Set referencePolicy to source for pulling image directly

[harshad16]

Set referencePolicy to source for pulling images directly

Description

The Source ReferencePolicy allows Imagestream to pull images directly from the external registry.
Without having to rely on the internal ReferencePolicy.
Related-to: opendatahub-io/notebooks#124

How Has This Been Tested?

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

[atheo89]

/lgtm

[harshad16]

/retest-required

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: atheo89

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• notebook-images/OWNERS [atheo89]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[harshad16]

Thank you for the approval
Merging this to work on release.

[shalberd]

@harshad16 for any non-master branch, referencePolicy of tags should be kept Local, though. Which it is not currently at branch v1.7.

You also have to differentiate between disconnected deployments with an internal openshift registry and without an openshift internal registry. If there is no internal openshift registry, then ImageContentSourcePolicy applies and it does not matter whether referencePolicy is set to Source or Local.

If there is an internal openshift registry, setting referencePolicy to Source only makes sense for the master branch, and even there, it only makes sense for the tags of an imagestream whose background image externally changes all the time. It does not make sense for stable, non-weekly images, unless you don't trust the cluster's image registry pruning settings.

Disconnected environments never directly pull from external locations.

Furthermore, imagePullPolicy of a container, especially when using digests, should always be set to IfNotPresent, leveraging the node image cache for a given image digest, or digest behind a tag.

[shalberd]

@harshad16 basically, the new image change trigger annotation way of dashboard PR-800 and kubeflow PR 72 will ensure automatically that an internal openshift registry is used, at time of notebook creation from an imagestream tag, when there is an internal openshift registry, and that otherwise, the tag.from.name external location, in sha256 digest format, is used.

PR-72 and PR-800 solve the problem in opendatahub-io/notebooks#124

when there is an internal openshift registry, it is leveraged, when there is not, it is not leveraged.

Now, using tag.referencePolicy: Source is not really necessary anymore, because image policy plugin automatically puts in the external location from i.e. https://github.com/opendatahub-io/odh-manifests/blob/master/notebook-images/base/params.env#L1 in the container image field when no internal openshift docker registry is present, regardless of tag.referencePolicy. That is the beauty of it.