Error 401 when operations take more than 5min

[fjcloud]

Version

$ oc-mirror version
Client Version: version.Info{Major:"", Minor:"", GitVersion:"4.11.0-202210262118.p0.g3c1c80c.assembly.stream-3c1c80c", GitCommit:"3c1c80ca6a5a22b5826c88897e7a9e5acd7c1a96", GitTreeState:"clean", BuildDate:"2022-10-27T00:32:32Z", GoVersion:"go1.18.4", Compiler:"gc", Platform:"linux/amd64"}

What happened?

error: error rendering new refs: render reference "registry.redhat.io/redhat/redhat-operator-index:v4.11": failed to copy: httpReadSeeker: failed open: unexpected status code https://registry.redhat.io/v2/redhat/redhat-operator-index/blobs/sha256:144af1563390e9a694f66e8065b32e12ab836b1412de7fdf423996a229b00d21: 401 Unauthorized - Server message: unauthorized: Access to the requested resource is not authorized

What did you expect to happen?

When operations are too long i experience 401 error

How to reproduce it (as minimally and precisely as possible)?

Use cpulimit to artificially make tasks longer

$  cpulimit -l 1 ./oc-mirror --config config.yml docker://localhost:5000 --dest-skip-tls --dest-use-http --verbose 9

Anything else we need to know?

my config.yml

apiVersion: mirror.openshift.io/v1alpha2
kind: ImageSetConfiguration
storageConfig:
  registry:
    imageURL: localhost:5000/metadata:latest
    skipTLS: true
mirror:
  operators:
    - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.11
      packages:
        - name: loki-operator
        - name: elasticsearch-operator
        - name: odf-operator

I suspect that after 5min auth with registry expire and there no refresh mecanism.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[DerDaku]

Same problem happening here. Slow Internet results in error 401 eventually.

/remove-lifecycle stale

[jritter]

I ran into the same issue. A solution for this would be highly appreciated.

[xymox]

I also ran into the same issue. It seems that expires_in is set to 300 seconds for registry.redhat.io and if there is more than 5 minutes (300 seconds) between the initial token request and a subsequent access to registry.redhat.io, the access is denied due to the expired token.
It happens on slow network (less than 8 Mbits/s bandwidth) which is a quite common setup for disconnected installation.

[DerDaku]

As a workaround for now I pulled the catalog images I want to mirror from using podman, retagged them and pushed them without signatures to my local registry to then use those images as the catalog for oc-mirror.

podman pull registry.redhat.io/redhat/redhat-operator-index:v4.12
podman tag registry.redhat.io/redhat/redhat-operator-index:v4.12 $LOCAL_REGISTRY_URL/redhat/redhat-operator-index:v4.12
podman push $LOCAL_REGISTRY_URL/redhat/redhat-operator-index:v4.12 --remove-signatures

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[joeltraber]

/remove-lifecycle stale

[rchakode]

A solution for this issue would be really appreciated, I'm experiencing the same issue.