DC: create pod with image from external registry failed on subclouds
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Medium
|
Andy |
Bug Description
Brief Description
-----------------
In a subcloud of DC system, try to create a pod with image from an external registry that has a CA signed certificate will fail, caused by image pulling error. Containerd complains that the registry's certificate is signed by unknown authority, even though the CA certificate is installed in the subcloud.
Severity
--------
Critical
Steps to Reproduce
------------------
- In the subcloud, install the CA certificate that signed the registry's certificate by:
system certificate-install -m ssl_ca <CA cert>
- Create a pod with an image from the registry by commandline or yaml file
Expected Behavior
------------------
The pod launches successfully.
Actual Behavior
----------------
The pod is failed to launch:
- kubectl get pod -n <namespace> will show the pod is in "ErrImagePull" state
- kubectl describe pod <pod name> -n <namespace> will show error:
x509: certificate signed by unknown authority
Reproducibility
---------------
100% reproducible
System Configuration
-------
Any
Branch/Pull Time/Commit
-------
stx master
Last Pass
---------
Unknown
Timestamp/Logs
--------------
Warning Failed 57s (x4 over 2m34s) kubelet, controller-0 Failed to pull image "registry.
Note: The above log is from a DC system where I setup the registry.central as the external registry with a CA signed certificate.
Test Activity
-------------
Developer Testing
Workaround
----------
restart containerd after CA certificate is installed.
systemctl restart containerd
Changed in starlingx: | |
assignee: | nobody → Andy (andy.wrs) |
status: | New → In Progress |
tags: | added: stx.5.0 stx.distcloud |
Fix proposed to branch: master /review. opendev. org/745949
Review: https:/