[Feature Request]: enhance UX on image import, replace "Registry"

[ikke-t]

Feature description

There is one confusing dialog that has caused misery at customer and partner.
It's small change, but UI is a bit misleading ATM. I've seen failures to import image in different ways, as the term "Repository" and "Name" are misleading. This dialog:

First of all, the word repository typically means server url like quay.io, registry.access.redhat.com. So people put those there, and enter the name of image like image:tag into the "name" field, as it can be read that way. Another error I've seen is to put http:// or https:// to "Repository" field.

Describe alternatives you've considered

In minimum, I'd change the Repository -text to "Image URL". Then I'd have an example there, like:

Image URL, e.g.: repository.com:5000/path/image:tag

Anything else?

I've heard from Max Murakami in slack that actually the example of repository.com:5000/path/image:tag is bad, as there is a bug that the dialog will grab anything after first colon as tag. That should be fixed while at it, the regexp should only take anything after the last colon as tag.

[shalberd]

Agreed that the grayed-out default value of that field or a hover-over popup needs to be more clear on what that field is doing, formats, all that.

I wonder also how you are dealing with importing from the openshift-internal registry, as that requires custom CAs often ... unless you use no verification of trust chain. Same for importing from e.g. a VMWare Harbor or Artifactory Docker Repo. Regarding the naming: I would neither call it repository nor Image Url, but docker image path. On a whole, I have not used this before, just making you aware that importing from a public internet location is not always allowed, that proxy settings HTTP_PROXY and HTTPS_PROXY need to be honored, and that custom CA trust needs to be taken into account. You can get a bundle of all public and additonal CAs from a configmap via auto-injection into the configmap data section https://docs.openshift.com/container-platform/4.10/networking/configuring-a-custom-pki.html#certificate-injection-usin[…]rs_configuring-a-custom-pki

e.g. if I put in https://myartifactory.mycompany.internal.ch/jupyter/image:v0.5, does that download work for servers having a custom CA-based ssl certificate and does it honor HTTP_PROXY and HTTPS_PROXY env variables?

Don't be too focused on the openshift-internal repo and downloads from the public internet, as a general side note. Many customer do not have the internal openshift repo. Many customers also do not have direct Internet access. You'd need to check at least the internal openshift registry for existence either by seeing of pods are in the namespace oc get pods -n openshift-image-registry or oc describe project openshift-image-registry | grep Status or oc describe configs.imageregistry.operator.openshift.io

This functionality is for BYON, isn't it? What happens after the base docker image is downloaded from the public internet? Where is the result stored? In the openshift-internal docker registry at /namespace path? Is an imagestream created based on that openshift-internal docker image in the namespace, too?

[manosnoam]

Verified in 2.4: