Investigate OpenShift Container Platform docker/image registry as a source of events

[mnuttall]

This issue is part of Epic #41: 'docker push' as a trigger for Tekton pipelines. In this case, we want to know what it will take to trigger Tekton pipelines as a result of operations on the OpenShift Container Platform container registry. As a preliminary investigation we need to know:

• Does the OCP container registry offer an external API?
• Does it support webhooks? What if any events can be subscribed to?

We don't want to have to poll the registry if there's any way to receive notifications or events from it. We are particularly interested in knowing:

• can we get events or must we poll?
• the names of pushed images
• the tags of pushed images
• the labels on pushed images (from LABEL commands in Dockerfiles)
• what if any other metadata is available
• what credentials must be provided, and how, in order to use the container registry APIs

[akihikokuroda]

So far, I can not find the webhook or REST API for the registry. https://docs.openshift.com/container-platform/4.2/registry/architecture-component-imageregistry.html

[vtereso]

/assign

[vtereso]

So far I found old (v3.5) Openshift registry documentation that specifies a way to get webhooks/notifications on Docker registry events. I found the codebase for the Openshift registry and they are currently still utilizing the docker/distribution standard handlers so this should still work (ref: https://github.com/openshift/image-registry/blob/master/pkg/dockerregistry/server/supermiddleware/app.go#L96 and https://github.com/docker/distribution)./blob/master/registry/handlers/app.go#L159). From what I can tell, neither the docker/distribution repo nor the openshift/image-registry repo make any references to webhooks s.t. https://docs.docker.com/ee/dtr/admin/manage-webhooks/use-the-api/ is likely not supported. I will continue to see if there are any alternatives as well as proof out the notification configuration approach works using a Triggers endpoint.

[vtereso]

I opened an issue and was directed to the new documentation that specifies that ImageStreams should best simulate a webhook like behavior. The image registry will create an ImageStreamMapping when updated, which should update the ImageStream status (although I couldn't find where this was located). As the documentation specifies, the only mechanism to achieve this is to watch the particular ImageStream objects and react. In our case, we could take this image and create/update a deployment through a Pipeline or Task. In this way, we could separate the CI/CD segments of our pipeline.

[mnuttall]

Leaving this open so we can find it, but no further work required at this point.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.