🐛 [BUG] - latest releases aren't pushed into the GCR

Question

🐛 [BUG] - latest releases aren't pushed into the GCR

Closed this issue 9 months ago · 10 comments

bkamin29 commented 10 months ago

SLO Generator Version

v2.4.0

Python Version

v2.4.0

What happened?

It's seem we having an issue with the GCR, currently we aren't able to pull more recent than v2.4.0..

What did you expect?

I suppose we have an issue when pushing latest image to the GCR, instead of GHCR

Screenshots

No response

Relevant log output

No response

Code of Conduct

I agree to follow this project's Code of Conduct

Answer 1 · 2023-12-08T13:29:07.000Z

Hi @bkamin29, thanks for reporting this. Can you share the output of your docker pull command, or the Cloud Run logs? I do see the images of 2.5.0 and 2.5.1 in the Google Container Registry. Also, which identity do you use to pull the images? One of the three Service Accounts that are allowed to pull, or your own identity?

Answer 2 · 2023-12-08T14:58:06.000Z

Hello Laurent,
this is the result of a docker pull command from my laptop but we encounter the same issue from Cloud RUN.

docker pull gcr.io/slo-generator-ci-a2b4/slo-generator:2.5.2                                                                                                                                                     
Error response from daemon: manifest for gcr.io/slo-generator-ci-a2b4/slo-generator:2.5.2 not found: manifest unknown: Failed to fetch "2.5.2" from request "/v2/slo-generator-ci-a2b4/slo-generator/manifests/2.5.2".

But in the meanwhile, docker pull gcr.io/slo-generator-ci-a2b4/slo-generator:2.4.0 is working will.

Answer 3 · 2023-12-08T15:29:09.000Z

Can you try with 2.5.0 and 2.5.1?

2.5.2 is indeed missing from the Container Registry.

Answer 4 · 2023-12-11T17:35:29.000Z

I'm getting similar error from Google Cloud Run (the service was running before using the same version, now it stopped working)

Google Cloud Run Service Agent service-xzy@serverless-robot-prod.iam.gserviceaccount.com must have permission to read the image, gcr.io/slo-generator-ci-a2b4/slo-generator:2.3.4. Ensure that the provided container image URL is correct and that the above account has permission to access the image.

Answer 5 · 2023-12-11T19:52:31.000Z

Hi @svenmueller, can you share the email(s) of the Service Account(s) that require access to the Container Registry? I also need the Google Workspace customer ID of your GCP Organization, as returned by gcloud organizations list.

For the record, I had to disable public access to the Container Registry after someone in South America generated a lot of traffic by pulling the whole images every 5 minutes. This incurred big charges on Google's side (like 150 USD per day for egress alone). As I was unable to pinpoint the exact identity of the caller (it is an Amazon-owned IP), I decided to grant permissions on a case-by-case basis.

Answer 6 · 2023-12-11T19:53:00.000Z

@bkamin29 Any news to share regarding 2.5.0 and 2.5.1?

Answer 7 · 2023-12-12T08:11:22.000Z

Can you try with 2.5.0 and 2.5.1?

2.5.2 is indeed missing from the Container Registry.

confirmed, 2.5.0 and 2.5.1 are working

Answer 8 · 2023-12-13T11:23:06.000Z

@svenmueller Feel free to share the details on my professional email (my username here, at google dot com) if you do not want to share them here.

Answer 9 · 2023-12-18T14:48:01.000Z

@lvaylet Thx! I've sent an email as you've suggested.

Answer 10 · 2023-12-18T14:55:41.000Z

@svenmueller Thanks a lot. I just granted the required permissions to your identities.