Bug 1144894

Summary:	[RFE] Use https in application URL's
Product:	OpenShift Container Platform	Reporter:	thunt
Component:	Node	Assignee:	Brenton Leanhardt <bleanhar>
Status:	CLOSED ERRATA	QA Contact:	libra bugs <libra-bugs>
Severity:	medium	Docs Contact:
Priority:	high
Version:	2.1.0	CC:	adellape, bleanhar, bmeng, jokerman, libra-onpremise-devel, mmccomas, obedin, ofayans, xiama
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openshift-origin-broker-1.16.2.6-1, rubygem-openshift-origin-controller-1.35.1.3-1	Doc Type:	Enhancement
Doc Text:	Previously, application URLs were presented to developers as HTTP URLs only, for example when listing their applications using the client tools. This enhancement adds the ability for administrators to require that all applications advertise HTTPS URLs instead. This requires setting the APP_ADVERTISE_HTTPS parameter to "true" in the /etc/openshift/broker.conf file on brokers, then restarting the openshift-broker service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-04-06 17:05:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description thunt 2014-09-21 22:00:08 UTC

Description of problem:
Customer policy requires that all URL's use https, including application URL's.

Customer requests that the console and other utilities use https when presenting application URL's

Version-Release number of selected component (if applicable):
2.1.*

How reproducible:
Very

Steps to Reproduce:
N/A

Actual results:
Current application URL is presented as http://myapp-mydomain.example.com/

Expected results:
Present application URL as https://myapp-mydomain.example.com/

Additional info:
PR to follow.

Implemented as configurable option based on broker.conf boolean:- 
"APP_REQUIRE_HTTPS"

This may be a different solution to BZ 1042920

Comment 2 Meng Bo 2014-09-22 03:02:46 UTC

The existing option in broker.conf can do this?

# Whether cartridges that specify direct SSL connection to the gear
# are allowed, denied or forced.
SSL_ENDPOINT="allow"
# SSL_ENDPOINT="deny"
# SSL_ENDPOINT="force"

Comment 3 Luke Meyer 2014-09-22 13:21:27 UTC

(In reply to Meng Bo from comment #2)

> # Whether cartridges that specify direct SSL connection to the gear
> # are allowed, denied or forced.
> SSL_ENDPOINT="allow"

This setting is not really related... has to do with ssl_to_gear in the cartridge manifest, i.e. whether the cartridge can/must handle direct SSL connections at its external port.

This bug has to do with what the broker and rhc tell the user is the app's web URL. The app is exposed at both :80 and :443, cleartext and secure, it's just that the cleartext URL is given and they'd like the option to report the secure one instead (especially so if they want to disable the cleartext port).

Comment 4 thunt 2014-10-06 18:47:46 UTC

Created PR #5853

Comment 5 Øystein Bedin 2015-03-17 17:27:34 UTC

Created updated PR #6101
https://github.com/openshift/origin-server/pull/6101
... and related PR #2988
https://github.com/openshift/li/pull/2988

Comment 8 Ma xiaoqiang 2015-03-19 07:06:00 UTC

Check on puddle[2.2.5/2015-03-18.2]

1. create some apps, and show the apps
all url of apps use "http"
2. configure the broker
# vim /etc/openshift/broker.conf
APP_ADVERTISE_HTTPS="true"
3. create some apps, and show app
all url use https

Comment 10 errata-xmlrpc 2015-04-06 17:05:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0779.html