How to Override this image - registry.redhat.io/ubi8/ubi-minimal in pipelinerun/taskrun pod

[seema-sandeep-jaisinghani-db]

Hi Team,

I am trying to use tekton in our project as POC.
We have our own secure image registry we are not allwoed to use registr.redhad.io.
For my sample pipeline, code fails with obvious error as we are not allowed to use public reistries - Failed to pull image "registry.redhat.io/ubi8/ubi-minimal@sha256:6910799b75ad41f00891978575a0d955be2f800c51b955af73926e7ab59a41c3": rpc error: code = Unknown desc = pinging container registry registry.redhat.io: Get "https://registry.redhat.io/v2/":

We have ubi-minimal image in our private registry, is ther ea way to override this image with registry value somewhere in tekton custom resources?

Much appreciate input on this!

[AlanGreene]

The image used is defined in your Task, either in spec.steps[].image or spec.stepTemplate.image.

You can update that value to point to a different registry as needed.

For example: image: my-registry.example.com/some-image
If you require authentication to access your private registry also ensure you have the imagePullSecrets configured correctly

See https://tekton.dev/docs/pipelines/tasks/#defining-steps

If the image referenced in the step field is from a private registry, TaskRuns or PipelineRuns that consume the task must provide the imagePullSecrets in a podTemplate.

[seema-sandeep-jaisinghani-db]

@AlanGreene THank you for your response, but my task has image specified for ubuntu. But when executed pipelineRUn it fails for this image - registry.redhat.io/ubi8/ubi-minimal

I could see in operators the ClusterServiceVersion has this image:

Please find below tasks and pipeline run used for reference.
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: echo-hello
spec:
steps:
- name: echo
image: ubuntu
script: |
#!/usr/bin/env bash
echo "Hello Seema"

and pipeline as this -
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
name: vlm
spec:
params:

• name: HELLO
  value: "Hello World!"
• name: BYE
  value: "Bye World!"
  pipelineSpec:
  tasks:
  • name: echo-hello
    taskRef:
    name: echo-hello

[AlanGreene]

Looking at tektoncd/operator#610 is seems like the source for the images used might be configurable by setting those environment variables: https://github.com/tektoncd/operator/blob/1fc53701027612210cae7a11eb374c381eda104e/operatorhub/openshift/release-artifacts/bundle/manifests/openshift-pipelines-operator-rh.clusterserviceversion.yaml#L852-L905

This seems to be specific to the operator so probably better asked in https://github.com/tektoncd/operator. Hopefully one of the maintainers there can confirm the current status of that functionality or an alternative.

[seema-sandeep-jaisinghani-db]

@AlanGreene Thanks you for heads up, I will follow up with operator discussion.

[AlanGreene]

New discussion in Operator repo: tektoncd/operator#1542
This one can probably be closed / marked resolved now.

[seema-sandeep-jaisinghani-db]

@AlanGreene Adding the pod yaml that gets generated as a part of taskrun for above mentioned echo-hello task. I have modified the echo-hello task for the needed ubi-minimal image in our private registry.

Updated task.yaml
apiVersion: tekton.dev/v1beta1 kind: Task metadata: name: echo-hello spec: steps: - name: echo image: docker-registry.default.svc:5000/fabric-vendor-images/ubi8-minimal:8.7-1049.1675784874 script: | #!/usr/bin/env bash echo "Hello Seema"

