Bug 1388016
| Summary: | [3.3] The insecure-registry address was removed during upgrade | ||||||
|---|---|---|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Anping Li <anli> | ||||
| Component: | Cluster Version Operator | Assignee: | Andrew Butcher <abutcher> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Anping Li <anli> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 3.3.1 | CC: | abutcher, aos-bugs, jialiu, jokerman, mmccomas | ||||
| Target Milestone: | --- | Keywords: | Regression, Reopened | ||||
| Target Release: | 3.3.1 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | openshift-ansible-3.3.41-1.git.0.a1a327b.el7 | Doc Type: | Bug Fix | ||||
| Doc Text: |
Previously, when upgrading to OCP 3.3 if the internal registry were not secured the --insecure-registry flag was improperly removed from /etc/sysconfig/docker resulting in failed pushes and pulls from the integrated registry. Now the upgrade playbooks have been updated to preserve that flag during an upgrade ensuring that insecure registries continue to work properly after upgrade.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-03-06 16:37:05 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
To avoid this issue, We can add one line "openshift_docker_insecure_registries=registryservice:ip" in inventory. Commit pushed to master at https://github.com/openshift/openshift-ansible https://github.com/openshift/openshift-ansible/commit/cab68138cd264b9a4cb5dad9801a42ee50e1bc9b Merge pull request #2670 from abutcher/hosted-registry-insecure Bug 1388016 - The insecure-registry address was removed during upgrade Before upgrade: OPTIONS=' --selinux-enabled --insecure-registry=172.30.0.0/16 --log-driver=json-file --log-opt max-size=50m' After upgrade: OPTIONS=' --selinux-enabled --log-driver=json-file --log-opt max-size=50m' The issue is on Containerized installation, the rpm installation works. Testing with containerized (on RHEL) upgrade from 3.2->3.3 and I can't reproduce the issue. Before uprade: OPTIONS=' --selinux-enabled --insecure-registry=172.30.0.0/16 --log-driver=json-file --log-opt max-size=50m' After upgrade: OPTIONS=' --selinux-enabled --insecure-registry=172.30.0.0/16 --log-driver=json-file --log-opt max-size=50m' I will try a few more tests with specific versions. Moving back to ON_QA since we can't reproduce this any longer. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:0448 |
Created attachment 1213376 [details] ansible logs Description of problem: During upgrade, "--insecure-registry=172.30.0.0/16" was removed during upgrade. Version-Release number of selected component (if applicable): ansible-2.2.0.0-0.62.rc1.el7.noarch openshift-ansible-3.3.38-1.git.0.2637ed5.el7.noarch How reproducible: always Steps to Reproduce: 1. install OCP-3.2 2. upgrade node to OCP-3.3 3. trigger sti-build Actual results: 3. docker push failed due to '--insecure-registry=172.30.0.0/16' was removed during upgrade. Expected results: Additional info: