Merge pull request #19611 from legionus/way-how-to-break-cluster

Add option to ignore image reference errors

Author: openshift-merge-robot

contrib/completions/bash/oc

@@ -160,6 +160,8 @@ type PrunerOptions struct {
 	RegistryClient *http.Client
 	// RegistryURL is the URL of the integrated Docker registry.
 	RegistryURL *url.URL
+	// IgnoreInvalidRefs indicates that all invalid references should be ignored.
+	IgnoreInvalidRefs bool
 }
 
 // Pruner knows how to prune istags, images, layers and image configs.
@@ -173,10 +175,11 @@ type Pruner interface {
 
 // pruner is an object that knows how to prune a data set
 type pruner struct {
-	g              genericgraph.Graph
-	algorithm      pruneAlgorithm
-	registryClient *http.Client
-	registryURL    *url.URL
+	g                 genericgraph.Graph
+	algorithm         pruneAlgorithm
+	registryClient    *http.Client
+	registryURL       *url.URL
+	ignoreInvalidRefs bool
 }
 
 var _ Pruner = &pruner{}
@@ -253,9 +256,10 @@ func NewPruner(options PrunerOptions) (Pruner, kerrors.Aggregate) {
 	algorithm.namespace = options.Namespace
 
 	p := &pruner{
-		algorithm:      algorithm,
-		registryClient: options.RegistryClient,
-		registryURL:    options.RegistryURL,
+		algorithm:         algorithm,
+		registryClient:    options.RegistryClient,
+		registryURL:       options.RegistryURL,
+		ignoreInvalidRefs: options.IgnoreInvalidRefs,
 	}
 
 	if err := p.buildGraph(options); err != nil {
@@ -493,8 +497,10 @@ func (p *pruner) addPodSpecToGraph(referrer *kapi.ObjectReference, spec *kapi.Po
 
 		ref, err := imageapi.ParseDockerImageReference(container.Image)
 		if err != nil {
-			glog.V(4).Infof("Unable to parse DockerImageReference %q of %s: %v - skipping", container.Image, getKindName(referrer), err)
-			errs = append(errs, newErrBadReferenceToImage(container.Image, referrer, err.Error()))
+			glog.Warningf("Unable to parse DockerImageReference %q of %s: %v - skipping", container.Image, getKindName(referrer), err)
+			if !p.ignoreInvalidRefs {
+				errs = append(errs, newErrBadReferenceToImage(container.Image, referrer, err.Error()))
+			}
 			continue
 		}
 
@@ -662,6 +668,25 @@ func (p *pruner) addBuildsToGraph(builds *buildapi.BuildList) []error {
 	return errs
 }
 
+// resolveISTagName parses  and tries to find it in the graph. If the parsing fails,
+// an error is returned. If the istag cannot be found, nil is returned.
+func (p *pruner) resolveISTagName(g genericgraph.Graph, referrer *kapi.ObjectReference, istagName string) (*imagegraph.ImageStreamTagNode, error) {
+	name, tag, err := imageapi.ParseImageStreamTagName(istagName)
+	if err != nil {
+		if p.ignoreInvalidRefs {
+			glog.Warningf("Failed to parse ImageStreamTag name %q: %v", istagName, err)
+			return nil, nil
+		}
+		return nil, newErrBadReferenceTo("ImageStreamTag", istagName, referrer, err.Error())
+	}
+	node := g.Find(imagegraph.ImageStreamTagNodeName(makeISTag(referrer.Namespace, name, tag)))
+	if istNode, ok := node.(*imagegraph.ImageStreamTagNode); ok {
+		return istNode, nil
+	}
+
+	return nil, nil
+}
+
 // addBuildStrategyImageReferencesToGraph ads references from the build strategy's parent node to the image
 // the build strategy references.
 //
@@ -687,23 +712,27 @@ func (p *pruner) addBuildStrategyImageReferencesToGraph(referrer *kapi.ObjectRef
 		}
 		ref, err := imageapi.ParseDockerImageReference(from.Name)
 		if err != nil {
-			msg := fmt.Sprintf("failed to parse DockerImage name %q of %s: %v", from.Name, getKindName(referrer), err)
-			glog.V(4).Infof(msg)
-			return []error{newErrBadReferenceToImage(from.Name, referrer, err.Error())}
+			glog.Warningf("Failed to parse DockerImage name %q of %s: %v", from.Name, getKindName(referrer), err)
+			if !p.ignoreInvalidRefs {
+				return []error{newErrBadReferenceToImage(from.Name, referrer, err.Error())}
+			}
+			return nil
 		}
 		imageID = ref.ID
 