TAskRun POD YML ->

kind: Pod apiVersion: v1 metadata: annotations: k8s.ovn.org/pod-networks: >- {"default":{"ip_addresses":["240.0.4.153/24"],"mac_address":"0a:58:f0:00:04:99","gateway_ips":["240.0.4.1"],"ip_address":"240.0.4.153/24","gateway_ip":"240.0.4.1"}} k8s.v1.cni.cncf.io/network-status: |- [{ "name": "ovn-kubernetes", "interface": "eth0", "ips": [ "240.0.4.153" ], "mac": "0a:58:f0:00:04:99", "default": true, "dns": {} }] k8s.v1.cni.cncf.io/networks-status: |- [{ "name": "ovn-kubernetes", "interface": "eth0", "ips": [ "240.0.4.153" ], "mac": "0a:58:f0:00:04:99", "default": true, "dns": {} }] kubectl.kubernetes.io/last-applied-configuration: > {"apiVersion":"tekton.dev/v1beta1","kind":"PipelineRun","metadata":{"annotations":{},"name":"vlm","namespace":"tekton-pipelines"},"spec":{"params":[{"name":"HELLO","value":"Hello World!"},{"name":"BYE","value":"Bye World!"}],"pipelineSpec":{"tasks":[{"name":"echo-hello","taskRef":{"name":"echo-hello"}}]}}} kubernetes.io/limit-ranger: >- LimitRanger plugin set: memory limit for container step-echo; memory request for init container prepare; memory limit for init container prepare; memory request for init container place-scripts; memory limit for init container place-scripts openshift.io/scc: pipelines-scc pipeline.tekton.dev/release: 9ec444e resourceVersion: '462288455' name: vlm-echo-hello-pod uid: 9a6dcef3-278c-4e3b-9a33-6b60e549e9b9 creationTimestamp: '2023-06-02T11:30:59Z' managedFields: - manager: openshift-pipelines-controller operation: Update apiVersion: v1 time: '2023-06-02T11:30:59Z' fieldsType: FieldsV1 fieldsV1: 'f:metadata': 'f:annotations': .: {} 'f:kubectl.kubernetes.io/last-applied-configuration': {} 'f:pipeline.tekton.dev/release': {} 'f:labels': .: {} 'f:app.kubernetes.io/managed-by': {} 'f:tekton.dev/memberOf': {} 'f:tekton.dev/pipeline': {} 'f:tekton.dev/pipelineRun': {} 'f:tekton.dev/pipelineTask': {} 'f:tekton.dev/task': {} 'f:tekton.dev/taskRun': {} 'f:ownerReferences': .: {} 'k:{"uid":"98c42c72-d228-44a5-a157-4c09ce08a4ee"}': {} 'f:spec': 'f:volumes': 'k:{"name":"tekton-internal-run-0"}': .: {} 'f:emptyDir': {} 'f:name': {} 'k:{"name":"tekton-internal-secret-volume-pipeline-dockercfg-fwvdt-f4px2"}': .: {} 'f:name': {} 'f:secret': .: {} 'f:defaultMode': {} 'f:secretName': {} 'k:{"name":"tekton-creds-init-home-0"}': .: {} 'f:emptyDir': .: {} 'f:medium': {} 'f:name': {} 'k:{"name":"tekton-internal-workspace"}': .: {} 'f:emptyDir': {} 'f:name': {} 'k:{"name":"tekton-internal-results"}': .: {} 'f:emptyDir': {} 'f:name': {} .: {} 'k:{"name":"tekton-internal-steps"}': .: {} 'f:emptyDir': {} 'f:name': {} 'k:{"name":"tekton-internal-bin"}': .: {} 'f:emptyDir': {} 'f:name': {} 'k:{"name":"tekton-internal-scripts"}': .: {} 'f:emptyDir': {} 'f:name': {} 'k:{"name":"tekton-internal-downward"}': .: {} 'f:downwardAPI': .: {} 'f:defaultMode': {} 'f:items': {} 'f:name': {} 'k:{"name":"tekton-internal-home"}': .: {} 'f:emptyDir': {} 'f:name': {} 'f:containers': 'k:{"name":"step-echo"}': 'f:image': {} 'f:volumeMounts': 'k:{"mountPath":"/tekton/downward"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:readOnly': {} 'k:{"mountPath":"/workspace"}': .: {} 'f:mountPath': {} 'f:name': {} 'k:{"mountPath":"/tekton/home"}': .: {} 'f:mountPath': {} 'f:name': {} 'k:{"mountPath":"/tekton/results"}': .: {} 'f:mountPath': {} 'f:name': {} .: {} 'k:{"mountPath":"/tekton/creds"}': .: {} 'f:mountPath': {} 'f:name': {} 'k:{"mountPath":"/tekton/bin"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:readOnly': {} 'k:{"mountPath":"/tekton/steps"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:readOnly': {} 'k:{"mountPath":"/tekton/creds-secrets/pipeline-dockercfg-fwvdt"}': .: {} 'f:mountPath': {} 'f:name': {} 'k:{"mountPath":"/tekton/scripts"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:readOnly': {} 'k:{"mountPath":"/tekton/run/0"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:terminationMessagePolicy': {} .: {} 'f:resources': .: {} 'f:requests': .: {} 'f:memory': {} 'f:args': {} 'f:command': {} 'f:terminationMessagePath': {} 'f:imagePullPolicy': {} 'f:name': {} 'f:dnsPolicy': {} 'f:serviceAccount': {} 'f:restartPolicy': {} 'f:activeDeadlineSeconds': {} 'f:schedulerName': {} 'f:terminationGracePeriodSeconds': {} 'f:initContainers': .: {} 'k:{"name":"place-scripts"}': 'f:image': {} 'f:volumeMounts': .: {} 'k:{"mountPath":"/tekton/bin"}': .: {} 'f:mountPath': {} 'f:name': {} 'k:{"mountPath":"/tekton/scripts"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:terminationMessagePolicy': {} .: {} 'f:resources': {} 'f:args': {} 'f:command': {} 'f:terminationMessagePath': {} 'f:imagePullPolicy': {} 'f:name': {} 'k:{"name":"prepare"}': 'f:image': {} 'f:volumeMounts': .: {} 'k:{"mountPath":"/tekton/bin"}': .: {} 'f:mountPath': {} 'f:name': {} 'k:{"mountPath":"/tekton/steps"}': .: {} 'f:mountPath': {} 'f:name': {} 'f:terminationMessagePolicy': {} .: {} 'f:workingDir': {} 'f:resources': {} 'f:command': {} 'f:terminationMessagePath': {} 'f:imagePullPolicy': {} 'f:name': {} 'f:serviceAccountName': {} 'f:enableServiceLinks': {} 'f:securityContext': {} - manager: ukgcpf1-lfq45-master-2 operation: Update apiVersion: v1 time: '2023-06-02T11:30:59Z' fieldsType: FieldsV1 fieldsV1: 'f:metadata': 'f:annotations': 'f:k8s.ovn.org/pod-networks': {} - manager: kubelet operation: Update apiVersion: v1 time: '2023-06-02T11:31:02Z' fieldsType: FieldsV1 fieldsV1: 'f:status': 'f:conditions': 'k:{"type":"ContainersReady"}': .: {} 'f:lastProbeTime': {} 'f:lastTransitionTime': {} 'f:message': {} 'f:reason': {} 'f:status': {} 'f:type': {} 'k:{"type":"Initialized"}': .: {} 'f:lastProbeTime': {} 'f:lastTransitionTime': {} 'f:message': {} 'f:reason': {} 'f:status': {} 'f:type': {} 'k:{"type":"Ready"}': .: {} 'f:lastProbeTime': {} 'f:lastTransitionTime': {} 'f:message': {} 'f:reason': {} 'f:status': {} 'f:type': {} 'f:containerStatuses': {} 'f:hostIP': {} 'f:initContainerStatuses': {} 'f:podIP': {} 'f:podIPs': .: {} 'k:{"ip":"240.0.4.153"}': .: {} 'f:ip': {} 'f:startTime': {} subresource: status - manager: multus operation: Update apiVersion: v1 time: '2023-06-02T11:31:02Z' fieldsType: FieldsV1 fieldsV1: 'f:metadata': 'f:annotations': 'f:k8s.v1.cni.cncf.io/network-status': {} 'f:k8s.v1.cni.cncf.io/networks-status': {} subresource: status namespace: tekton-pipelines ownerReferences: - apiVersion: tekton.dev/v1beta1 kind: TaskRun name: vlm-echo-hello uid: 98c42c72-d228-44a5-a157-4c09ce08a4ee controller: true blockOwnerDeletion: true labels: app.kubernetes.io/managed-by: tekton-pipelines tekton.dev/memberOf: tasks tekton.dev/pipeline: vlm tekton.dev/pipelineRun: vlm tekton.dev/pipelineTask: echo-hello tekton.dev/task: echo-hello tekton.dev/taskRun: vlm-echo-hello spec: restartPolicy: Never activeDeadlineSeconds: 5400 initContainers: - resources: limits: memory: 1Gi requests: memory: 50Mi terminationMessagePath: /dev/termination-log name: prepare command: - /ko-app/entrypoint - init - /ko-app/entrypoint - /tekton/bin/entrypoint - step-echo securityContext: capabilities: drop: - MKNOD allowPrivilegeEscalation: false imagePullPolicy: IfNotPresent volumeMounts: - name: tekton-internal-bin mountPath: /tekton/bin - name: tekton-internal-steps mountPath: /tekton/steps - name: kube-api-access-8bwdd readOnly: true mountPath: /var/run/secrets/kubernetes.io/serviceaccount