Unable to Deploy Public Image on OpenFaaS from Docker Hub

[ZNFY]

Expected Behaviour

The function should deploy successfully using the provided add.yml configuration and the image znfy233/add should be pulled from the Docker Hub without any issues.

Current Behaviour

When deploying the function with the faas-cli deploy -f add.yml command, I receive the error: the Community Edition license agreement only supports public images, even though the image znfy233/add is public.

Why is this needed?

This issue needs to be resolved to ensure that functions can be deployed without licensing issues, especially when using public images. It prevents the deployment of functions and restricts the use of OpenFaaS Community Edition with publicly available images.

List All Possible Solutions and Workarounds

I tried deploying the pytorch/pytorch image, but I still get the same error message.

Steps to Reproduce (for bugs)

1. Create a function with the add.yml configuration.
2. Attempt to deploy the function using the command: faas-cli deploy -f add.yml.
3. Observe the error message: the Community Edition license agreement only supports public images.

Context

I am learning to use OpenFaaS. Following the tutorial, I built an image and uploaded it to Docker Hub, setting it to public, but I am unable to deploy it.

Your Environment

CLI:
commit: 41605396955e6b13488755852106bd9bf315219a
version: 0.16.37

Gateway
uri: http://192.168.100.2:31119
version: 0.27.9
sha: 4e80b96d19a2b23855c2ed55afb2632179f3d2e7

Provider
name: faas-netes-ce
orchestration: kubernetes
version: 0.18.9
sha: 294f3bc

[alexellis]

Hi,

I was able to deploy your image using OpenFaaS CE with no issues:

def handle(req):
    array = req.replace('\n', '').split(',')
    rlt = 0
    for i in array:
        rlt += int(i)
    return rlt

That's the handler correct, with the python3 template?

alex@ae-m2 ~ % ssh nuc
Last login: Fri Nov 29 15:25:45 2024 from 192.168.1.14
[alex@nuc ~]$ kind create cluster --name ce
Creating cluster "ce" ...
 ✓ Ensuring node image (kindest/node:v1.30.0) 🖼 
 ✓ Preparing nodes 📦  
 ✓ Writing configuration 📜 
 ✓ Starting control-plane 🕹️ 
 ✓ Installing CNI 🔌 
 ✓ Installing StorageClass 💾 
Set kubectl context to "kind-ce"
You can now use your cluster with:

kubectl cluster-info --context kind-ce

Have a nice day! 👋
[alex@nuc ~]$ arkade install openfaas
Using Kubeconfig: /home/alex/.kube/config
Client: x86_64, Linux
2024/12/03 09:41:21 User dir established as: /home/alex/.arkade/
"openfaas" already exists with the same configuration, skipping

Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "ingress-nginx" chart repository
...Successfully got an update from the "inlets" chart repository
...Successfully got an update from the "inlets-pro" chart repository
...Successfully got an update from the "openfaas" chart repository
...Successfully got an update from the "jetstack" chart repository
...Successfully got an update from the "istio" chart repository
...Successfully got an update from the "kasten" chart repository
...Successfully got an update from the "stable" chart repository
Update Complete. ⎈Happy Helming!⎈

VALUES values.yaml
Command: /home/alex/.arkade/bin/helm [upgrade --install openfaas openfaas/openfaas --namespace openfaas --values /tmp/charts/openfaas/values.yaml --set gateway.directFunctions=false --set faasnetes.imagePullPolicy=Always --set basicAuthPlugin.replicas=1 --set gateway.replicas=1 --set ingressOperator.create=false --set openfaasImagePullPolicy=IfNotPresent --set queueWorker.replicas=1 --set queueWorker.maxInflight=1 --set basic_auth=true --set serviceType=NodePort --set operator.create=false --set dashboard.enabled=false --set clusterRole=false --set autoscaler.enabled=false --set dashboard.publicURL=http://127.0.0.1:8080]
Release "openfaas" does not exist. Installing it now.
NAME: openfaas
LAST DEPLOYED: Tue Dec  3 09:41:24 2024
NAMESPACE: openfaas
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
To verify that openfaas has started, run:

  kubectl -n openfaas get deployments -l "release=openfaas, app=openfaas"

To retrieve the admin password, run:

  echo $(kubectl -n openfaas get secret basic-auth -o jsonpath="{.data.basic-auth-password}" | base64 --decode)
=======================================================================
= OpenFaaS has been installed.                                        =
=======================================================================

