deckhouse / k8s-image-availability-exporter

Alert if an image used in Kubernetes cannot be pulled from container registry
Apache License 2.0
215 stars 26 forks source link

Use HEAD response statuscode for error checks #46

Closed sboschman closed 2 years ago

sboschman commented 2 years ago

After upgrading from 0.1.17 to 0.2.0 missing images are reported under the 'unknown_error' metric instead of absent==1.

Log:

ERRO[2021-12-06T16:23:08+01:00] HEAD https://registry.example.io/v2/my-example/manifests/my-tag: unexpected status code 404 Not Found (HEAD responses have no body, use GET for details)  availability_mode=unknown_error image_name="registry.example.io/v2/my-example/manifests/my-tag"

availability_mode=unknown_error

The isAbsent check (image_pull.go) checks the Errors field (https://github.com/distribution/distribution/blob/main/docs/spec/api.md#errors), after the GET -> HEAD switch this diagnostic errors field is always empty (HEAD responses have no body, use GET for details). The HEAD request will just return a 404, see https://github.com/distribution/distribution/blob/main/docs/spec/api.md#existing-manifests, so I guess checking the http statuscode is enough.

Log after change:

ERRO[2021-12-06T16:23:08+01:00] HEAD https://registry.example.io/v2/my-example/manifests/my-tag: unexpected status code 404 Not Found (HEAD responses have no body, use GET for details)  availability_mode=absent image_name="registry.example.io/v2/my-example/manifests/my-tag"

availability_mode=absent

Now the image shows up again in the *_absent metric with value 1

zuzzas commented 2 years ago

@sboschman, hi. And thanks for the PR.

Would you mind changing the error checking for other cases in the same file? Or is it not as trivial as 404 code in case of manifest absence?

sboschman commented 2 years ago

Good point, might as well fix those other error checks right away. Based on this info I suppose it is indeed as trivial as checking for 401, 403 and 404 statuscodes in case of a HEAD request.

zuzzas commented 2 years ago

My thanks!