Refresh local registry auth info each time when access local registry
Local registry uses admin account password as authentication info. And this password may be changed by openstack client at any time. When sysinv tries to download images from local registry, it cannot cache the auth info, otherwise it may lead to authentication failure in keystone, and account be locked at the end. Partial-Bug: 1853017 Change-Id: I07f273a05a1bc3c08b48d13c94eb6df6aecdf7c3 Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
This commit is contained in:
parent
ea87911c84
commit
423a475aff
|
@ -707,7 +707,6 @@ class AppOperator(object):
|
||||||
|
|
||||||
start = time.time()
|
start = time.time()
|
||||||
try:
|
try:
|
||||||
local_registry_auth = cutils.get_local_docker_registry_auth()
|
|
||||||
with self._lock:
|
with self._lock:
|
||||||
self._docker._retrieve_specified_registries()
|
self._docker._retrieve_specified_registries()
|
||||||
except Exception as e:
|
except Exception as e:
|
||||||
|
@ -719,7 +718,7 @@ class AppOperator(object):
|
||||||
pool = greenpool.GreenPool(size=threads)
|
pool = greenpool.GreenPool(size=threads)
|
||||||
for tag, success in pool.imap(
|
for tag, success in pool.imap(
|
||||||
functools.partial(self._docker.download_an_image,
|
functools.partial(self._docker.download_an_image,
|
||||||
app.name, local_registry_auth),
|
app.name),
|
||||||
images_to_download):
|
images_to_download):
|
||||||
if success:
|
if success:
|
||||||
continue
|
continue
|
||||||
|
@ -2926,7 +2925,7 @@ class DockerHelper(object):
|
||||||
# Failed to get a docker client
|
# Failed to get a docker client
|
||||||
LOG.error("Failed to stop Armada service : %s " % e)
|
LOG.error("Failed to stop Armada service : %s " % e)
|
||||||
|
|
||||||
def download_an_image(self, app_name, local_registry_auth, img_tag):
|
def download_an_image(self, app_name, img_tag):
|
||||||
|
|
||||||
rc = True
|
rc = True
|
||||||
|
|
||||||
|
@ -2939,6 +2938,7 @@ class DockerHelper(object):
|
||||||
|
|
||||||
LOG.info("Image %s download started from local registry" % img_tag)
|
LOG.info("Image %s download started from local registry" % img_tag)
|
||||||
client = docker.APIClient(timeout=INSTALLATION_TIMEOUT)
|
client = docker.APIClient(timeout=INSTALLATION_TIMEOUT)
|
||||||
|
local_registry_auth = cutils.get_local_docker_registry_auth()
|
||||||
auth = '{0}:{1}'.format(local_registry_auth['username'],
|
auth = '{0}:{1}'.format(local_registry_auth['username'],
|
||||||
local_registry_auth['password'])
|
local_registry_auth['password'])
|
||||||
subprocess.check_call(["crictl", "pull", "--creds", auth, img_tag])
|
subprocess.check_call(["crictl", "pull", "--creds", auth, img_tag])
|
||||||
|
@ -2961,6 +2961,9 @@ class DockerHelper(object):
|
||||||
try:
|
try:
|
||||||
# Tag and push the image to the local registry
|
# Tag and push the image to the local registry
|
||||||
client.tag(target_img_tag, img_tag)
|
client.tag(target_img_tag, img_tag)
|
||||||
|
# admin password may be changed by openstack client cmd in parallel.
|
||||||
|
# So we cannot cache auth info, need refresh it each time.
|
||||||
|
local_registry_auth = cutils.get_local_docker_registry_auth()
|
||||||
client.push(img_tag, auth_config=local_registry_auth)
|
client.push(img_tag, auth_config=local_registry_auth)
|
||||||
except Exception as e:
|
except Exception as e:
|
||||||
rc = False
|
rc = False
|
||||||
|
|
|
@ -5344,13 +5344,11 @@ class ConductorManager(service.PeriodicService):
|
||||||
"Upgrade in progress."
|
"Upgrade in progress."
|
||||||
% image_versions.TILLER_IMAGE_VERSION)
|
% image_versions.TILLER_IMAGE_VERSION)
|
||||||
download_image = running_image_name + ":" + image_versions.TILLER_IMAGE_VERSION
|
download_image = running_image_name + ":" + image_versions.TILLER_IMAGE_VERSION
|
||||||
local_registry_auth = cutils.get_local_docker_registry_auth()
|
|
||||||
self._docker._retrieve_specified_registries()
|
self._docker._retrieve_specified_registries()
|
||||||
|
|
||||||
# download the image
|
# download the image
|
||||||
try:
|
try:
|
||||||
img_tag, ret = self._docker.download_an_image("helm",
|
img_tag, ret = self._docker.download_an_image("helm",
|
||||||
local_registry_auth,
|
|
||||||
download_image)
|
download_image)
|
||||||
if not ret:
|
if not ret:
|
||||||
raise Exception
|
raise Exception
|
||||||
|
|
Loading…
Reference in New Issue