|Summary:||Cannot deploy docker-registry "Readiness probe failed: HTTP probe failed with statuscode: 403"|
|Product:||OpenShift Container Platform||Reporter:||Miheer Salunke <misalunk>|
|Component:||Networking||Assignee:||Phil Cameron <pcameron>|
|Status:||CLOSED ERRATA||QA Contact:||Meng Bo <bmeng>|
|Version:||3.2.1||CC:||aos-bugs, bbennett, mfojtik, misalunk, tdawson|
|Fixed In Version:||Doc Type:||No Doc Update|
PR 3405 documented the work
|Last Closed:||2017-05-18 09:27:04 UTC||Type:||Bug|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
Description Miheer Salunke 2016-09-29 11:05:57 UTC
Description of problem: Cannot deploy docker-registry. The registry pod after getting created gets killed in sometime. Readiness probe failed: HTTP probe failed with statuscode: 403 Liveness probe failed: HTTP probe failed with statuscode: 403 Version-Release number of selected component (if applicable): atomic-openshift-188.8.131.52-1 How reproducible: Always on customer end Steps to Reproduce: 1.Create a registry 2. 3. Actual results: The registry pod gets created and the again gets killed. We can see the readiness and liveness probe failing with 403 error. Expected results: The registry pod shall not get killed after getting created. The Liveness and Readiness probe shall not give 403 error. Additional info:
Comment 4 Michal Minar 2016-10-04 08:31:52 UTC
Miheer, is some kind of network filtering proxy running on the host? The readiness probe receives (from node.log): <HTML><HEAD><TITLE>Access Denied</TITLE></HEAD> <BODY> <FONT face="Helvetica"><big><strong></strong></big><BR></FONT> <blockquote> <TABLE border=0 cellPadding=1 width="80%"> <TR><TD><FONT face="Helvetica"><big>Access Denied (policy_denied)</big><BR><BR></FONT></TD></TR> <TR><TD><FONT face="Helvetica">Your system policy has denied access to the requested URL.</FONT></TD></TR> <TR><TD><FONT face="Helvetica"></FONT></TD></TR> <TR><TD><FONT face="Helvetica" SIZE=2><BR>For assistance, contact your network support team.</FONT></TD></TR> </TABLE> </blockquote> </FONT> </BODY> </HTML> Which means the request didn't event make it to the registry.
Comment 5 Michal Fojtik 2016-10-31 11:39:51 UTC
Comment 6 Michal Fojtik 2016-10-31 11:39:52 UTC
Comment 12 Phil Cameron 2016-12-16 18:40:24 UTC
I have changed the "Working with HTTP Proxies" documentation https://github.com/openshift/openshift-docs/pull/3405 Please take a look. I can make further edits.
Comment 13 Phil Cameron 2017-01-06 14:48:06 UTC
Comment 14 Troy Dawson 2017-03-07 19:54:04 UTC
This should have gone to QA a while ago, moving it on.
Comment 15 Meng Bo 2017-03-08 10:45:32 UTC
The doc looks good to me.
Comment 17 errata-xmlrpc 2017-05-18 09:27:04 UTC
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1235