Skip to content

OCPBUGS-62828: MCO degraded when an empty pull-secret is configured #5486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Dec 15, 2025
+26 −9
Merged

OCPBUGS-62828: MCO degraded when an empty pull-secret is configured #5486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 16 additions & 9 deletions pkg/operator/sync.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2179,16 +2179,23 @@ func (optr *Operator) getImageRegistryPullSecrets() ([]byte, error) {

clusterPullSecretRaw := clusterPullSecret.Data[corev1.DockerConfigJsonKey]

// Add in the cluster pull secret to the JSON map, but convert it to kubernetes.io/dockercfg first
// as the global pull secret is of type kubernetes.io/dockerconfigjson
clusterPullSecretRawOld, err := ctrlcommon.ConvertSecretTodockercfg(clusterPullSecretRaw)
if err != nil {
return nil, fmt.Errorf("failed to convert global pull secret to old format: %w", err)
}
// Handle empty pull-secret gracefully
// Check if the pull-secret is empty or just contains "{}"
// This can happen when users set an empty pull-secret: `oc set data secret/pull-secret '.dockerconfigjson={}'`
if len(clusterPullSecretRaw) > 0 && string(bytes.TrimSpace(clusterPullSecretRaw)) != "{}" {
// Add in the cluster pull secret to the JSON map, but convert it to kubernetes.io/dockercfg first
// as the global pull secret is of type kubernetes.io/dockerconfigjson
clusterPullSecretRawOld, err := ctrlcommon.ConvertSecretTodockercfg(clusterPullSecretRaw)
if err != nil {
return nil, fmt.Errorf("failed to convert global pull secret to old format: %w", err)
}

err = ctrlcommon.MergeDockerConfigstoJSONMap(clusterPullSecretRawOld, dockerConfigJSON.Auths)
if err != nil {
return nil, fmt.Errorf("failed to merge global pull secret: %w", err)
err = ctrlcommon.MergeDockerConfigstoJSONMap(clusterPullSecretRawOld, dockerConfigJSON.Auths)
if err != nil {
return nil, fmt.Errorf("failed to merge global pull secret: %w", err)
}
} else {
klog.V(4).Infof("Skipping merge of empty global pull secret")
}

// Add in a default image registry route for first boot cases; this route won't be provided during a pull
Expand Down
10 changes: 10 additions & 0 deletions pkg/secrets/secrets_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,16 @@ type: kubernetes.io/dockercfg`
bytes: []byte(`{"auths":{}}`),
expected: &DockerConfigJSON{Auths: DockerConfig{}},
},
{
Copy link
Member

@cheesesashimi cheesesashimi Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

praise: Thanks for adding these test cases!

name: "Empty JSON object without auths key",
bytes: []byte(`{}`),
expected: &DockerConfigJSON{Auths: nil},
},
{
name: "JSON null literal",
bytes: []byte(`null`),
errExpected: true,
},
{
name: "Invalid K8s object bytes",
bytes: []byte(`{"kind":"ConfigMap","apiVersion":"v1","metadata":{"name":"configmap"},"data":{"key":"value"}}`),
Expand Down