Skip to content

OCPBUGS-82974: Make IRI registry read-only via environment variable#5845

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
rwsu:OCPBUGS-82974
Apr 15, 2026
Merged

OCPBUGS-82974: Make IRI registry read-only via environment variable#5845
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
rwsu:OCPBUGS-82974

Conversation

@rwsu
Copy link
Copy Markdown
Contributor

@rwsu rwsu commented Apr 13, 2026

- What I did

Without this change, clients pushing to the IRI registry receive HTTP 500 Internal Server Error. Write requests reach the :ro filesystem mount and fail there, causing the registry to return 500. With REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true' set, push and delete requests are rejected at the application layer with 405 Method Not Allowed instead.

REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED=true does not work -- the env var parser produces map[string]interface{} but the registry code expects map[interface{}]interface{} from gopkg.in/yaml.v2, causing a panic. Passing the entire YAML map as the value at path depth 1
(REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true') triggers yaml.Unmarshal() and produces the correct type.

Fixes: OCPBUGS-82974

- How to verify it

When iri-registry.service is running, push any image to it and you should receive status 405 error:

Error: writing blob: initiating layer upload to /v2/test/image/blobs/uploads/ in localhost:22625: StatusCode: 405, "Method not allowed\n"

- Description for the changelog

Enforce IRI registry read-only mode at the application layer to return 405 instead of 500 on write attempts.

Summary by CodeRabbit

  • New Features

    • Registry service now supports enabling a read-only storage maintenance mode when starting the registry.
  • Tests

    • Added unit test assertions to verify the registry maintenance mode setting is applied correctly.

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 13, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: This pull request references Jira Issue OCPBUGS-82974, which is invalid:

  • expected the bug to target either version "4.22." or "openshift-4.22.", but it targets "4.23" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

- What I did

Without this change, clients pushing to the IRI registry receive HTTP 500 Internal Server Error. Write requests reach the :ro filesystem mount and fail there, causing the registry to return 500. With REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true' set, push and delete requests are rejected at the application layer with 405 Method Not Allowed instead.

REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED=true does not work -- the env var parser produces map[string]interface{} but the registry code expects map[interface{}]interface{} from gopkg.in/yaml.v2, causing a panic. Passing the entire YAML map as the value at path depth 1
(REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true') triggers yaml.Unmarshal() and produces the correct type.

Fixes: OCPBUGS-82974

- How to verify it

When iri-registry.service is running, push any image to it and you should receive status 405 error:

Error: writing blob: initiating layer upload to /v2/test/image/blobs/uploads/ in localhost:22625: StatusCode: 405, "Method not allowed\n"

- Description for the changelog

Enforce IRI registry read-only mode at the application layer to return 405 instead of 500 on write attempts.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from andfasano and zaneb April 13, 2026 12:28
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 13, 2026
@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 13, 2026

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 13, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: This pull request references Jira Issue OCPBUGS-82974, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 13, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: dd8b6046-1a39-4a92-9471-bbf54c538065

📥 Commits

Reviewing files that changed from the base of the PR and between 21f3130 and 1633c52.

📒 Files selected for processing (2)
  • pkg/controller/internalreleaseimage/internalreleaseimage_helpers_test.go
  • pkg/controller/internalreleaseimage/templates/master/units/iri-registry.service.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • pkg/controller/internalreleaseimage/templates/master/units/iri-registry.service.yaml

Walkthrough

Adds the environment variable REGISTRY_STORAGE_MAINTENANCE_READONLY={"enabled":true} to the IRI registry systemd unit ExecStart and updates the unit-rendering test to assert the rendered unit Contents contains that exact string and does not contain the similarly named incorrect identifier.

