Skip to content

Fix set_registry_token call for token usa #1370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chandwanitulsi wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix set_registry_token call for token usa #1370

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 22 additions & 3 deletions iib/workers/tasks/build.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
get_bundles_from_deprecation_list,
get_resolved_bundles,
get_resolved_image,
get_images_needing_overwrite_token,
podman_pull,
request_logger,
reset_docker_config,
Expand Down Expand Up @@ -833,10 +834,19 @@ def handle_add_request(
:raises IIBError: if the index image build fails.
"""
_cleanup()
# Resolve bundles to their digests
# Resolve bundles to their digests. Apply overwrite_from_index_token only to same-namespace
# bundles that are not already covered by worker Docker config credentials. That preserves
# broader template auth (e.g. quay.io/namespace) when present, avoids breaking public pulls
# on other namespaces of the same registry, and still allows the overwrite token to pull
# private same-namespace bundles when no other creds exist.
# Do not stamp from_index auth here — this step does not pull from_index; prepare_request
# and later from_index accessors apply the overwrite token for the index itself.
set_request_state(request_id, 'in_progress', 'Resolving the bundles')

with set_registry_token(overwrite_from_index_token, from_index, append=True):
bundles_needing_token = get_images_needing_overwrite_token(from_index, bundles)

def _resolve_bundles() -> None:
nonlocal resolved_bundles
resolved_bundles = get_resolved_bundles(bundles)
verify_labels(resolved_bundles)
if check_related_images:
Expand All @@ -846,6 +856,15 @@ def handle_add_request(
worker_config.iib_related_image_registry_replacement.get(username),
)

resolved_bundles: List[str] = []
if bundles_needing_token:
with set_registry_token(
overwrite_from_index_token, bundles_needing_token, append=True
):
_resolve_bundles()
else:
_resolve_bundles()

# Check if Gating passes for all the bundles
if greenwave_config:
gate_bundles(resolved_bundles, greenwave_config)
Expand All @@ -867,7 +886,7 @@ def handle_add_request(
from_index_resolved = prebuild_info['from_index_resolved']

Opm.set_opm_version(from_index_resolved)
with set_registry_token(overwrite_from_index_token, from_index_resolved):
with set_registry_token(overwrite_from_index_token, from_index_resolved, append=True):
is_fbc = is_image_fbc(from_index_resolved) if from_index else False
if is_fbc:
# logging requested by stakeholders do not delete
Expand Down
22 changes: 17 additions & 5 deletions iib/workers/tasks/build_fbc_operations.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
from iib.workers.tasks.celery import app
from iib.workers.tasks.opm_operations import opm_registry_add_fbc_fragment, Opm
from iib.workers.tasks.utils import (
get_images_needing_overwrite_token,
get_resolved_image,
prepare_request_for_build,
request_logger,
Expand Down Expand Up @@ -69,12 +70,23 @@ def handle_fbc_operation_request(
_cleanup()
set_request_state(request_id, 'in_progress', 'Resolving the fbc fragments')

# Resolve all fbc fragments
# Apply overwrite_from_index_token only to same-namespace fragments that are not already
# covered by worker Docker config credentials. from_index is not pulled here; prepare_request
# and later from_index accessors apply the overwrite token for the index itself.
fragments_needing_token = get_images_needing_overwrite_token(from_index, fbc_fragments)
resolved_fbc_fragments = []
for fbc_fragment in fbc_fragments:
with set_registry_token(overwrite_from_index_token, fbc_fragment, append=True):
resolved_fbc_fragment = get_resolved_image(fbc_fragment)
resolved_fbc_fragments.append(resolved_fbc_fragment)

def _resolve_fbc_fragments() -> None:
for fbc_fragment in fbc_fragments:
resolved_fbc_fragments.append(get_resolved_image(fbc_fragment))

if fragments_needing_token:
with set_registry_token(
overwrite_from_index_token, fragments_needing_token, append=True
):
_resolve_fbc_fragments()
else:
_resolve_fbc_fragments()

prebuild_info = prepare_request_for_build(
request_id,
Expand Down
94 changes: 74 additions & 20 deletions iib/workers/tasks/opm_operations.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -839,14 +839,32 @@ def opm_registry_add_fbc(
ignore_existing=True,
)

_opm_registry_add(
base_dir=base_dir,
index_db=index_db_file,
bundles=bundles,
overwrite_csv=overwrite_csv,
container_tool=container_tool,
graph_update_mode=graph_update_mode,
)
from iib.workers.tasks.utils import get_images_needing_overwrite_token, set_registry_token

