Dashboard: `CreateContainerConfigError` on 0.7.0 release on docker

[CarolynMabbott]

Describe the bug

Dashboard pod wont go into ready state
Has error CreateContainerConfigError in status

Expected behaviour

It doesnt happen

Steps to reproduce the bug

Install 0.7.0 release on docker

Environment details

• Kubernetes Platform:
  
  docker

• Kubernetes or OpenShift version:
  

• Install mode (if on OpenShift):
  
• Cloud-provider/provisioner:
  

• Versions:

  • Tekton Dashboard:
    
    0.7.0

  • Tekton Pipelines:
    

  • Tekton Triggers:
    
• Install namespaces:
  
  
  
  • Tekton Dashboard:
    
    
  
  
  • Tekton Pipelines:
    
    
  
  
  • Tekton Triggers:
    
    
  
  

Additional Info

Dashbaord pod status
tekton-dashboard-95969f65b-fl9h5 0/1 CreateContainerConfigError 0 5m32s
Output from describe dashboard pod

Events:
  Type     Reason     Age                From                     Message
  ----     ------     ----               ----                     -------
  Normal   Scheduled  84s                default-scheduler        Successfully assigned tekton-pipelines/tekton-dashboard-95969f65b-fl9h5 to docker-desktop
  Normal   Pulling    83s                kubelet, docker-desktop  Pulling image "gcr.io/tekton-releases/github.com/tektoncd/dashboard/cmd/dashboard@sha256:1a44d51696970ec16981eeada03c45e73b202d87a680c0a93f6fc3e27f8798b4"
  Normal   Pulled     73s                kubelet, docker-desktop  Successfully pulled image "gcr.io/tekton-releases/github.com/tektoncd/dashboard/cmd/dashboard@sha256:1a44d51696970ec16981eeada03c45e73b202d87a680c0a93f6fc3e27f8798b4"
  Warning  Failed     10s (x7 over 73s)  kubelet, docker-desktop  Error: container has runAsNonRoot and image will run as root
  Normal   Pulled     10s (x6 over 72s)  kubelet, docker-desktop  Container image "gcr.io/tekton-releases/github.com/tektoncd/dashboard/cmd/dashboard@sha256:1a44d51696970ec16981eeada03c45e73b202d87a680c0a93f6fc3e27f8798b4" already present on machine

[a-roberts]

Worth noting this is using the latest staged release candidate at https://console.cloud.google.com/storage/browser/tekton-releases/dashboard/koo/mytestbucket/previous/v0.7.0

[eddycharly]

Released images are built with ko right ?

Using the config in the repo below ?
https://github.com/tektoncd/dashboard/blob/c5e6a8d35b74ee608434c5d0f206f110240da71a/.ko.yaml#L1

[a-roberts]

Released images are built with ko right ?

Using the config in the repo below ?
https://github.com/tektoncd/dashboard/blob/c5e6a8d35b74ee608434c5d0f206f110240da71a/.ko.yaml#L1

Yeah should be

[a-roberts]

@eddycharly do you think we need a

securityContext:
--
  runAsUser: 1000

type stanza somewhere now? The now part is interesting though, I know you mention that image above and wondering if that has a new restriction (so we could fix with a non-root user, which we should do anyway IMO, or use an older version of that image if it is the problem)

[eddycharly]

We shouldn't need it at all as we're using a nonroot base image.
I will dive in the released image to see what happens.

[eddycharly]

I feel like it's an issue when building the release image.
kustomize build overlays/dev | ko apply -f - runs fine locally.

Do you see this line 2020/06/11 14:14:14 Using base gcr.io/distroless/base:nonroot for github.com/tektoncd/dashboard/cmd/dashboardin the release logs ?

[a-roberts]

I feel like it's an issue when building the release image.
kustomize build overlays/dev | ko apply -f - runs fine locally.

Do you see this line 2020/06/11 14:14:14 Using base gcr.io/distroless/base:nonroot for github.com/tektoncd/dashboard/cmd/dashboardin the release logs ?

No, attaching logs here

releaserunbuild.txt
releaserunpublish.txt

I see

Using base gcr.io/distroless/static:latest for github.com/tektoncd/dashboard/cmd/dashboard

[eddycharly]

That's it, it's not a nonroot image

[eddycharly]

Do you know where is the dockerfile for the gcr.io/tekton-releases/dogfooding/ko-gcloud:latest image ?

[a-roberts]

Right, so it's like that file addition is doing nothing - any pointers @afrittoli @vdemeester?

^^

[afrittoli]

It's in the plumbing repo. I'm on my phone now, can give you a link later if you cannot find it.

[eddycharly]

From the logs, it's ko v0.5.0 so that's fine.
Dunno why but either .ko.yaml is not there or ko ignores it.

[eddycharly]

Got it 😄

[eddycharly]

https://github.com/tektoncd/dashboard/blob/a1c6711f5692d358918b60b6cab82fda71578a8c/tekton/build.yml#L49

It's not going to copy hidden files (those that begin with a .) !

[eddycharly]

Ping @a-roberts

[afrittoli]

https://github.com/tektoncd/plumbing/blob/master/tekton/images/ko-gcloud/Dockerfile

[eddycharly]

Thank you @afrittoli we found the issue, in the end it was not related to the image.