{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/os/issues/353","repository_url":"https://api.github.com/repos/openshift/os","labels_url":"https://api.github.com/repos/openshift/os/issues/353/labels{/name}","comments_url":"https://api.github.com/repos/openshift/os/issues/353/comments","events_url":"https://api.github.com/repos/openshift/os/issues/353/events","html_url":"https://github.com/openshift/os/issues/353","id":367317843,"node_id":"MDU6SXNzdWUzNjczMTc4NDM=","number":353,"title":"AMI tags not shared between accounts","user":{"login":"wking","id":209920,"node_id":"MDQ6VXNlcjIwOTkyMA==","avatar_url":"https://avatars1.githubusercontent.com/u/209920?v=4","gravatar_id":"","url":"https://api.github.com/users/wking","html_url":"https://github.com/wking","followers_url":"https://api.github.com/users/wking/followers","following_url":"https://api.github.com/users/wking/following{/other_user}","gists_url":"https://api.github.com/users/wking/gists{/gist_id}","starred_url":"https://api.github.com/users/wking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wking/subscriptions","organizations_url":"https://api.github.com/users/wking/orgs","repos_url":"https://api.github.com/users/wking/repos","events_url":"https://api.github.com/users/wking/events{/privacy}","received_events_url":"https://api.github.com/users/wking/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-10-05T18:20:25Z","updated_at":"2018-10-05T20:16:56Z","closed_at":null,"author_association":"MEMBER","body":"Spun off from discussion in #314, which landed the tags.  Here are two acounts, rh-dev and the one we use for CI:\r\n\r\n```console\r\n$ AWS_PROFILE=rh-dev aws sts get-caller-identity --query Account --output text\r\n531415883065\r\n$ AWS_PROFILE=ci aws sts get-caller-identity --query Account --output text\r\n460538899914\r\n```\r\n\r\nrh-dev sees alpha tags on AMIs, while CI does not:\r\n\r\n```console\r\n$ AWS_PROFILE=rh-dev AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-images --filters \"Name=tag:rhcos_tag,Values=alpha\" --query 'sort_by(Images, &CreationDate)[-1].Name' --output text\r\nrhcos_dev_4.0.6562-hvm\r\n$ AWS_PROFILE=ci AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-images --filters \"Name=tag:rhcos_tag,Values=alpha\" --query 'sort_by(Images, &CreationDate)[-1].Name' --output text\r\nNone\r\n```\r\n\r\nGet the actual AMI ID:\r\n\r\n```console\r\n$ AWS_PROFILE=rh-dev AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-images --filters \"Name=tag:rhcos_tag,Values=alpha\" --query 'sort_by(Images, &CreationDate)[-1].ImageId' --output text\r\nami-0a08f82608c65f0bc\r\n```\r\n\r\nThe AMI is public:\r\n\r\n```console\r\n$ AWS_PROFILE=rh-dev AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-image-attribute --image-id ami-0a08f82608c65f0bc --attribute launchPermission --output text\r\nami-0a08f82608c65f0bc\r\nLAUNCHPERMISSIONS  all\r\n```\r\n\r\nBut I can't describe it from the CI account:\r\n\r\n```console\r\n$ AWS_PROFILE=ci AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-image-attribute --image-id ami-0a08f82608c65f0bc --attribute launchPermission --output text\r\n\r\nAn error occurred (AuthFailure) when calling the DescribeImageAttribute operation: Not authorized for image:ami-0a08f82608c65f0bc\r\n```\r\n\r\nThe AMI is there for listing:\r\n\r\n```console\r\n$ AWS_PROFILE=ci AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-images --image-ids ami-08b37b9b9700f5a0d --query Images[].Name --output text\r\nrhcos_dev_4.0.6554-hvm\r\n```\r\n\r\nComparing the `descibe-images` output between accounts:\r\n\r\n```console\r\n$ alias get='AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-images --image-ids ami-08b37b9b9700f5a0d --query Images[0] --output json'\r\n$ diff -u <(AWS_PROFILE=rh-dev get) <(AWS_PROFILE=ci get)\r\n--- /dev/fd/632018-10-05 11:18:12.323494210 -0700\r\n+++ /dev/fd/622018-10-05 11:18:12.323494210 -0700\r\n@@ -1,24 +1,6 @@\r\n {\r\n     \"VirtualizationType\": \"hvm\",\r\n     \"Description\": \"Red Hat CoreOS 4.0.6554 (eca924619ba62e615665c6dfda32a12593edb331277aed113ae9217d44746ffd)\",\r\n-    \"Tags\": [\r\n-        {\r\n-            \"Value\": \"alpha\",\r\n-            \"Key\": \"rhcos_tag\"\r\n-        },\r\n-        {\r\n-            \"Value\": \"rhcos_dev_4.0.6554-hvm\",\r\n-            \"Key\": \"Name\"\r\n-        },\r\n-        {\r\n-            \"Value\": \"4.0.6554\",\r\n-            \"Key\": \"ostree_version\"\r\n-        },\r\n-        {\r\n-            \"Value\": \"eca924619ba62e615665c6dfda32a12593edb331277aed113ae9217d44746ffd\",\r\n-            \"Key\": \"ostree_commit\"\r\n-        }\r\n-    ],\r\n     \"Hypervisor\": \"xen\",\r\n     \"EnaSupport\": true,\r\n     \"SriovNetSupport\": \"simple\",\r\n```\r\n\r\nSo why are those tags not visible to me in the CI account?\r\n\r\nCC @miabbott "},"comment":{"url":"https://api.github.com/repos/openshift/os/issues/comments/427486542","html_url":"https://github.com/openshift/os/issues/353#issuecomment-427486542","issue_url":"https://api.github.com/repos/openshift/os/issues/353","id":427486542,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzQ4NjU0Mg==","user":{"login":"ashcrow","id":22706,"node_id":"MDQ6VXNlcjIyNzA2","avatar_url":"https://avatars3.githubusercontent.com/u/22706?v=4","gravatar_id":"","url":"https://api.github.com/users/ashcrow","html_url":"https://github.com/ashcrow","followers_url":"https://api.github.com/users/ashcrow/followers","following_url":"https://api.github.com/users/ashcrow/following{/other_user}","gists_url":"https://api.github.com/users/ashcrow/gists{/gist_id}","starred_url":"https://api.github.com/users/ashcrow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashcrow/subscriptions","organizations_url":"https://api.github.com/users/ashcrow/orgs","repos_url":"https://api.github.com/users/ashcrow/repos","events_url":"https://api.github.com/users/ashcrow/events{/privacy}","received_events_url":"https://api.github.com/users/ashcrow/received_events","type":"User","site_admin":false},"created_at":"2018-10-05T20:16:56Z","updated_at":"2018-10-05T20:16:56Z","author_association":"MEMBER","body":"> So basically, \"we're fine with the installer as it stands and don't need openshift/installer#409 or other ways to select RHCOS channels\"? And you folks can just grant access to whatever internal account (or make the image public) to release it to those users.\r\n\r\nFor customer production usage, yes. There will be one stream now and possibly more later. For people doing testing, kicking the tires, or CI systems, then tagging is as important as noted IMHO."}}
{"actor":{"display_login":"ashcrow"}}