Change:
<!-- Please only use this template for submitting reports about failing tests in Kubernetes CI jobs --Which jobs are failing: containerd-l2bridge-windows-master containerd-overlay-windows-master Which test(s) are failing: [] Container Runtime blackbox test when running a container with a new image should be able to pull from private registry with secret [NodeConformance] Since when has it been failing: Unknown. Testgrid link: Reason for failure: When creating the container, the following error occurs: Failed: Error: failed to create containerd task: hcsshim::CreateComputeSystem image-pull-test: The container operating system does not match the host operating system. Windows Server 2019 is used in the testing environment, and the image image, and the test is passing in all other jobs that are using docker instead of containerd. But the image has been built at the beggining of 2019, so it's most likely outdated (the Microsoft official images are updated regularly), which could lead to the OS version mismatch. Note that most of the other tests are passing for the containerd jobs, which are using the test images hosted in the image (LTS 2019 and 1809 have the same OS version), and they're always up-to-date. One solution could be to republish the image based on a freshly pulled nanoserver image. Anything else we need to know: /sig windows /sig testing
- is the login/password public so this can be debugged outside of the prow cluster?
- what containerd branch / hash was it built from?
- Some part of my memory thinks this was fixed in upstream containerd/cri. Do you recall any items around this recently?
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale

Discussion:
--network="${KUBE_GCE_NETWORK:-${KUBE_GKE_NETWORK:-e2e}}"  --node-tag="${NODE_TAG:-}"  --master-tag="${MASTER_TAG:-}"  <ins> --docker-config-file="${DOCKER_CONFIG_FILE:-}"  </ins> --dns-domain="${KUBE_DNS_DOMAIN:-cluster.local}"  --ginkgo.slowSpecThreshold="${GINKGO_SLOW_SPEC_THRESHOLD:-300}"  ${KUBE_CONTAINER_RUNTIME:+"--container-runtime=${KUBE_CONTAINER_RUNTIME}"} 

import ( "context" "fmt" <ins> "io/ioutil" </ins> "path" "time"

} } }` <ins> // we might be told to use a different docker config JSON. if framework.TestContext.DockerConfigFile != "" { contents, err := ioutil.ReadFile(framework.TestContext.DockerConfigFile) framework.ExpectNoError(err) auth = string(contents) } </ins> secret := &v1.Secret{ Data: map[string][]byte{v1.DockerConfigJsonKey: []byte(auth)}, Type: v1.SecretTypeDockerConfigJson,

// SpecSummaryOutput is the file to write ginkgo.SpecSummary objects to as tests complete. Useful for debugging and test introspection. SpecSummaryOutput string <ins> // DockerConfigFile is a file that contains credentials which can be used to pull images from certain private registries, needed for a test. DockerConfigFile string </ins> } // NodeKillerConfig describes configuration of NodeKiller -- a utility to

flags.StringVar(&TestContext.ProgressReportURL, "progress-report-url", "", "The URL to POST progress updates to as the suite runs to assist in aiding integrations. If empty, no messages sent.") flags.StringVar(&TestContext.SpecSummaryOutput, "spec-dump", "", "The file to dump all ginkgo.SpecSummary to after tests run. If empty, no objects are saved/printed.") <ins> flags.StringVar(&TestContext.DockerConfigFile, "docker-config-file", "", "A file that contains credentials which can be used to pull images from certain private registries, needed for a test.") </ins> } // RegisterClusterFlags registers flags specific to the cluster e2e test suite.