WIP: Add controller to update cross image stream tag aliases

[mfojtik]

Today, when you create imagestreamtag alias like:

$ oc import-image openshift/origin-pod:latest --confirm
$ oc tag --source=imagestreamtag origin-pod:latest foo:bar --alias=true
Tag second:foo set up to track origin-pod:latest

The message above is a lie, no tracking is setupped for the origin-pod:latest, the "second:foo" will never update. To prove this:

$ oc tag --source=docker openshift/origin-pod:v3.6.0-alpha.0 test/origin-pod:latest

Then check the second:foo and you will see it still points to previous version of origin-pod:latest.

To fix this we should have a controller that handles relations between aliased image stream and automatically update the status of the aliased image stream to reflect an update in the source image stream.

[mfojtik]

This is currently blocked on 1.6 rebase (I need update to clientset generator to get UpdateStatus()...), however @smarterclayton @soltysh PTAL the idea.

I'm still not sure what to do when the source image stream tag is deleted (should we just stop tracking? should we put some special annotation or status on saying the source image stream was deleted?...)

Also we should probably add shared informer for ImageStreams and re-use it in image import controller (that is the highest PM tech-debt in 3.7).

[ncdc]

You will be getting generated shared informers for all origin types for free in 3.6.

[smarterclayton]

The generic trigger controller will require a shared informer and will remove the deployment and build trigger controllers watch on images.

How do you handle security on this? It looks like I can use this to steal images I don't have access to in other namespaces?

[smarterclayton]

Also, we really need to collapse the secret informers. Probably the most expensive single type right now

[mfojtik]

How do you handle security on this? It looks like I can use this to steal images I don't have access to in other namespaces?

If you had an access to create an alias for the image stream tag that lives in a namespace you have access to, don't you expect that alias to update when the source image stream tag change?

But I see your point, I can change the "from" to point to an image stream that exists in a namespace I don't have access to and the controller will update it to match the tag... I guess I can just forbid updating cross-namespace? (or is there a SAR check if an user who created this image stream have access to other image stream?).

[smarterclayton]

I think this is the reason we didn't do aliases outside of an image stream. :) Do we have a strong use case for aliases inside the namespace? Why wouldn't I just use the image stream as is? On Apr 3, 2017, at 10:54 AM, Michal Fojtik <[email protected]> wrote: How do you handle security on this? It looks like I can use this to steal images I don't have access to in other namespaces? If you had an access to create an alias for the image stream tag that lives in a namespace you have access to, don't you expect that alias to update when the source image stream tag change? But I see your point, I can change the "from" to point to an image stream that exists in a namespace I don't have access to and the controller will update it to match the tag... I guess I can just forbid updating cross-namespace? (or is there a SAR check if an user who created this image stream have access to other image stream?). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#13595 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_pzOP-UnlWXQtlsxwEA4_UhIC7Agjks5rsLOwgaJpZM4Mvz9p> .

[mfojtik]

@smarterclayton in that case, maybe we should remove the --alias completely? or at least change the message to tell users that tag will not be "tracked" but just copied and never updated :-)

and I think I agree, I don't see much use-cases for in-namespace cross-imagestream alias... it kind of make sense for :latest inside image stream...

[smarterclayton]

It's primary use case is to support virtual tags like :latest, :stable, :qa which point to other tags. The intent is that callers resolve it at use time (UI, new-app) to get a long term tag. So if we need to communicate that better we should. On Apr 3, 2017, at 12:21 PM, Michal Fojtik <[email protected]> wrote @smarterclayton <https://github.com/smarterclayton> in that case, maybe we should remove the --alias completely? or at least change the message to tell users that tag will not be "tracked" but just copied and never updated :-) and I think I agree, I don't see much use-cases for in-namespace cross-imagestream alias... it kind of make sense for :latest inside image stream... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#13595 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p516vPbEdu8sF_TJ5MQBsBksQLGhks5rsMgbgaJpZM4Mvz9p> .