search

okd-project / okd

The self-managing, auto-upgrading, Kubernetes distribution for everyone
https://okd.io
Apache License 2.0
1.71k stars 294 forks source link

pullSecret issue in OKD4 docs #264

Closed timhughes closed 3 years ago

timhughes commented 4 years ago

Describe the bug [Documentation]

I just saw that OKD4 has been released GA and was having a go at installing it.

https://www.openshift.com/blog/okd4-is-now-generally-available

I have got to the install-config.yaml part and the docs at https://docs.okd.io/latest/installing/installing_bare_metal/installing-bare-metal.html#installation-bare-metal-config-yaml_installing-bare-metal have a spot for a pullSecret but the announcement on https://www.openshift.com/blog/okd4-is-now-generally-available say that a pullSecret is not required. I have tried setting it to false and removing all together and several other idea but they all were causing an error.

With pullSecret set to empty string

openshift-install create manifests --dir=ignition
FATAL failed to fetch Master Machines: failed to load asset "Install Config": invalid "install-config.yaml" file: pullSecret: Invalid value: "": unexpected end of JSON input

With pullSecret set to false

openshift-install create manifests --dir=ignition
FATAL failed to fetch Master Machines: failed to load asset "Install Config": invalid "install-config.yaml" file: pullSecret: Invalid value: "false": json: cannot unmarshal bool into Go value of type validate.imagePullSecret

Eventually found in the restricted docs '{"auths":{"xxxxxxx": {"auth": "xxxxxx","email": "xxxxxx"}}}'

Which allows the ignition files to compile.

The announcement says the following so I am guessing that there is a correct way and the docs haven't caught up yet.

As a community distribution it does not require a pull secret from https://openshift.com/try. All OKD4 images are available without additional authentication.
vrutkovs commented 4 years ago

Right, previously it has been tracked in #182.

Ideally the installer would automatically set a dummy pull secret if its not set, the issue is that its a pretty large change and we had issues during periodic rebase. Hopefully that would be solved in 4.6

It appears we need a:

jkassis commented 4 years ago

image

fager commented 4 years ago

I got the same build-errors with the fake-pull-secret.

OKD Version: 4.5.0-0.okd-2020-08-12-020541 Fake-Pull-Secret used from okd/README.md openshift/php ImageStream changed to https://raw.githubusercontent.com/openshift/library/master/community/php/imagestreams/php-centos7.json because images where not synced from the registy.

Error like mentioned by @jkassis and shown in the attachment

Logfile and BuildConfig: cotd-2-2.log buildconfig-cotd-2.yaml.txt

anjannath commented 3 years ago

@jkandasa @fager Can you try this dummy pull secret instead of the one mentioned in the readme, this should make the validation happy

{"auths":{"fake":{"auth": "Zm9vOmJhcgo="}}}
cgruver commented 3 years ago

I can vouch for that as well. I had to do that for my OKD disconnected install to mirror, as well as for the OKD CRC build.

It's looking for valid base64 that is can parse in the form of user:password.

openshift-bot commented 3 years ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot commented 3 years ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten. Rotten issues close after an additional 30d of inactivity. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten /remove-lifecycle stale

robertoyoc commented 3 years ago

@jkandasa @fager Can you try this dummy pull secret instead of the one mentioned in the readme, this should make the validation happy

{"auths":{"fake":{"auth": "Zm9vOmJhcgo="}}}

@vrutkovs Maybe adding this workaround somewhere in the documentation? It says pull secret its optional but it doesnt' specify how to avoid its validation when installing.

vrutkovs commented 3 years ago

We have it mentioned in https://github.com/openshift/okd#getting-started. I don't think its worth updating docs.okd.io when its clearly a bug

Reamer commented 3 years ago

I have encountered the following error more than three times now. Because the command oc fails, Podman is used to extract the image. Sometimes Podman fails and with it the whole update (Latest Podman error https://github.com/openshift/okd/issues/566). Changing the auth to a parsable structure solves this problem. We should document a parsable dummy authentication.

I0128 13:27:36.063700  353146 run.go:18] Running: nice -- ionice -c 3 oc image extract --path /:/run/mco-machine-os-content/os-content-063878889 --registry-config /var/lib/kubelet/config.json quay.io/openshift/okd-content@sha256:95034a94e28949af41a53b9efb2fbb0651454a7c37bab002b0646e73c4721829
error: unable to load --registry-config: error occurred while trying to unmarshal json
W0128 13:27:36.360277  353146 run.go:44] nice failed: running nice -- ionice -c 3 oc image extract --path /:/run/mco-machine-os-content/os-content-063878889 --registry-config /var/lib/kubelet/config.json quay.io/openshift/okd-content@sha256:95034a94e28949af41a53b9efb2fbb0651454a7c37bab002b0646e73c4721829 failed: error: unable to load --registry-config: error occurred while trying to unmarshal json
Reamer commented 3 years ago

/remove-lifecycle rotten

Reamer commented 3 years ago

/close

openshift-ci-robot commented 3 years ago

@Reamer: You can't close an active issue/PR unless you authored it or you are a collaborator.

In response to [this](https://github.com/openshift/okd/issues/264#issuecomment-810383783): >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
vrutkovs commented 3 years ago

All docs updated to use valid pull secret

andreaskaris commented 3 years ago

Sorry for reopening this, but ...

I do not know which docs were updated, but clearly not this page: https://docs.okd.io/latest/installing/installing_aws/installing-aws-default.html

Nor anything else in docs.okd.io

I'm reopening this because I'd expect that any installation related documentation should also mention 

You will also be prompted for a pull-secret that will be made available to all of of your machines - for OKD4 you should either paste the pull-secret you use for your registry, or paste {"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} to bypass the required value check (see bug #182).

Or that it should clearly point non-RH registered users to a decent way to obtain a pull-secret.

Or how else are non-RH customers supposed to get a valid pull-secret?

fossxplorer commented 3 years ago

@andreaskaris You can create an account for free and obtain the pull secret.

andreaskaris commented 3 years ago

@fossxplorer It's o.k., there really was an issue in our docs and it was fixed with https://github.com/openshift/okd/issues/627