search

envoyproxy / gateway

Manages Envoy Proxy as a Standalone or Kubernetes-based Application Gateway
https://gateway.envoyproxy.io
Apache License 2.0
1.61k stars 349 forks source link

Dockerhub OCI issues #4289

Closed mfacenet closed 1 month ago

mfacenet commented 1 month ago

Description: When following the guide to install via helm (slightly modified to run as a helm template command) I get the following error Error: GET "https://registry-1.docker.io/v2/envoyproxy/gateway-helm/tags/list": unable to retrieve credentials I believe this to be related to the ongoing issues that dockerhub is experiencing with rate limits and authentication, however, it could also be related to changes that docker is doing to the dockerhub api's (noted other errors when it comes to our mirroring process for the past 3 days).

Repro steps: helm template eg oci://docker.io/envoyproxy/gateway-helm -n envoy-gateway-system

Environment: n/a

Logs: n/a

mfacenet commented 1 month ago

As a follow on, I'd also like to see the chart in artifcathub.io

arkodg commented 1 month ago

@mfacenet I tried

helm template eg oci://docker.io/envoyproxy/gateway-helm -n envoy-gateway-system --version v1.1.1

and I'm not seeing any issues

If you are being rate limited by Docker Hub, I suggest taking necessary approaches to avoid it like moving the image to a private registry so it doesnt disrupt production or pulling using an account that doesnt get rate limited by Docker Hub

There are no plans to support pushing helm charts to an additional registry

mfacenet commented 1 month ago

@mfacenet I tried

helm template eg oci://docker.io/envoyproxy/gateway-helm -n envoy-gateway-system --version v1.1.1

and I'm not seeing any issues

If you are being rate limited by Docker Hub, I suggest taking necessary approaches to avoid it like moving the image to a private registry so it doesnt disrupt production or pulling using an account that doesnt get rate limited by Docker Hub

not being rate limited, tried this from a personal machine (not vpn'd in to the corp network) as well as a machine in the corporate network and also had another dev try this on their machine, the error seems to be consistent, maybe it's a regional issue?

mfacenet commented 1 month ago

Should also mention that while my machine is docker authed (docker login) the corp machine wasn't

mfacenet commented 1 month ago

helm template eg oci://docker.io/envoyproxy/gateway-helm -n envoy-gateway-system --version v1.1.1

ahh I see, you had to supply the tag, that's not really ideal, this is how we check for upgrades (render templates and if there's a delta they get merged after verification) requiring --version seems to go counter to the ideals that helm offers also with the reliance on docker-credential-desktop helper (to auth to the registry) that limits the ability to deploy this anywhere that isn't running docker "docker" i.e. helm on a machine running containerd