openshift origin v3.7 - ImageStream Import failed (InternalError) unauthorized: authentication required

[olsib]

We've setup image streaming to external docker registry. The Docker Registry is running behind an NGINX. It uses docker-auth for authorization & is backed up by S3 storage.

Version

oc v3.7.0+7ed6862
kubernetes v1.7.6+a08f5eeb62
features: Basic-Auth GSSAPI Kerberos SPNEGO

openshift v3.7.0+7ed6862
kubernetes v1.7.6+a08f5eeb62

Steps To Reproduce

oc secrets new-dockercfg central-registry --docker-server='docker-registry.xxxxx.com' --docker-username=xxxx --docker-password=xxxx --docker-email=xxx
oc secrets link default secrets/central-registry --for=pull
oc secrets link builder secrets/central-registry --for=pull
oc import-image image:tag --from=docker-registry.xxxxxx.com/project/image:tag --confirm

Current Result

! error: Import failed (InternalError): Internal error occurred: Get https://docker-registry-xxxxx.com/v2/project/image/manifests/tag: unauthorized: authentication required
2 hours ago

Expected Result

Import sucessful

Additional Information

This was working on previous versions of Openshift (v3.6, v1.5.1). Recently upgraded to v3.7

[olsib]

this seems to be a duplicate of:
#18059

With oc client v3.6.1 the docker registry secrets are created fine, but oc client v3.7 creates docker registry secret in new docker format.

Is there a fix planned for this? Which origin version is it planned to come through?

[bparees]

I believe a backport for OCP is under way, but for origin it may not be fixed until 3.9. @mfojtik and team own it and would have to provide the specifics.

[soltysh]

Fix is in #18062.