# Get the faas-cli
curl -SLsf https://cli.openfaas.com | sudo sh

# Forward the gateway to your machine
kubectl rollout status -n openfaas deploy/gateway
kubectl port-forward -n openfaas svc/gateway 8080:8080 &

# If basic auth is enabled, you can now log into your gateway:
PASSWORD=$(kubectl get secret -n openfaas basic-auth -o jsonpath="{.data.basic-auth-password}" | base64 --decode; echo)
echo -n $PASSWORD | faas-cli login --username admin --password-stdin

faas-cli store deploy figlet
faas-cli list

# For Raspberry Pi
faas-cli store list \
 --platform armhf

faas-cli store deploy figlet \
 --platform armhf

# Find out more at:
# https://github.com/openfaas/faas

🐳 Want to speed up your CI 2-3x, whilst lowering costs? https://actuated.dev

Deployment:

[alex@nuc ~]$ faas-cli deploy --image znfy233/add:latest --name add


[alex@nuc ~]$ faas-cli version
  ___                   _____           ____
 / _ \ _ __   ___ _ __ |  ___|_ _  __ _/ ___|
| | | | '_ \ / _ \ '_ \| |_ / _` |/ _` \___ \
| |_| | |_) |  __/ | | |  _| (_| | (_| |___) |
 \___/| .__/ \___|_| |_|_|  \__,_|\__,_|____/
      |_|

CLI:
 commit:  0b1e92baf1377cc64c89b131fb3b227105f115da
 version: 0.16.3
Handling connection for 8080

Gateway
 uri:     http://127.0.0.1:8080
 version: 0.27.11
 sha:     2fb748e03d58568309f516c215c6f2be17bf667c


Provider
 name:          faas-netes-ce
 orchestration: kubernetes
 version:       0.18.10 
 sha:           39509ced6d6d2039e3f166ccaa3c88c7e1787f98

Result:

[alex@nuc ~]$ cat test.txt 
1
2
3
4
[alex@nuc ~]$ cat test.txt | faas-cli invoke add 
Handling connection for 8080
1234
[alex@nuc ~]$ 

[alexellis]

I see you have some Chinese characters in your profile, it's well known that the Chinese authority may block access to US hosted sites such as the Docker Hub.

Perhaps you can share your exact stack.yml file, or maybe you're running your Kubernetes cluster on a network or in a VM without proper Internet access?

Perhaps you could try using a local company's registry instead like Alibaba cloud etc?

[ZNFY]

Hello! Thank you very much for your reply! I specifically set up a proxy and modified the "/etc/containerd/config.toml" file as follows:
"[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
endpoint = ["https://xx.xx(proxy)"]"
As a result, my Kubernetes cluster can pull images from Docker Hub normally, and I successfully tested pulling the image using the command crictl pull znfy233/add.

However, when I try to pull the image using OpenFaaS, I still get the error:
"the Community Edition license agreement only supports public images", which has frustrated me all afternoon.

Since you mentioned that you can deploy it successfully, it seems that the issue is indeed caused by China's network firewall. I might need to set up a more comprehensive proxy.

By the way, can OpenFaaS modify the image pulling endpoint, similar to how I configure the containerd?

Thank you again for your reply!

[alexellis]

Hi,

This information was very helpful.

You can use OpenFaaS Edge with faasd on a VM, if you become a sponsor via GitHub at 25 USD / month, this would allow you to use public and private images, and does not have the same checks. It also gives you extra features like scale to zero.

Is this a personal or work project?

If Kubernetes is a hard requirement, then we would recommend purchasing OpenFaaS Standard on a monthly basis.

Regards,

Alex

[ZNFY]

Hello alexellis,

Thank you very much for your suggestion. However, I am just learning how to use this software, and I plan to use OpenFaaS as a tool for my Master's thesis. I really want to support OpenFaaS, but $25 a month is a bit expensive for me, as my monthly living expenses are only $200 (this is quite common in China).

If the issue is caused by network restrictions preventing image pulls, then even subscribing to a paid plan might not resolve the problem.

If it is not possible to modify the image source adress in OpenFaaS, I will consider setting up a more comprehensive proxy or switching to a different platform.

Thank you for your reply.

[alexellis]

The commercial versions will work with your configuration.

Is there a specific reason you need Kubernetes, or can you use faasd on a VM?