v0.13.0: the place-scripts container can't start on OpenShift

[JustinKuli]

Expected Behavior

The release.notags.yaml should be able to be applied to an OpenShift cluster in order to install Tekton without any changes.

Actual Behavior

Tekton appears to install correctly, but trying to run a Task with a script results in the Pod being stuck at with Error: ErrImagePull status. The problem seems to be in this message:

Failed to pull image "gcr.io/distroless/base:debug@sha256:f79e093f9ba639c957ee857b1ad57ae5046c328998bf8f72b30081db4d8edbe4": rpc error: code = Unknown desc = Invalid image name "gcr.io/distroless/base:debug@sha256:f79e093f9ba639c957ee857b1ad57ae5046c328998bf8f72b30081db4d8edbe4", unknown transport "gcr.io/distroless/base"

Steps to Reproduce the Problem

1. Install Tekton v0.13.0 on OpenShift (In my case, OCP 4.3)

2. Create a Task that uses a script, like this:

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: simple-task
spec:
  resources:
    outputs:
      - name: image
        type: image
  steps:
    - name: aaa
      image: ubuntu
      script: |
        #!/usr/bin/env bash
        sleep 3
        echo "Step aaa will complete successfully..."
        sleep 3

3. Run the Task

Additional Info

• Kubernetes version:

  Output of kubectl version:

# kubectl version
Client Version: version.Info{Major:"1", Minor:"17", GitVersion:"v1.17.3", GitCommit:"06ad960bfd03b39c8310aaf92d1e7c12ce618213", GitTreeState:"clean", BuildDate:"2020-02-13T18:08:14Z", GoVersion:"go1.13.8", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"16+", GitVersion:"v1.16.2", GitCommit:"a02f27a", GitTreeState:"clean", BuildDate:"2020-04-13T12:04:13Z", GoVersion:"go1.12.12", Compiler:"gc", Platform:"linux/amd64"}

# oc version
Client Version: openshift-clients-4.3.0-201910250623-88-g6a937dfe
Server Version: 4.3.13
Kubernetes Version: v1.16.2

• Tekton Pipeline version:

  Output of tkn version or kubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'

# kubectl get pods -n tekton-pipelines -l app=tekton-pipelines-controller -o=jsonpath='{.items[0].metadata.labels.version}'
v0.13.0

Workaround:

I was able to edit the tekton-pipelines-controller Deployment to set the -shell-image to gcr.io/distroless/base@sha256:f79e093f9ba639c957ee857b1ad57ae5046c328998bf8f72b30081db4d8edbe4 instead of gcr.io/distroless/base:debug@sha256:f79e093f9ba639c957ee857b1ad57ae5046c328998bf8f72b30081db4d8edbe4, which resolved the issue.

[vdemeester]

/kind bug

[JustinKuli]

It seems like whatever creates the notags version of the release could/should've gotten this? I'm not sure what goes into creating that. If so, there's probably a better way to fix it than my commit.

If it's as simple as changing config/controller.yaml, then I can open a PR.

[vdemeester]

ohhh I think I know what's going on now… notags is only "driven" by ko but now there is more than this in the yamls… Indeed, we need to update our release script to fix that.

/assign