Mirror CCM and CSI images to GCR

[gardener]

Mirror CCM and CSI images to GCR

[rfranzke]

I agree with the image vector argument: This should be enough to overcome the challenges you described. We don't run infrastructure to mirror each and every image that is somewhere referenced in our open-source repositories.

The other extensions already default to gcr for their images, hence I created this issue.

The reason is that we build the CCMs for AWS, Azure, etc. ourselves with https://github.com/gardener/cloud-provider-azure, so we also push the image to our registry. With OpenStack it's different because we don't have to build it and can just consume the communities image.

I suggest closing the issue.

[vpnachev]

There is https://github.com/gardener/gardener-extension-provider-openstack/blob/master/pkg/imagevector/imagevector.go.
It can be controlled via

gardener-extension-provider-openstack/charts/gardener-extension-provider-openstack/values.yaml

Lines 42 to 52 in cd7be7e

	# images:
	# - name: pause-container
	# sourceRepository: github.com/kubernetes/kubernetes/blob/master/build/pause/Dockerfile
	# repository: gcr.io/google_containers/pause-amd64
	# tag: "3.0"
	# version: 1.11.x
	# - name: pause-container
	# sourceRepository: github.com/kubernetes/kubernetes/blob/master/build/pause/Dockerfile
	# repository: gcr.io/google_containers/pause-amd64
	# tag: "3.1"
	# version: ">= 1.12"

.

So whoever wants to avoid the docker limits can overwrite the default images from https://github.com/gardener/gardener-extension-provider-openstack/blob/master/charts/images.yaml.

Is there anything else that you want to add?

[ialidzhikov]

+1, I don't see why we have to maintain the images also in GCR. There is imagevector overwrite and locally (or wherever) you can set it to whatever.

[vlerenc]

At runtime/in production the image vector should always/only pull images from our GCR.

That's to keep the failure domain small and because we are very satisfied with GCR performance and availability (other than Quay/Docker Hub that had downtimes in the past that impacted Gardener before we started mirroring images to our GCR).

[ialidzhikov]

At runtime/in production the image vector should always/only pull images from our GCR.

That's to keep the failure domain small and because we are very satisfied with GCR performance and availability (other than Quay/Docker Hub that had downtimes in the past that impacted Gardener before we started mirroring images to our GCR).

Sure, I agree. But we should not maintain each and every image to GCR just because the imagevector logic can be broken. We had an issue in the imagevector logic and we will fix it. It is just too much effort to double maintain all of similar images and I don't like the idea at all as I shared in similar discussions in the past.

[kon-angelo]

There were a couple of CCloud cases in the recent days, where they hit the dockerhub limit when deploying shoots. It's also a situation that can plague CCloud more than other providers.

Maybe it's not an issue directly of this repo and can be moved to an issue of the landscape, but the problem remains and the images need a more reliable source than DockerHub. The other extensions already default to gcr for their images, hence I created this issue.