 	case "ImageStreamImage":
 		_, id, err := imageapi.ParseImageStreamImageName(from.Name)
 		if err != nil {
-			msg := fmt.Sprintf("failed to parse ImageStreamImage name %q of %s: %v", from.Name, getKindName(referrer), err)
-			glog.V(4).Infof(msg)
-			return []error{newErrBadReferenceTo("ImageStreamImage", from.Name, referrer, err.Error())}
+			glog.Warningf("Failed to parse ImageStreamImage name %q of %s: %v", from.Name, getKindName(referrer), err)
+			if !p.ignoreInvalidRefs {
+				return []error{newErrBadReferenceTo("ImageStreamImage", from.Name, referrer, err.Error())}
+			}
+			return nil
 		}
 		imageID = id
 
 	case "ImageStreamTag":
-		istNode, err := resolveISTagName(p.g, referrer, from.Name)
+		istNode, err := p.resolveISTagName(p.g, referrer, from.Name)
 		if err != nil {
 			glog.V(4).Infof(err.Error())
 			return []error{err}
@@ -1332,18 +1361,3 @@ func makeISTag(namespace, name, tag string) *imageapi.ImageStreamTag {
 func makeISTagWithStream(is *imageapi.ImageStream, tag string) *imageapi.ImageStreamTag {
 	return makeISTag(is.Namespace, is.Name, tag)
 }
-
-// resolveISTagName parses ImageStreamTag's name and tries to find it in the graph. If the parsing fails,
-// an error is returned. If the istag cannot be found, nil is returned.
-func resolveISTagName(g genericgraph.Graph, referrer *kapi.ObjectReference, istagName string) (*imagegraph.ImageStreamTagNode, error) {
-	name, tag, err := imageapi.ParseImageStreamTagName(istagName)
-	if err != nil {
-		return nil, newErrBadReferenceTo("ImageStreamTag", istagName, referrer, err.Error())
-	}
-	node := g.Find(imagegraph.ImageStreamTagNodeName(makeISTag(referrer.Namespace, name, tag)))
-	if istNode, ok := node.(*imagegraph.ImageStreamTagNode); ok {
-		return istNode, nil
-	}
-
-	return nil, nil
-}

contrib/completions/zsh/oc

@@ -48,6 +48,7 @@ func TestImagePruning(t *testing.T) {
 		pruneOverSizeLimit         *bool
 		allImages                  *bool
 		pruneRegistry              *bool
+		ignoreInvalidRefs          *bool
 		keepTagRevisions           *int
 		namespace                  string
 		images                     imageapi.ImageList
@@ -851,6 +852,34 @@ func TestImagePruning(t *testing.T) {
 			expectedStreamUpdates: []string{"foo/bar|sha256:0000000000000000000000000000000000000000000000000000000000000003"},
 		},
 
