Image refresh for services

[github-actions]

Image refresh for services

• FAIL: image-refresh services

[cockpituous]

image-refresh in progress on 1-ci-srv-04.
Log: https://logs.cockpit-project.org/logs/image-refresh-3344-20220508-030404/

[cockpituous]

image-refresh in progress on 1-ci-srv-03.
Log: https://logs.cockpit-project.org/logs/image-refresh-3344-20220508-030404/

[cockpituous]

Task failed: https://logs.cockpit-project.org/logs/image-refresh-3344-20220508-030404/

[cockpituous]

image-refresh in progress on 1-ci-srv-03.
Log: https://logs.cockpit-project.org/logs/image-refresh-3344-20220508-030606/

[cockpituous]

Task failed: https://logs.cockpit-project.org/logs/image-refresh-3344-20220508-030606/

[martinpitt]

Error: initializing source docker://quay.io/bitnami/grafana:latest: reading manifest latest in quay.io/bitnami/grafana: unauthorized: access to the requested resource is not authorized

Ah, that's the same "bitnami images disappeared" issue that we already fixed in https://github.com/cockpit-project/cockpituous/pull/481recently. Just that we can't use the same fix -- we simply can't use docker.io images on our images due to the pull limits.

So we should look for another grafana image somewhere else. In the worst case we need to dig out our old "docker.io to quay.io" image sync workflow, but that's quite some overhead.

[allisonkarlitskaya]

Can't we podman pull ... one time in the image creation and then add --pull=never to the /root/run-grafana script?

I can't imagine anyone gets upset about one pull every 2 weeks when we refresh the services image...

[martinpitt]

We already don't talk to the internet during tests, this is just purely the image creation. It's less about upsetting anyone, it's just that the majority of our infra runs inside the RH VPN -- so eeeeveryone in RH has to share pretty much a single (or very few) pull request limit. We've had plenty of image refreshes fail on the request limit, which is why we had to move to quay.io so hastily back then. We can't go back, sorry.

[mvollmer]

Superseded by #3388.