terminationMessagePolicy: File image: >- registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:08cbd580243004da2e2376a0af1d6496ad9e6ef2e42da951fbdbadc0dca30c69 workingDir: / - resources: limits: memory: 1Gi requests: memory: 50Mi terminationMessagePath: /dev/termination-log name: place-scripts command: - sh securityContext: capabilities: drop: - MKNOD allowPrivilegeEscalation: false imagePullPolicy: IfNotPresent volumeMounts: - name: tekton-internal-scripts mountPath: /tekton/scripts - name: tekton-internal-bin mountPath: /tekton/bin - name: kube-api-access-8bwdd readOnly: true mountPath: /var/run/secrets/kubernetes.io/serviceaccount terminationMessagePolicy: File image: >- registry.redhat.io/ubi8/ubi-minimal@sha256:6910799b75ad41f00891978575a0d955be2f800c51b955af73926e7ab59a41c3 args: - '-c' - | scriptfile="/tekton/scripts/script-0-hnl67" touch ${scriptfile} && chmod +x ${scriptfile} cat > ${scriptfile} << '_EOF_' IyEvdXNyL2Jpbi9lbnYgYmFzaAplY2hvICJIZWxsbyBTZWVtYSIK _EOF_ /tekton/bin/entrypoint decode-script "${scriptfile}" serviceAccountName: pipeline imagePullSecrets: - name: pipeline-dockercfg-fwvdt priority: 0 schedulerName: default-scheduler enableServiceLinks: true terminationGracePeriodSeconds: 30 preemptionPolicy: PreemptLowerPriority nodeName: ukgcpf1-lfq45-worker-a-tvqpf securityContext: seLinuxOptions: level: 's0:c67,c29' fsGroup: 1004480000 containers: - resources: limits: memory: 1Gi requests: memory: 50Mi terminationMessagePath: /tekton/termination name: step-echo command: - /tekton/bin/entrypoint env: - name: HTTPS_PROXY value: 'http://test.com:8080' - name: HTTP_PROXY value: 'http://test.com:8080' - name: NO_PROXY value: >- .cluster.local,.svc,100.110.32.160/28,100.110.35.0/24,127.0.0.1,169.254.169.254,240.0.0.0/15,240.2.0.0/15,api-int.ukgcpf1.frt.fabric.gcp.test.com,dev.paas.gcp.db.com,frt.fabric.gcp.test.com,localhost,metadata,metadata.google.internal,metadata.google.internal. - name: SSL_CERT_DIR value: >- /tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts securityContext: capabilities: drop: - MKNOD allowPrivilegeEscalation: false imagePullPolicy: IfNotPresent volumeMounts: - name: tekton-internal-scripts readOnly: true mountPath: /tekton/scripts - name: tekton-internal-downward readOnly: true mountPath: /tekton/downward - name: tekton-creds-init-home-0 mountPath: /tekton/creds - name: tekton-internal-run-0 mountPath: /tekton/run/0 - name: tekton-internal-bin readOnly: true mountPath: /tekton/bin - name: tekton-internal-workspace mountPath: /workspace - name: tekton-internal-home mountPath: /tekton/home - name: tekton-internal-results mountPath: /tekton/results - name: tekton-internal-steps readOnly: true mountPath: /tekton/steps - name: tekton-internal-secret-volume-pipeline-dockercfg-fwvdt-f4px2 mountPath: /tekton/creds-secrets/pipeline-dockercfg-fwvdt - name: kube-api-access-8bwdd readOnly: true mountPath: /var/run/secrets/kubernetes.io/serviceaccount - name: config-trusted-cabundle-volume readOnly: true mountPath: /tekton-custom-certs/ca-bundle.crt subPath: ca-bundle.crt - name: config-service-cabundle-volume readOnly: true mountPath: /tekton-custom-certs/service-ca.crt subPath: service-ca.crt terminationMessagePolicy: File image: >- docker-registry.default.svc:5000/fabric-vendor-images/ubi8-minimal:8.7-1049.1675784874 args: - '-wait_file' - /tekton/downward/ready - '-wait_file_content' - '-post_file' - /tekton/run/0/out - '-termination_path' - /tekton/termination - '-step_metadata_dir' - /tekton/run/0/status - '-docker-cfg=pipeline-dockercfg-fwvdt' - '-entrypoint' - /tekton/scripts/script-0-hnl67 - '--' serviceAccount: pipeline volumes: - name: tekton-internal-workspace