# opm registry add pulls bundle images; apply overwrite token for same-namespace
# bundles not already covered by worker Docker config (mirrors opm_index_add).
bundles_needing_token = get_images_needing_overwrite_token(from_index, bundles)
if bundles_needing_token:
with set_registry_token(
overwrite_from_index_token, bundles_needing_token, append=True
):
_opm_registry_add(
base_dir=base_dir,
index_db=index_db_file,
bundles=bundles,
overwrite_csv=overwrite_csv,
container_tool=container_tool,
graph_update_mode=graph_update_mode,
)
else:
_opm_registry_add(
base_dir=base_dir,
index_db=index_db_file,
bundles=bundles,
overwrite_csv=overwrite_csv,
container_tool=container_tool,
graph_update_mode=graph_update_mode,
)

fbc_dir, _ = opm_migrate(index_db=index_db_file, base_dir=base_dir)
# we should keep generating Dockerfile here
Expand Down Expand Up @@ -1020,22 +1038,42 @@ def opm_registry_add_fbc_fragment(
f'Extracting operator packages from {len(fbc_fragments)} fbc fragment(s)',
)

from iib.workers.tasks.utils import get_images_needing_overwrite_token, set_registry_token

# the dir where all the configs from from_index are stored
# this will look like /tmp/iib-**/configs
from_index_configs_dir = get_catalog_dir(from_index=from_index, base_dir=temp_dir)
if overwrite_from_index_token:
with set_registry_token(overwrite_from_index_token, from_index, append=True):
from_index_configs_dir = get_catalog_dir(from_index=from_index, base_dir=temp_dir)
else:
from_index_configs_dir = get_catalog_dir(from_index=from_index, base_dir=temp_dir)
log.info("The content of from_index configs located at %s", from_index_configs_dir)

# Single pass: Extract all fragment paths and operators
# Single pass: Extract all fragment paths and operators. Re-apply overwrite token for
# same-namespace fragments that are not covered by worker Docker config, matching resolve.
fragment_data = []
all_fragment_operators = []

for i, fbc_fragment in enumerate(fbc_fragments):
# fragment path will look like /tmp/iib-**/fbc-fragment-{index}
fragment_path, fragment_operators = extract_fbc_fragment(
temp_dir=temp_dir, fbc_fragment=fbc_fragment, fragment_index=i
)
fragment_data.append((fragment_path, fragment_operators))
all_fragment_operators.extend(fragment_operators)
fragments_needing_token = get_images_needing_overwrite_token(from_index, fbc_fragments)

if fragments_needing_token:
with set_registry_token(
overwrite_from_index_token, fragments_needing_token, append=True
):
for i, fbc_fragment in enumerate(fbc_fragments):
# fragment path will look like /tmp/iib-**/fbc-fragment-{index}
fragment_path, fragment_operators = extract_fbc_fragment(
temp_dir=temp_dir, fbc_fragment=fbc_fragment, fragment_index=i
)
fragment_data.append((fragment_path, fragment_operators))
all_fragment_operators.extend(fragment_operators)
else:
for i, fbc_fragment in enumerate(fbc_fragments):
# fragment path will look like /tmp/iib-**/fbc-fragment-{index}
fragment_path, fragment_operators = extract_fbc_fragment(
temp_dir=temp_dir, fbc_fragment=fbc_fragment, fragment_index=i
)
fragment_data.append((fragment_path, fragment_operators))
all_fragment_operators.extend(fragment_operators)

# Single verification: Check for operators that already exist in the database
operators_in_db, index_db_path = verify_operators_exists(
Expand Down Expand Up @@ -1213,7 +1251,11 @@ def opm_index_add(
# The bundles are not resolved since these are stable tags, and references
# to a bundle image using a digest fails when using the opm command.

from iib.workers.tasks.utils import run_cmd, set_registry_token
from iib.workers.tasks.utils import (
get_images_needing_overwrite_token,
run_cmd,
set_registry_token,
)

bundle_str = ','.join(bundles) or '""'
cmd = [
Expand Down Expand Up @@ -1248,7 +1290,19 @@ def opm_index_add(
log.info('Using force to add bundle(s) to index')
cmd.extend(['--overwrite-latest'])

with set_registry_token(overwrite_from_index_token, from_index, append=True):
# Authenticate to from_index and to same-namespace bundles that are not already covered
# by worker Docker config (needed when opm pulls those bundles after resolve).
token_images: List[str] = []
if from_index:
token_images.append(from_index)
for bundle in get_images_needing_overwrite_token(from_index, bundles):
if bundle not in token_images:
token_images.append(bundle)

if token_images:
with set_registry_token(overwrite_from_index_token, token_images, append=True):
run_cmd(cmd, {'cwd': base_dir}, exc_msg='Failed to add the bundles to the index image')
else:
run_cmd(cmd, {'cwd': base_dir}, exc_msg='Failed to add the bundles to the index image')


Expand Down
Loading
Loading