+		{
+			name:               "build with ignored bad image reference",
+			pruneOverSizeLimit: newBool(true),
+			ignoreInvalidRefs:  newBool(true),
+			images: testutil.ImageList(
+				testutil.UnmanagedImage("sha256:0000000000000000000000000000000000000000000000000000000000000000", "otherregistry/foo/bar@sha256:0000000000000000000000000000000000000000000000000000000000000000", false, "", ""),
+				testutil.SizedImage("sha256:0000000000000000000000000000000000000000000000000000000000000002", registryHost+"/foo/bar@sha256:0000000000000000000000000000000000000000000000000000000000000002", 100, nil),
+				testutil.SizedImage("sha256:0000000000000000000000000000000000000000000000000000000000000003", registryHost+"/foo/bar@sha256:0000000000000000000000000000000000000000000000000000000000000003", 200, nil),
+			),
+			streams: testutil.StreamList(
+				testutil.Stream(registryHost, "foo", "bar", testutil.Tags(
+					testutil.Tag("latest",
+						testutil.TagEvent("sha256:0000000000000000000000000000000000000000000000000000000000000000", "otherregistry/foo/bar@sha256:0000000000000000000000000000000000000000000000000000000000000000"),
+						testutil.TagEvent("sha256:0000000000000000000000000000000000000000000000000000000000000002", registryHost+"/foo/bar@sha256:0000000000000000000000000000000000000000000000000000000000000002"),
+						testutil.TagEvent("sha256:0000000000000000000000000000000000000000000000000000000000000003", registryHost+"/foo/bar@sha256:0000000000000000000000000000000000000000000000000000000000000003"),
+					),
+				)),
+			),
+			builds: testutil.BuildList(
+				testutil.Build("foo", "build1", "source", "DockerImage", "foo", registryHost+"/foo/bar@sha256:many-zeros-and-3"),
+			),
+			limits: map[string][]*kapi.LimitRange{
+				"foo": testutil.LimitList(100, 200),
+			},
+			expectedImageDeletions: []string{"sha256:0000000000000000000000000000000000000000000000000000000000000003"},
+			expectedStreamUpdates:  []string{"foo/bar|sha256:0000000000000000000000000000000000000000000000000000000000000003"},
+		},
+
 		{
 			name:                "build with bad image reference",
 			builds:              testutil.BuildList(testutil.Build("foo", "build1", "source", "DockerImage", "foo", registryHost+"/foo/bar@invalid-digest")),
@@ -908,14 +937,17 @@ func TestImagePruning(t *testing.T) {
 			if test.pruneRegistry != nil {
 				options.PruneRegistry = test.pruneRegistry
 			}
+			if test.ignoreInvalidRefs != nil {
+				options.IgnoreInvalidRefs = *test.ignoreInvalidRefs
+			}
 			p, err := NewPruner(options)
 			if err != nil {
 				if len(test.expectedErrorString) > 0 {
 					if a, e := err.Error(), test.expectedErrorString; a != e {
 						t.Fatalf("got unexpected error: %q != %q", a, e)
 					}
 				} else {
-					t.Fatalf("got unexpected error: %v", test.expectedErrorString)
+					t.Fatalf("got unexpected error: %v", err)
 				}
 				return
 			} else if len(test.expectedErrorString) > 0 {

pkg/oc/admin/prune/imageprune/prune.go

@@ -119,6 +119,7 @@ type PruneImagesOptions struct {
 	Namespace           string
 	ForceInsecure       bool
 	PruneRegistry       *bool
+	IgnoreInvalidRefs   bool
 
 	ClientConfig    *restclient.Config
 	AppsClient      appsclient.AppsInterface
@@ -166,6 +167,7 @@ func NewCmdPruneImages(f *clientcmd.Factory, parentName, name string, out io.Wri
 	cmd.Flags().StringVar(&opts.RegistryUrlOverride, "registry-url", opts.RegistryUrlOverride, "The address to use when contacting the registry, instead of using the default value. This is useful if you can't resolve or reach the registry (e.g.; the default is a cluster-internal URL) but you do have an alternative route that works. Particular transport protocol can be enforced using '<scheme>://' prefix.")
 	cmd.Flags().BoolVar(&opts.ForceInsecure, "force-insecure", opts.ForceInsecure, "If true, allow an insecure connection to the docker registry that is hosted via HTTP or has an invalid HTTPS certificate. Whenever possible, use --certificate-authority instead of this dangerous option.")
 	cmd.Flags().BoolVar(opts.PruneRegistry, "prune-registry", *opts.PruneRegistry, "If false, the prune operation will clean up image API objects, but the none of the associated content in the registry is removed.  Note, if only image API objects are cleaned up through use of this flag, the only means for subsequently cleaning up registry data corresponding to those image API objects is to employ the 'hard prune' administrative task.")
+	cmd.Flags().BoolVar(&opts.IgnoreInvalidRefs, "ignore-invalid-refs", opts.IgnoreInvalidRefs, "If true, the pruning process will ignore all errors while parsing image references. This means that the pruning process will ignore the intended connection between the object and the referenced image. As a result an image may be incorrectly deleted as unused.")
 
 	return cmd
 }
@@ -388,6 +390,7 @@ func (o PruneImagesOptions) Run() error {
 		RegistryClient:     registryClient,
 		RegistryURL:        registryURL,
 		PruneRegistry:      o.PruneRegistry,
+		IgnoreInvalidRefs:  o.IgnoreInvalidRefs,
 	}
 	if o.Namespace != metav1.NamespaceAll {
 		options.Namespace = o.Namespace