emptyDir: {} - name: tekton-internal-home emptyDir: {} - name: tekton-internal-results emptyDir: {} - name: tekton-internal-steps emptyDir: {} - name: tekton-internal-secret-volume-pipeline-dockercfg-fwvdt-f4px2 secret: secretName: pipeline-dockercfg-fwvdt defaultMode: 420 - name: tekton-internal-scripts emptyDir: {} - name: tekton-internal-bin emptyDir: {} - name: tekton-internal-downward downwardAPI: items: - path: ready fieldRef: apiVersion: v1 fieldPath: 'metadata.annotations[''tekton.dev/ready'']' defaultMode: 420 - name: tekton-creds-init-home-0 emptyDir: medium: Memory - name: tekton-internal-run-0 emptyDir: {} - name: kube-api-access-8bwdd projected: sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: name: kube-root-ca.crt items: - key: ca.crt path: ca.crt - downwardAPI: items: - path: namespace fieldRef: apiVersion: v1 fieldPath: metadata.namespace - configMap: name: openshift-service-ca.crt items: - key: service-ca.crt path: service-ca.crt defaultMode: 420 - name: config-trusted-cabundle-volume configMap: name: config-trusted-cabundle items: - key: ca-bundle.crt path: ca-bundle.crt defaultMode: 420 - name: config-service-cabundle-volume configMap: name: config-service-cabundle items: - key: service-ca.crt path: service-ca.crt defaultMode: 420 dnsPolicy: ClusterFirst tolerations: - key: node.kubernetes.io/not-ready operator: Exists effect: NoExecute tolerationSeconds: 300 - key: node.kubernetes.io/unreachable operator: Exists effect: NoExecute tolerationSeconds: 300 - key: node.kubernetes.io/memory-pressure operator: Exists effect: NoSchedule status: containerStatuses: - name: step-echo state: waiting: reason: PodInitializing lastState: {} ready: false restartCount: 0 image: >- docker-registry.default.svc:5000/fabric-vendor-images/ubi8-minimal:8.7-1049.1675784874 imageID: '' started: false qosClass: Burstable podIPs: - ip: 240.0.4.153 podIP: 240.0.4.153 hostIP: 100.110.35.20 startTime: '2023-06-02T11:30:59Z' initContainerStatuses: - name: prepare state: terminated: exitCode: 0 reason: Completed startedAt: '2023-06-02T11:31:02Z' finishedAt: '2023-06-02T11:31:02Z' containerID: >- cri-o://feaabf0a61d6b700eeba3d8b2161f389845c7f71404dcb643adc4ab669086c59 lastState: {} ready: true restartCount: 0 image: >- registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:08cbd580243004da2e2376a0af1d6496ad9e6ef2e42da951fbdbadc0dca30c69 imageID: >- registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:08cbd580243004da2e2376a0af1d6496ad9e6ef2e42da951fbdbadc0dca30c69 containerID: 'cri-o://feaabf0a61d6b700eeba3d8b2161f389845c7f71404dcb643adc4ab669086c59' - name: place-scripts state: waiting: reason: ImagePullBackOff message: >- Back-off pulling image "registry.redhat.io/ubi8/ubi-minimal@sha256:6910799b75ad41f00891978575a0d955be2f800c51b955af73926e7ab59a41c3" lastState: {} ready: false restartCount: 0 image: >- registry.redhat.io/ubi8/ubi-minimal@sha256:6910799b75ad41f00891978575a0d955be2f800c51b955af73926e7ab59a41c3 imageID: '' conditions: - type: Initialized status: 'False' lastProbeTime: null lastTransitionTime: '2023-06-02T11:30:59Z' reason: ContainersNotInitialized message: 'containers with incomplete status: [place-scripts]' - type: Ready status: 'False' lastProbeTime: null lastTransitionTime: '2023-06-02T11:30:59Z' reason: ContainersNotReady message: 'containers with unready status: [step-echo]' - type: ContainersReady status: 'False' lastProbeTime: null lastTransitionTime: '2023-06-02T11:30:59Z' reason: ContainersNotReady message: 'containers with unready status: [step-echo]' - type: PodScheduled status: 'True' lastProbeTime: null lastTransitionTime: '2023-06-02T11:30:59Z' phase: Pending