imagePullSecrets error (doc or code)

[Hokwang]

Hi,

Sorry this may be a question.

I install tekton pipeline and dashboard today.

install using kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml command

and edit default config following your guide,
because of dockerhub pull rate limit, I need to set imagePullSecrets

Here's some problem.

k edit configmap -n tekton-pipelines config-defaults
apiVersion: v1
data:
  default-pod-template: |
    imagePullSecret:
      - name: dockerhub

and following basic tutorial,

vi task.yaml
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: echo-hello-world
spec:
  steps:
    - name: echo
      image: ubuntu
      command:
        - echo
      args:
        - "Hello World"
k apply -f task.yaml

vi taskrun.yaml
apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  name: echo-hello-world-task-run
spec:
  taskRef:
    name: echo-hello-world
k apply -f taskrun.yaml

k get pod
NAME                                          READY   STATUS             RESTARTS   AGE
echo-hello-world-task-run-pod-wk5np           0/1     ImagePullBackOff   0          2m50s

k describe pod echo-hello-world-task-run-pod-wk5np
<snip>
Warning  Failed     83s (x4 over 2m50s)  kubelet, node-1  Failed to pull image "ubuntu": rpc error: code = Unknown desc = Error response from daemon: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit

Look at your doc, https://github.com/tektoncd/pipeline/blob/master/docs/podtemplates.md#supported-fields
there's imagePullSecret (no last s)

In native, as you know, imagePullSecrets used. (last s)

and look at your code
https://github.com/NikeNano/pipeline/blob/462dde92e9a43da76101283087161439d0e87082/pkg/pod/pod.go#L294
there's ImagePullSecrets (first catipal and last s)

I waste couple of hours~.

• Kubernetes version:
  Output of kubectl version: 1.17.11
• Tekton Pipeline version: 0.19.0

[afrittoli]

Thanks for the report; and thank you for taking the time for tracking down the issue and reporting it ^_^

imagePullsSecrets is a list and should indeed have the trailing s, the documentation has to be fixed.
The lower case i is fine as it is though - while the go name is ImagePullsSecrets, the json mapping has a lower case i (which is the norm):

pipeline/pkg/apis/pipeline/pod/template.go

Line 102 in f530a69

ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

[Hokwang]

@afrittoli Hi, Thanks for your fix. I saw your doc fix.
but I think there's still problem.
working solution is

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-defaults
data:
  default-pod-template: |
    ImagePullSecrets:
      - name: dockerhub

not small i, isn't it?

[Hokwang]

/reopen

[tekton-robot]

@Hokwang: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[Hokwang]

/remove-lifecycle stale

[Hokwang]

@afrittoli
I want to ask once again.
every variable start with big letter now, but it is nice to change small letter, isn't it?

[ghost]

@Hokwang it should be small i in imagePullSecrets. The pod template from the configmap is read into a pod.Template struct with ImagePullSecrets field (

pipeline/pkg/apis/pipeline/pod/template.go

Lines 100 to 102 in e20d249

	// ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

). Notice json:"imagePullSecrets" on the field - this is the field name which should be used. The YAML library we use looks at the json tags on the field name and reads from there. It might support both ImagePullSecrets and imagePullSecrets?

Can you try with the lowercase i and confirm if it works? If it does not then that def seems like a bug to me.

[Hokwang]

@sbwsg I tested. small i does not work.
and I am using now big I.

$ k -n tekton-pipelines get configmap config-defaults -o yaml
apiVersion: v1
data:
  default-pod-template: |
    ImagePullSecrets:
      - name: dockerhub
kind: ConfigMap
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
<snip>
  creationTimestamp: "2021-02-09T07:53:55Z"
  labels:
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipelines
  name: config-defaults
  namespace: tekton-pipelines
  resourceVersion: "177390904"
  selfLink: /api/v1/namespaces/tekton-pipelines/configmaps/config-defaults
  uid: 962b51ec-aff6-418d-ace5-bce5e7352219

[ghost]

I'll have a look at this and see if I can figure out what's happening.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[Hokwang]

@sbwsg did you have a time for find out this issue?

/remove-lifecycle stale

[ghost]

I haven't had a chance yet but still intend to try and reproduce the issue on my side.

[ghost]

@Hokwang I see the imagePullSecrets correctly added to the pod YAML for the taskrun when I use the lowercase 'i' in my defaults configmap.

I followed your steps to reproduce. Here is what I see:

1. Apply defaults configmap:

diff --git a/config/config-defaults.yaml b/config/config-defaults.yaml
index a75dc28ee..e789c6840 100644
--- a/config/config-defaults.yaml
+++ b/config/config-defaults.yaml
@@ -21,6 +21,13 @@ metadata:
     app.kubernetes.io/instance: default
     app.kubernetes.io/part-of: tekton-pipelines
 data:
+  # default-pod-template contains the default pod template to use
+  # TaskRun and PipelineRun, if none is specified. If a pod template
+  # is specified, the default pod template is ignored.
+  default-pod-template: |
+    imagePullSecrets:
+    - name: dockerhub
+

λ kubectl apply -f ./config/config-defaults.yaml

2. Create task and taskrun from your steps.
3. Check the yaml of the pod that is created:

λ k get pods echo-hello-world-task-run-pod-vnmjg -o yaml | grep -C2 "imagePullSecrets"
        f:dnsPolicy: {}
        f:enableServiceLinks: {}
        f:imagePullSecrets:
          .: {}
          k:{"name":"dockerhub"}:
--
--
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  imagePullSecrets:
  - name: dockerhub
  initContainers:

So here the imagePullSecrets has been correctly included in the pod definition from my defaults configmap.

Are you still running Tekton Pipelines 0.19? You could try upgrading and seeing if that resolves your problem?

[ghost]

Additional follow up: it also works me when I use uppercase I for ImagePullSecrets, which is interesting too. But it still works when I use lowercase as well.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.