Changes

Cohort / File(s) Summary
Registry service unit & test
pkg/controller/internalreleaseimage/templates/master/units/iri-registry.service.yaml, pkg/controller/internalreleaseimage/internalreleaseimage_helpers_test.go
Add REGISTRY_STORAGE_MAINTENANCE_READONLY={"enabled":true} to the podman run -e args in the iri-registry.service unit. Update verifyInternalReleaseMasterMachineConfig test to assert the rendered systemd unit Contents includes the exact JSON-string and does not include REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Stable And Deterministic Test Names ❓ Inconclusive The test file referenced in the PR summary could not be located in the repository to verify test names for dynamic content. Confirm the test file path exists and is accessible, then provide the actual test name declarations to check for dynamic values that change between runs.
✅ Passed checks (8 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically describes the main change: adding an environment variable to make the IRI registry read-only. It references the relevant Jira ticket and accurately summarizes the primary objective of the PR.
Test Structure And Quality ✅ Passed Test modifications add focused assertions checking for REGISTRY_STORAGE_MAINTENANCE_READONLY environment variable presence/absence in systemd unit configuration, following existing Ginkgo/Expect() patterns without explicit failure messages.
Microshift Test Compatibility ✅ Passed This PR does not add any new Ginkgo e2e tests, only adds assertions to an existing test helper function.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests are added in this PR. Changes are limited to helper function assertions and systemd configuration.
Topology-Aware Scheduling Compatibility ✅ Passed Pull request adds environment variable to systemd service unit and test assertions. No scheduling constraints, topology affinity rules, nodeSelector directives, or deployment manifests are introduced.
Ote Binary Stdout Contract ✅ Passed The pull request changes do not violate the OTE Binary Stdout Contract. Test assertions are within test case helper functions, and the systemd unit modification only adds environment variables—neither involves stdout writes in process-level code.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PR does not add new Ginkgo e2e tests; only modifies existing Go unit tests, so custom check does not apply.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: This pull request references Jira Issue OCPBUGS-82974, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

- What I did

Without this change, clients pushing to the IRI registry receive HTTP 500 Internal Server Error. Write requests reach the :ro filesystem mount and fail there, causing the registry to return 500. With REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true' set, push and delete requests are rejected at the application layer with 405 Method Not Allowed instead.

REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED=true does not work -- the env var parser produces map[string]interface{} but the registry code expects map[interface{}]interface{} from gopkg.in/yaml.v2, causing a panic. Passing the entire YAML map as the value at path depth 1
(REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true') triggers yaml.Unmarshal() and produces the correct type.

Fixes: OCPBUGS-82974

- How to verify it

When iri-registry.service is running, push any image to it and you should receive status 405 error:

Error: writing blob: initiating layer upload to /v2/test/image/blobs/uploads/ in localhost:22625: StatusCode: 405, "Method not allowed\n"

- Description for the changelog

Enforce IRI registry read-only mode at the application layer to return 405 instead of 500 on write attempts.

Summary by CodeRabbit

  • New Features
  • Registry service now supports read-only storage maintenance mode configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/controller/internalreleaseimage/internalreleaseimage_helpers_test.go`:
- Line 43: The test currently only checks for presence of the key substring in
ignCfg.Systemd.Units[0].Contents which is too permissive; update the assertion
to verify the exact env assignment string (e.g. assert.Contains t,
*ignCfg.Systemd.Units[0].Contents, "REGISTRY_STORAGE_MAINTENANCE_READONLY=1")
and also add an explicit negative assertion to reject the incorrect variant
(e.g. assert.NotContains t, *ignCfg.Systemd.Units[0].Contents,
"REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED") so the test fails if the broken
`_ENABLED` form is produced.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d2bd2814-5808-4ed5-96cd-025d55bc8962

📥 Commits

Reviewing files that changed from the base of the PR and between 449e78f and 21f3130.

📒 Files selected for processing (2)
  • pkg/controller/internalreleaseimage/internalreleaseimage_helpers_test.go
  • pkg/controller/internalreleaseimage/templates/master/units/iri-registry.service.yaml

Comment thread pkg/controller/internalreleaseimage/internalreleaseimage_helpers_test.go Outdated
@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 13, 2026

/test unit

@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 13, 2026

/verified by @rwsu

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Apr 13, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: This PR has been marked as verified by @rwsu.

Details

In response to this:

/verified by @rwsu

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@pawanpinjarkar
Copy link
Copy Markdown

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 13, 2026
@openshift-merge-bot
Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift

@andfasano
Copy link
Copy Markdown
Contributor

Will also require to run a green iso-no-registry job @rwsu

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD 449e78f and 2 for PR HEAD 6111f9d in total

@pawanpinjarkar
Copy link
Copy Markdown

/hold as per @andfasano 's comments

@pawanpinjarkar
Copy link
Copy Markdown

/test ?

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 13, 2026
@pawanpinjarkar
Copy link
Copy Markdown

/test e2e-agent-compact-ipv4-iso-no-registry

…v var

Without this change, clients pushing to the IRI registry receive HTTP 500
Internal Server Error. Write requests reach the :ro filesystem mount and
fail there, causing the registry to return 500. With
REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true' set, push and delete
requests are rejected at the application layer with 405 Method Not Allowed
instead.

REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED=true does not work -- the env
var parser produces map[string]interface{} but the registry code expects
map[interface{}]interface{} from gopkg.in/yaml.v2, causing a panic. Passing
the entire YAML map as the value at path depth 1
(REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true') triggers
yaml.Unmarshal() and produces the correct type.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@openshift-ci-robot openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Apr 14, 2026
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Apr 14, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: This pull request references Jira Issue OCPBUGS-82974, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.22.0) matches configured target version for branch (4.22.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Details

In response to this:

- What I did

Without this change, clients pushing to the IRI registry receive HTTP 500 Internal Server Error. Write requests reach the :ro filesystem mount and fail there, causing the registry to return 500. With REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true' set, push and delete requests are rejected at the application layer with 405 Method Not Allowed instead.

REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED=true does not work -- the env var parser produces map[string]interface{} but the registry code expects map[interface{}]interface{} from gopkg.in/yaml.v2, causing a panic. Passing the entire YAML map as the value at path depth 1
(REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true') triggers yaml.Unmarshal() and produces the correct type.

Fixes: OCPBUGS-82974

- How to verify it

When iri-registry.service is running, push any image to it and you should receive status 405 error:

Error: writing blob: initiating layer upload to /v2/test/image/blobs/uploads/ in localhost:22625: StatusCode: 405, "Method not allowed\n"

- Description for the changelog

Enforce IRI registry read-only mode at the application layer to return 405 instead of 500 on write attempts.

Summary by CodeRabbit

  • New Features

  • Registry service now supports enabling a read-only storage maintenance mode when starting the registry.

  • Tests

  • Added unit test assertions to verify the registry maintenance mode setting is applied correctly.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 14, 2026

/test e2e-agent-compact-ipv4-iso-no-registry
/test unit

@andfasano
Copy link
Copy Markdown
Contributor

/test e2e-agent-compact-ipv4-iso-no-registry

1 similar comment
@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 14, 2026

/test e2e-agent-compact-ipv4-iso-no-registry

@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 15, 2026

/verified by @rwsu

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Apr 15, 2026
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: This PR has been marked as verified by @rwsu.

Details

In response to this:

/verified by @rwsu

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@andfasano
Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 15, 2026
@openshift-merge-bot
Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Apr 15, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andfasano, pawanpinjarkar, rwsu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 15, 2026

e2e-agent-compact-ipv4-iso-no-registry passed
/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 15, 2026
@rwsu
Copy link
Copy Markdown
Contributor Author

rwsu commented Apr 15, 2026

/test e2e-aws-ovn

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD fb2926d and 2 for PR HEAD 1633c52 in total

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Apr 15, 2026

@rwsu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit b589ae5 into openshift:main Apr 15, 2026
19 checks passed
@openshift-ci-robot
Copy link
Copy Markdown
Contributor

@rwsu: Jira Issue Verification Checks: Jira Issue OCPBUGS-82974
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-82974 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

- What I did

Without this change, clients pushing to the IRI registry receive HTTP 500 Internal Server Error. Write requests reach the :ro filesystem mount and fail there, causing the registry to return 500. With REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true' set, push and delete requests are rejected at the application layer with 405 Method Not Allowed instead.

REGISTRY_STORAGE_MAINTENANCE_READONLY_ENABLED=true does not work -- the env var parser produces map[string]interface{} but the registry code expects map[interface{}]interface{} from gopkg.in/yaml.v2, causing a panic. Passing the entire YAML map as the value at path depth 1
(REGISTRY_STORAGE_MAINTENANCE_READONLY='enabled: true') triggers yaml.Unmarshal() and produces the correct type.

Fixes: OCPBUGS-82974

- How to verify it

When iri-registry.service is running, push any image to it and you should receive status 405 error:

Error: writing blob: initiating layer upload to /v2/test/image/blobs/uploads/ in localhost:22625: StatusCode: 405, "Method not allowed\n"

- Description for the changelog

Enforce IRI registry read-only mode at the application layer to return 405 instead of 500 on write attempts.

Summary by CodeRabbit

  • New Features

  • Registry service now supports enabling a read-only storage maintenance mode when starting the registry.

  • Tests

  • Added unit test assertions to verify the registry maintenance mode setting is applied correctly.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants