to 9.111.255.188
  Normal   SuccessfulMountVolume  1m                kubelet, 9.111.255.188  MountVolume.SetUp succeeded for volume "istio-ca-service-account-token-8w2hv"
  Normal   Pulling                29s (x3 over 1m)  kubelet, 9.111.255.188  pulling image "docker.io/istionightly/istio-ca:0.7.1"
  Warning  Failed                 22s (x3 over 1m)  kubelet, 9.111.255.188  Failed to pull image "docker.io/istionightly/istio-ca:0.7.1": rpc error: code = Unknown desc = Error response from daemon: manifest for istionightly/istio-ca:0.7.1 not found
  Warning  Failed                 22s (x3 over 1m)  kubelet, 9.111.255.188  Error: ErrImagePull
  Normal   BackOff                7s (x3 over 1m)   kubelet, 9.111.255.188  Back-off pulling image "docker.io/istionightly/istio-ca:0.7.1"
  Warning  Failed                 7s (x3 over 1m)   kubelet, 9.111.255.188  Error: ImagePullBackOff

Analysis:
Try to pull image directly by:

[root@mstnode ~]# docker pull docker.io/istionightly/istio-ca:0.7.1
Error response from daemon: manifest for istionightly/istio-ca:0.7.1 not found

The reason is that default image repository defined in value.yaml isn't updated.
Confirm it by running:

[root@mstnode ~]# docker pull docker.io/istio/istio-ca:0.7.1
0.7.1: Pulling from istio/istio-ca
9541024e96f1: Pull complete
d53a23416d7c: Pull complete
f21c2237ca76: Pull complete
Digest: sha256:744e7a4426474d10f7984c601590ee6dab304f5cf6677a80b37c3025993dbd4e
Status: Downloaded newer image for istio/istio-ca:0.7.1

Workaround:

helm install --name istio --namespace istio-system --set global.hub=docker.io/istio istio-0.7.1/install/kubernetes/helm/istio

/cc @gyliu513

[sdake]

Not clear to me what should be done to correct this in the future other than modify the values.yaml during the branching & tagging process.

[linsun]

This is bad, we should be using the docker.io/istio repo, not the nightly. looks like this is only an issue with helm, not with the istio.yaml files.

[ldemailly]

@hklai @rkpagadala @sebastienvas looks like one more image needs to be substituted when making the official release?

[hklai]

instead of substituting image, it looks like the hub value in https://github.com/istio/istio/blob/master/install/kubernetes/helm/istio/values.yaml needs to be updated?

I am not very familiar with helm, so please bear with me.
why is the hub value hardcoded to nightly? And how did it work in prior releases?

[ldemailly]

@hklai you are right - @costinm why is there a hub (docker.io/istionightly)/tag (circleci-nightly) in the values.yaml ?

generally though what will be the plan for that file to point to nightlies vs releases etc

[linsun]

it never worked in previous releases, only in master...

hub value in values.yaml is for people to specify their own hubs.... the default one in official release should be docker.io/istio... we should replace it to use that when we generate the official release.

[hklai]

or shouldn't it be the other way around? The default should be docker.io/istio, if override that to nightly only when someone wants to pick up bleeding edge?

[ldemailly]

sure for hub but what about the tag ?

[linsun]

I think the default was docker.io/istio before, but changed to nightly. @costinm do you know why?

tag is similar, you could customize it too based on a local build tag.

[ldemailly]

for dev mode/build from source, the makefile should change the hub/tag to HUB and TAG but I'm still curious how the right tag would get in there for the release tar ball ?

[linsun]

@hklai i downloaded the 0.8 pre build istio-0.8.0-pre20180414-09-15 and it looks okay for pre-release:

  hub: gcr.io/istio-release

  # Default tag for Istio images.
  # Should track latest released version.
  # Currently using nightly build, for testing
  tag: 0.8.0-pre20180414-09-15

Does anyone know where is this configured for the official release? I 'd like to get this fixed in 0.8 as many people has reported helm install not working in the past few releases.

[hklai]

Both the hub and tag are "injected" by the release pipeline.

For the official 0.8.0 build (which will be rebuilt from the release branch), the hub will be docker.io and the tag will be 0.8.0.

[hklai]

@linsun is there any remaining work that needs to be done here?

[bechampion]

this has worked for me:

  hub: gcr.io/istio-release

  # Default tag for Istio images.
  # Should track latest released version in the branch.
  tag: 0.8.0
  proxy:
    image: proxyv2
    resources:

We should move to this on master no ?