article ImagePullBackoff error on OneAgent and ActiveGate pods in Troubleshooting

ImagePullBackoff error on OneAgent and ActiveGate pods

darynakovyrina — Tue, 16 Jan 2024 15:22:33 GMT

The underlying host's container runtime doesn't contain the certificate presented by your endpoint.

The skipCertCheck field in the DynaKube YAML doesn't control this certificate check. Additionally, the trustedCAs field in the DynaKube YAML is used to add custom Root Certificate Authorities for communication with the Dynatrace API and does not apply to the ActiveGate.

Example error (the error message may vary):

desc = failed to pull and unpack image "<environment>/linux/activegate:latest": failed to resolve reference "<environment>/linux/activegate:latest": failed to do request: Head "<environment>/linux/activegate/manifests/latest": x509: certificate signed by unknown authority
Warning Failed ... Error: ErrImagePull
Normal BackOff ... Back-off pulling image "<environment>/linux/activegate:latest"
Warning Failed ... Error: ImagePullBackOff

In this example, if the description on your pod shows x509: certificate signed by unknown authority, you must fix the certificates on your Kubernetes hosts, or use the private repository configuration to store the images. Additionally, for issues related to Dynatrace API communication, you can use the trustedCAs configuration in the DynaKube YAML to trust additional RootCAs. This involves adding custom RootCAs from a configmap where the key to the data must be "certs". This setting is specifically for enhancing security in API communications and does not influence the ActiveGate's certificate handling.

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

Brijesh_Saw — Tue, 12 Dec 2023 17:47:00 GMT

Hi @darynakovyrina,

I have faced same issue with operator version v0.14.0, Where I got to know that there is a issue with operator itself and I rolled back to old operator version.
Can you please try the same with different operator version.

Thanks and Regards

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

sirbaughmf — Wed, 24 Jul 2024 15:57:22 GMT

We too have this issue, what exactly is the fix for this issue. As I understand it, adding configMap and enabling trustedCAs is not the answer as it doesn't apply to the OCP Active Gate. Thus what is the solution or workaround?

Much thx! Marcie

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

ronaldnnr — Thu, 25 Jul 2024 20:09:50 GMT

Does anyone have a solution for this problem? I have the same problem

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

gopher — Mon, 02 Sep 2024 05:28:57 GMT

All,

After v0.14.0 The typical solution for this (One Agent, Active Gate, Operator) is to use the following annotation in the CRD

'feature.dynatrace.com/no-proxy: "<your internal repository>" and this will allow for the connectivity to your private repository.

This will allow communication to the private repository without going through the proxy and will allow for not using pull secrets on One Agent, Active Gate, Operator. If you are are using 'code-module images' you must have pull secrets at this point of time for it to download.

Thanks

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

attilaa — Mon, 19 May 2025 13:15:48 GMT

Hello Team,

After upgraded the Operator to 1.5.1 , we still have the problem on our environments with the following error messages:
Failed to pull image "pyx18484.live.dynatrace.com/linux/oneagent:1.313.38-raw": rpc error: code = Canceled desc = reading blob sha256:95833c5ea187db26ca343ae5e52555df0f14c8559fcc9b259479926bc4f7298b: Get "": context canceled

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

shahinm — Mon, 19 May 2025 13:22:59 GMT

@attilaa what is your container runtime client, is it crio?

Re: ImagePullBackoff error on OneAgent and ActiveGate pods

attilaa — Fri, 30 May 2025 08:54:13 GMT

Hello @shahinm

Yes, it is CRI-O.
We already raised a support case: Re: [Dynatrace] Re: Openshift Dynatrace Operator update issues – Dynatrace
I saw your article: Intermittent failures when pulling OneAgent container images [CRI-O <v1.32] - Dynatrace Community