{"action":"created","issue":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/9050","repository_url":"https://api.github.com/repos/cockpit-project/cockpit","labels_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/9050/labels{/name}","comments_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/9050/comments","events_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/9050/events","html_url":"https://github.com/cockpit-project/cockpit/issues/9050","id":317949837,"number":9050,"title":"openshift 3.9 regression: image registry whitelist enabled by default and hard to configure","user":{"login":"martinpitt","id":200109,"avatar_url":"https://avatars3.githubusercontent.com/u/200109?v=4","gravatar_id":"","url":"https://api.github.com/users/martinpitt","html_url":"https://github.com/martinpitt","followers_url":"https://api.github.com/users/martinpitt/followers","following_url":"https://api.github.com/users/martinpitt/following{/other_user}","gists_url":"https://api.github.com/users/martinpitt/gists{/gist_id}","starred_url":"https://api.github.com/users/martinpitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinpitt/subscriptions","organizations_url":"https://api.github.com/users/martinpitt/orgs","repos_url":"https://api.github.com/users/martinpitt/repos","events_url":"https://api.github.com/users/martinpitt/events{/privacy}","received_events_url":"https://api.github.com/users/martinpitt/received_events","type":"User","site_admin":false},"labels":[{"id":279643827,"url":"https://api.github.com/repos/cockpit-project/cockpit/labels/knownissue","name":"knownissue","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":273,"created_at":"2018-04-26T09:34:58Z","updated_at":"2018-05-15T09:16:47Z","closed_at":null,"author_association":"MEMBER","body":"This breaks the `check-openshift TestRegistry.testImagestreamImport` test:\r\n```\r\n# echo '{\"apiVersion\":\"v1\",\"kind\":\"ImageStream\",\"metadata\": {\"name\":\"test\"},\"spec\":{\"dockerImageRepository\": \"localhost:5555/juggs\"}}' | oc create -f -\r\nThe ImageStream \"test\" is invalid: spec.dockerImageRepository: Forbidden: registry \"localhost:5555\" not allowed by whitelist: \"172.30.15.225:5000\", \"docker.io:443\", \".docker.io:443\", \".redhat.com:443\", and 5 more ...\r\n```\r\n\r\nThis is frustratingly hard to configure. I asked about that in https://github.com/openshift/origin/issues/19524 . As this works for \"official\" docker/redhat registries, I think it's fine to naughty-override the test for now, to not further block the openshift refreshes (this got dragged on for way too long now)."},"comment":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/comments/389100332","html_url":"https://github.com/cockpit-project/cockpit/issues/9050#issuecomment-389100332","issue_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/9050","id":389100332,"user":{"login":"cockpituous","id":14330603,"avatar_url":"https://avatars1.githubusercontent.com/u/14330603?v=4","gravatar_id":"","url":"https://api.github.com/users/cockpituous","html_url":"https://github.com/cockpituous","followers_url":"https://api.github.com/users/cockpituous/followers","following_url":"https://api.github.com/users/cockpituous/following{/other_user}","gists_url":"https://api.github.com/users/cockpituous/gists{/gist_id}","starred_url":"https://api.github.com/users/cockpituous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cockpituous/subscriptions","organizations_url":"https://api.github.com/users/cockpituous/orgs","repos_url":"https://api.github.com/users/cockpituous/repos","events_url":"https://api.github.com/users/cockpituous/events{/privacy}","received_events_url":"https://api.github.com/users/cockpituous/received_events","type":"User","site_admin":false},"created_at":"2018-05-15T09:16:47Z","updated_at":"2018-05-15T09:16:47Z","author_association":"CONTRIBUTOR","body":"verify/rhel-7-5\nOoops, it happened again<hr>\n```\n# ----------------------------------------------------------------------\n# testImagestreamImport (check_openshift.TestRegistry)\n#\n/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (C.UTF-8)\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nThe connection to the server 10.111.112.101:8443 was refused - did you specify the right host or port?\nNo resources found.\n\nDevTools listening on ws://127.0.0.1:10167/devtools/browser/60d8daed-a8eb-4e51-820b-9511525831b2\n[0515/091408.304788:ERROR:zygote_host_impl_linux.cc(268)] Failed to adjust OOM score of renderer with pid 39543: Permission denied (13)\n[0515/091409.291165:ERROR:zygote_host_impl_linux.cc(268)] Failed to adjust OOM score of renderer with pid 39594: Permission denied (13)\nCDP: {\"source\":\"security\",\"level\":\"error\",\"text\":\"Refused to apply inline style because it violates the following Content Security Policy directive: \\\"default-src 'self' http://127.0.0.2:9291\\\". Either the 'unsafe-inline' keyword, a hash ('sha256-I4l5F4Kq75Yvla5XX3FqfoQO1206LqJ8p8rtQPyLwm4='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.\\n\",\"timestamp\":1526375654913.03,\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":3920,\"stackTrace\":{\"callFrames\":[{\"functionName\":\"html\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":3920,\"columnNumber\":74},{\"functionName\":\"be.