WasmPlugin with ImagePullSecret

msonnleitner · December 22, 2021, 10:10am

I am using Istio 1.12 (Anthos Service mesh with in-cluster control plane) and I am trying to get a Hello World wasm plugin to work. When using an public image, such as New in Istio 1.12: Wasm-based extensions and ecosystem - Tetrate, it works, and I can also pull Kubernetes images in a pod using that given secret.

Has anyone got this working with an imagePullSecret?

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: hello-world
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: hello-world
  url: europe-west1-docker.pkg.dev/REDACTED/test/wasm-hello-world:latest
  imagePullPolicy: Always
  imagePullSecret: regcred
  phase: AUTHN
  pluginConfig:
    aaa: 3

Error message: 2021-12-22T10:01:50.007496Z error wasm cannot fetch Wasm module oci://europe-west1-docker.pkg.dev/REDACTED/test/wasm-hello-world:latest: could not fetch Wasm OCI image: could not fetch image: GET https://europe-west1-docker.pkg.dev/v2/token?scope=repository%3AREDACTED%2Ftest%2Fwasm-hello-world%3Apull&service=europe-west1-docker.pkg.dev: DENIED: Permission “artifactregistry.repositories.downloadArtifacts” denied on resource “projects/REDACTED/locations/europe-west1/repositories/test” (or it may not exist)

msonnleitner · December 22, 2021, 10:34am

Ok it seems it is not yet implemented

github.com

istio/istio/blob/e0207105bb09baf1299a5752b98d83240ba981af/pkg/wasm/cache.go#L146

    
      
          		// Get sha256 checksum and check if it is the same as provided one.
          		sha := sha256.Sum256(b)
          		dChecksum = hex.EncodeToString(sha[:])
          		if checksum != "" && dChecksum != checksum {
          			wasmRemoteFetchCount.With(resultTag.Value(checksumMismatch)).Increment()
          			return "", fmt.Errorf("module downloaded from %v has checksum %v, which does not match: %v", downloadURL, dChecksum, checksum)
          		}
          	case "oci":
          		ctx, cancel := context.WithTimeout(context.Background(), timeout)
          		defer cancel()
          		// TODO: support imagePullSecret and pass it to ImageFetcherOption.
          		fetcher := NewImageFetcher(ctx, ImageFetcherOption{})
          		b, err = fetcher.Fetch(u.Host+u.Path, checksum)
          		if err != nil {
          			if errors.Is(err, errWasmOCIImageDigestMismatch) {
          				wasmRemoteFetchCount.With(resultTag.Value(checksumMismatch)).Increment()
          			} else {
          				wasmRemoteFetchCount.With(resultTag.Value(downloadFailure)).Increment()
          			}
          			return "", fmt.Errorf("could not fetch Wasm OCI image: %v", err)
          		}

Topic		Replies	Views
Using pullImageSecret with the sidecar injector Networking	2	2666	August 14, 2020
Using Azure Container Registry to host istio images Config	1	979	April 27, 2021
Install Istio using container images Contributors	4	3863	September 19, 2020
Istio-proxy container fails after hub set to private repository Config	0	717	February 15, 2022
Trying to Install Multi-Primary but fails at creating remote secret	13	1590	April 9, 2021

WasmPlugin with ImagePullSecret

Related Topics