Unable to use new-app to create from a --docker-image docker (authentication error?)

[benwaine]

I am attempting to use the new app command to create an application, specifying an image from an external repository using the --docker-image argument. The created pod gets stuck on an image pull error.

Based on the error received in the pod event log I'm assuming I have made some invalid assumptions regards how to authenticate against a private repository. I'm reading from this guide.

Error:

Failed to pull image "registry.hub.docker.com/akbenaw/demo-app:latest": rpc error: code = 2 desc = Error response from daemon: {"message":"pull access denied for registry.hub.docker.com/akbenaw/demo-app, repository does not exist or may require 'docker login'"}

Any help would be much appreciated!

Version

oc v3.7.1+ab0f056
kubernetes v1.7.6+a08f5eeb62
features: Basic-Auth

Server https://192.168.99.100:8443
openshift v3.7.1+a8deba5-34
kubernetes v1.7.6+a08f5eeb62

Using docker toolbox for mac.

Steps To Reproduce

Create A Cluster

1. oc cluster up --create-machine

Update config to allow pulling from private docker repository

1. docker cp origin:/var/lib/origin/openshift.local.config .
2. Update the master-config.yaml file to add registry.hub.docker.com

# ....
imagePolicyConfig:
  allowedRegistriesForImport:
  - domainName: registry.hub.docker.com
  - domainName: docker.io
  - domainName: '*.docker.io'
# ....

3. docker cp master-config.yaml origin:/var/lib/origin/openshift.local.config/master/

Restart Cluster

1. oc cluster down
2. oc cluster up --use-existing-config

Build And Push Docker Image

1. docker login registry.hub.docker.com
2. docker build . -t registry.hub.docker.com/akbenaw/demo-app:latest
3. docker push registry.hub.docker.com/akbenaw/demo-app:latest

Create Pull Secret & Add To Default SA

1. oc login https://192.168.99.100:8443 --token=xxxxxxxxxx
2. oc secret new-dockercfg docker-config-akbenaw-rep --docker-email="ben.andersen-waine@xxxxxx.com" --docker-username="akbenaw" --docker-password="xxxxxxxxxxxxx" --docker-server="registry.hub.docker.com"
3. oc secrets link default docker-config-akbenaw-rep --for=pull

Create a new-app

oc new-app --docker-image=registry.hub.docker.com/akbenaw/demo-app --name=demo-app

W0306 16:13:59.343503   56337 newapp.go:440] Could not find an image stream match for "registry.hub.docker.com/akbenaw/demo-app:latest". Make sure that a Docker image with that tag is available on the node for the deployment to succeed.
--> Found Docker image f480e20 (6 hours old) from registry.hub.docker.com for "registry.hub.docker.com/akbenaw/demo-app:latest"

    * This image will be deployed in deployment config "demo-app"
    * Port 8080/tcp will be load balanced by service "demo-app"
      * Other containers can access this service through the hostname "demo-app"

--> Creating resources ...
    deploymentconfig "demo-app" created
    service "demo-app" created
--> Success
    Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:
     'oc expose svc/demo-app'
    Run 'oc status' to view your app.

Current Result

oc describe pos xxxxx

Name:		demo-app-1-dtv9r
Namespace:	myproject
Node:		localhost/10.0.2.15
Start Time:	Tue, 06 Mar 2018 16:14:00 +0000
Labels:		app=demo-app
		deployment=demo-app-1
		deploymentconfig=demo-app
Annotations:	kubernetes.io/created-by={"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicationController","namespace":"myproject","name":"demo-app-1","uid":"60b28c13-2159-11e8-b798-6a87990b...
		openshift.io/deployment-config.latest-version=1
		openshift.io/deployment-config.name=demo-app
		openshift.io/deployment.name=demo-app-1
		openshift.io/generated-by=OpenShiftNewApp
		openshift.io/scc=restricted
Status:		Pending
IP:		172.17.0.3
Created By:	ReplicationController/demo-app-1
Controlled By:	ReplicationController/demo-app-1
Containers:
  demo-app:
    Container ID:
    Image:		registry.hub.docker.com/akbenaw/demo-app:latest
    Image ID:
    Port:		8080/TCP
    State:		Waiting
      Reason:		ErrImagePull
    Ready:		False
    Restart Count:	0
    Environment:	<none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-66nwk (ro)
Conditions:
  Type		Status
  Initialized 	True
  Ready 	False
  PodScheduled 	True
Volumes:
  default-token-66nwk:
    Type:	Secret (a volume populated by a Secret)
    SecretName:	default-token-66nwk
    Optional:	false
QoS Class:	BestEffort
Node-Selectors:	<none>
Tolerations:	<none>
Events:
  FirstSeen	LastSeen	Count	From			SubObjectPath			Type		Reason			Message
  ---------	--------	-----	----			-------------			--------	------			-------
  1m		1m		1	default-scheduler					Normal		Scheduled		Successfully assigned demo-app-1-dtv9r to localhost
  1m		1m		1	kubelet, localhost					Normal		SuccessfulMountVolume	MountVolume.SetUp succeeded for volume "default-token-66nwk"
  1m		20s		3	kubelet, localhost	spec.containers{demo-app}	Normal		Pulling			pulling image "registry.hub.docker.com/akbenaw/demo-app:latest"
  1m		19s		3	kubelet, localhost	spec.containers{demo-app}	Warning		Failed			Failed to pull image "registry.hub.docker.com/akbenaw/demo-app:latest": rpc error: code = 2 desc = Error response from daemon: {"message":"pull access denied for registry.hub.docker.com/akbenaw/demo-app, repository does not exist or may require 'docker login'"}
  1m		19s		3	kubelet, localhost	spec.containers{demo-app}	Warning		Failed			Error: ErrImagePull
  1m		4s		3	kubelet, localhost	spec.containers{demo-app}	Normal		BackOff			Back-off pulling image "registry.hub.docker.com/akbenaw/demo-app:latest"
  1m		4s		3	kubelet, localhost	spec.containers{demo-app}	Warning		Failed			Error: ImagePullBackOff

Expected Result

A functioning application running my demo-app

[jwforres]

@openshift/sig-developer-experience

[bparees]

I think this is a known issue w/ how secrets are created by that command.

Can you try creating a raw secret instead by:

1. do a docker login so your .dockerconfigjson file contains proper creds
2. create a secret via: oc secrets new dockeridsecret .dockerconfigjson=yourconfig.json

?

/cc @juanvallejo

[juanvallejo]

I believe there was a fix for this backported to 3.7, however that commit does not appear to have made it into @benwaine 's specific version of the client

[benwaine]

Apologies for the late response.

Thanks for supplying a resolution!