(anonymous function)\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":3937,\"columnNumber\":40},{\"functionName\":\"\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":1427,\"columnNumber\":40},{\"functionName\":\"l\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":2475,\"columnNumber\":41},{\"functionName\":\"\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":2483,\"columnNumber\":20},{\"functionName\":\"$eval\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":2799,\"columnNumber\":35},{\"functionName\":\"$digest\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":2752,\"columnNumber\":59},{\"functionName\":\"$apply\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":2821,\"columnNumber\":34},{\"functionName\":\"\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":2660,\"columnNumber\":26},{\"functionName\":\"s\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":945,\"columnNumber\":22},{\"functionName\":\"\",\"scriptId\":\"42\",\"url\":\"http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js\",\"lineNumber\":1037,\"columnNumber\":33}]}}\n> warning: ImageStream \"alltags\" is invalid: spec.dockerImageRepository: Forbidden: registry \"localhost:5555\" not allowed by whitelist: \"172.30.12.185:5000\", \"docker.io:443\", \"*.docker.io:443\", \"*.redhat.com:443\", and 5 more ...\nTraceback (most recent call last):\n  File \"/build/cockpit/test/verify/kubelib.py\", line 1617, in testImagestreamImport\n    b.wait_not_present(\"modal-dialog\")\n  File \"/build/cockpit/test/common/testlib.py\", line 273, in wait_not_present\n    return self.wait_js_func('!ph_is_present', selector)\n  File \"/build/cockpit/test/common/testlib.py\", line 264, in wait_js_func\n    self.wait_js_cond(\"%s(%s)\" % (func, ','.join(map(jsquote, args))))\n  File \"/build/cockpit/test/common/testlib.py\", line 261, in wait_js_cond\n    self.raise_cdp_exception(\"timeout\\nwait_js_cond\", cond, result[\"exceptionDetails\"], trailer)\n  File \"/build/cockpit/test/common/testlib.py\", line 166, in raise_cdp_exception\n    raise Error(\"%s(%s): %s\" % (func, arg, msg))\nError: timeout\nwait_js_cond(!ph_is_present(\"modal-dialog\")): condition did not become true\ncdp: {u'level': u'error', u'url': u'http://127.0.0.2:9291/cockpit/login', u'text': u'Failed to load resource: the server responded with a status of 401 (Authentication failed)', u'source': u'network', u'networkRequestId': u'39594.8', u'timestamp': 1526375649661.43}\ncdp: {u'stackTrace': {u'callFrames': [{u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 74, u'scriptId': u'42', u'functionName': u'html', u'lineNumber': 3920}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 40, u'scriptId': u'42', u'functionName': u'be.(anonymous function)', u'lineNumber': 3937}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 40, u'scriptId': u'42', u'functionName': u'', u'lineNumber': 1427}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 41, u'scriptId': u'42', u'functionName': u'l', u'lineNumber': 2475}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 20, u'scriptId': u'42', u'functionName': u'', u'lineNumber': 2483}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 35, u'scriptId': u'42', u'functionName': u'$eval', u'lineNumber': 2799}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 59, u'scriptId': u'42', u'functionName': u'$digest', u'lineNumber': 2752}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 34, u'scriptId': u'42', u'functionName': u'$apply', u'lineNumber': 2821}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 26, u'scriptId': u'42', u'functionName': u'', u'lineNumber': 2660}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 22, u'scriptId': u'42', u'functionName': u's', u'lineNumber': 945}, {u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'columnNumber': 33, u'scriptId': u'42', u'functionName': u'', u'lineNumber': 1037}]}, u'timestamp': 1526375654913.03, u'level': u'error', u'url': u'http://127.0.0.2:9291/cockpit/$cca90507a8a85bed486f9ad67b96f785a6e91ad7/kubernetes/registry.js', u'text': u'Refused to apply inline style because it violates the following Content Security Policy directive: \"default-src \\'self\\' http://127.0.0.2:9291\". Either the \\'unsafe-inline\\' keyword, a hash (\\'sha256-I4l5F4Kq75Yvla5XX3FqfoQO1206LqJ8p8rtQPyLwm4=\\'), or a nonce (\\'nonce-...\\') is required to enable inline execution. Note also that \\'style-src\\' was not explicitly set, so \\'default-src\\' is used as a fallback.\\n', u'source': u'security', u'lineNumber': 3920}\nwarning: ImageStream \"alltags\" is invalid: spec.dockerImageRepository: Forbidden: registry \"localhost:5555\" not allowed by whitelist: \"172.30.12.185:5000\", \"docker.io:443\", \"*.docker.io:443\", \"*.redhat.com:443\", and 5 more ...\n\nnot ok 79 testImagestreamImport (check_openshift.TestRegistry) # duration: 235s\nWrote screenshot to TestRegistry-testImagestreamImport-rhel-7-5-127.0.0.2-2401-FAIL.png\nWrote HTML dump to TestRegistry-testImagestreamImport-rhel-7-5-127.0.0.2-2401-FAIL.html\nWrote JS log to TestRegistry-testImagestreamImport-rhel-7-5-127.0.0.2-2401-FAIL.js.log\nJournal extracted to TestRegistry-testImagestreamImport-rhel-7-5-127.0.0.2-2401-FAIL.log\nJournal extracted to TestRegistry-testImagestreamImport-openshift-127.0.0.2-2402-FAIL.log\n/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (C.UTF-8)\n```\nFirst occurrence: 2018-05-15T09:16:43.589098 | revision 5c935fe52316d8c4dd1463e575f206055ac0d595, [logs](http://fedorapeople.org/groups/cockpit/logs/pull-9169-20180515-063434-5c935fe5-verify-rhel-7-5/log.html)\nTimes recorded: 1\nLatest occurrences:\n\n- 2018-05-15T09:16:43.589098 | revision 5c935fe52316d8c4dd1463e575f206055ac0d595, [logs](http://fedorapeople.org/groups/cockpit/logs/pull-9169-20180515-063434-5c935fe5-verify-rhel-7-5/log.html)\n"}}
{"actor":{"display_login":"cockpituous"}}