Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
I use k3s in my prod setup. In the namespace I'm using a default deny all network policy. Specifically for my kaniko pod, I added an allowance rule. k3s uses kube-route to enforce network-policies. kube-route uses ip rules. In my case it takes most of the time roughly 1s to apply the policies. This results in the kaniko pod failing to start, as when the push permission check is conducted, the network policy did not add the allowance rule yet.
When disabling the push permission check, the network policy has enough time to be applied.
As in the past with kaniko, there were some problems regarding the push permission check, having the possibility to disable it seems like an adequate solution.
In certain situations disabling the push permission checks yields better performance as well.
I also thought about adding a retry mechanism, but I'm not convinced this is the best approach here, as it would be more complex and ultimately delays the feedback for the user, that a certain build lacks the required push permissions. Additionally, having the possibility to disable the check all together as mentioned previously might in some situations speed up the build.
That basically is the printed error message:
error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "registry-svc:5001/environment/f07b24df-58dd-4a24-bdb5-3e64d9e3bfd4:latest": creating push check transport for registry-svc:5001 failed: Get "https://registry-svc:5001/v2/": dial tcp 10.43.7.253:5001: connect: connection refused; Get "http://registry-svc:5001/v2/": dial tcp 10.43.7.253:5001: connect: connection refused
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide for more details.
Reviewer Notes
Release Notes
Added flag
--skip-push-permission-check
to disable initial push permission check