Skip to content

MGMT-22370: Add exponential backoff to agent image pull #10337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yoavsc0302 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

MGMT-22370: Add exponential backoff to agent image pull #10337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions internal/ignition/discovery.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,22 @@ IMAGE=$(echo $1 | sed 's/[@:].*//')
podman images | grep $IMAGE || podman rmi --force $1 || true
`

const agentPullImage = `#!/usr/bin/sh
Copy link
Copy Markdown
Contributor

@pastequo pastequo May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be a problem if the global timeout is reached while we are pulling the image ?
Coult it corrupt the local container storage ?

Maybe the right approach would be to move the podman pull + podman cp into the ExecStart step

It would be nice to have another opinion on this

Copy link
Copy Markdown
Contributor Author

@yoavsc0302 yoavsc0302 May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding whether the global timeout reached while pulling the image could corrupt the local container storage, let's assume for now it could. This concern exists in today's upstream behavior as well iiuc. This PR hasn't introduced it, since the pull already happens during the 10-minute timeout window in upstream (via the podman run in ExecStartPre).

Now, both in upstream and in this PR, when the 10-minute timeout occurs, systemd restarts the full sequence from ExecStartPre 1 (https://github.com/openshift/assisted-service/blob/master/internal/ignition/templates/agent.service#L14), which runs the BZ1964591 cleanup script (https://github.com/openshift/assisted-service/blob/master/internal/ignition/discovery.go#L95).
Isn't this the exact purpose of this script? To clean up the image in case it got corrupted, so the next pull starts fresh?

IMAGE=$1
DELAY=5
MAX_DELAY=300
podman image exists "$IMAGE" && exit 0
while true; do
podman pull "$IMAGE" && exit 0
echo "Pull failed for $IMAGE, retrying in ${DELAY}s..."
sleep $DELAY
DELAY=$((DELAY * 2))
if [ $DELAY -gt $MAX_DELAY ]; then
DELAY=$MAX_DELAY
fi
done
`

const okdBinariesOverlayTemplate = `#!/bin/env bash
set -eux
# Fetch an image with OKD rpms
Expand Down Expand Up @@ -303,6 +319,7 @@ func (ib *ignitionBuilder) FormatDiscoveryIgnitionFile(ctx context.Context, infr
"PullSecretToken": pullSecretToken,
"AGENT_MOTD": url.PathEscape(agentMessageOfTheDay),
"AGENT_FIX_BZ1964591": url.PathEscape(agentFixBZ1964591),
"AGENT_PULL_IMAGE": url.PathEscape(agentPullImage),
"IPv6_CONF": url.PathEscape(common.Ipv6DuidDiscoveryConf),
"PULL_SECRET": url.PathEscape(infraEnv.PullSecret),
"RH_ROOT_CA": rhCa,
Expand Down
3 changes: 2 additions & 1 deletion internal/ignition/templates/agent.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,8 @@ Environment=no_proxy={{.NoProxy}}{{if .PullSecretToken}}
Environment=PULL_SECRET_TOKEN={{.PullSecretToken}}{{end}}
TimeoutStartSec={{.AgentTimeoutStartSec}}
ExecStartPre=/usr/local/bin/agent-fix-bz1964591 {{.AgentDockerImg}}
ExecStartPre=podman run --privileged --rm -v /usr/local/bin:/hostbin {{.AgentDockerImg}} cp /usr/bin/agent /hostbin
ExecStartPre=/usr/local/bin/agent-pull-image {{.AgentDockerImg}}
ExecStartPre=podman run --pull=never --privileged --rm -v /usr/local/bin:/hostbin {{.AgentDockerImg}} cp /usr/bin/agent /hostbin
ExecStart=/usr/local/bin/agent --url {{.ServiceBaseURL}} --infra-env-id {{.infraEnvId}} --agent-version {{.AgentDockerImg}} --insecure={{.SkipCertVerification}} {{if .HostCACertPath}}--cacert {{.HostCACertPath}}{{end}}

[Unit]
Expand Down
9 changes: 9 additions & 0 deletions internal/ignition/templates/discovery.ign
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,15 @@
},
"contents": { "source": "data:,{{.AGENT_FIX_BZ1964591}}" }
},
{
"overwrite": true,
"path": "/usr/local/bin/agent-pull-image",
"mode": 493,
"user": {
"name": "root"
},
"contents": { "source": "data:,{{.AGENT_PULL_IMAGE}}" }
},
{
"overwrite": true,
"path": "/etc/motd",
Expand Down