| Summary: | receiving unexpected SSL certificate responses with multiple OpenShift routers running | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Joel Diaz <jdiaz> |
| Component: | Networking | Assignee: | Ben Bennett <bbennett> |
| Networking sub component: | router | QA Contact: | zhaozhanqi <zzhao> |
| Status: | CLOSED CURRENTRELEASE | Docs Contact: | |
| Severity: | unspecified | ||
| Priority: | unspecified | CC: | aos-bugs, bmeng, gburges, jgoulding, spurtell, twiest |
| Version: | 3.2.1 | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-01 19:32:59 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Joel Diaz
2016-11-01 15:09:03 UTC
You also need to set the ROUTER_SERVICE_SNI_PORT and ROUTER_SERVICE_NO_SNI_PORT variables otherwise the two will get tangled. Documented in PR https://github.com/openshift/openshift-docs/pull/3090, but it hasn't landed yet. So I set the environment vars, and I'm still seeing the intermittent wrong SSL cert responses.
[root@ip-172-31-48-106 ~]# oc get dc router -o yaml | grep SNI -A1
- name: ROUTER_SERVICE_NO_SNI_PORT
value: "10443"
- name: ROUTER_SERVICE_SNI_PORT
value: "10444"
[root@ip-172-31-48-106 ~]# oc get dc router2 -o yaml | grep SNI -A1
- name: ROUTER_SERVICE_NO_SNI_PORT
value: "11443"
- name: ROUTER_SERVICE_SNI_PORT
value: "11444"
[root@ip-172-31-48-106 ~]# oc get dc router2 -o yaml | grep haproxy-router
image: registry.ops.openshift.com/openshift3/ose-haproxy-router:v3.2.1.17
[root@ip-172-31-48-106 ~]# curl -i -v https://nodejs-ssl-sharding.ab49.opstest.openshiftapps.com 2>&1 | grep subject
* subject: CN=*.ab49.opstest.openshiftapps.com,O=Red Hat Inc.,L=Raleigh,ST=North Carolina,C=US
[root@ip-172-31-48-106 ~]# curl -i -v https://nodejs-ssl-sharding.ab49.opstest.openshiftapps.com 2>&1 | grep subject
* subject: CN=*.d234.opstest.openshiftapps.com,OU=RHC Cloud Operations,O=Red Hat Inc.,L=Raleigh,ST=North Carolina,C=US
FYI, tried this on a 3.3 cluster, and after adding the environment vars, I haven't seen the wrong SSL cert responses.
[root@ip-172-31-55-141 ~]# rpm -qa | grep atomic-openshift
tuned-profiles-atomic-openshift-node-3.3.1.3-1.git.0.86dc49a.el7.x86_64
atomic-openshift-clients-3.3.1.3-1.git.0.86dc49a.el7.x86_64
atomic-openshift-master-3.3.1.3-1.git.0.86dc49a.el7.x86_64
atomic-openshift-3.3.1.3-1.git.0.86dc49a.el7.x86_64
atomic-openshift-node-3.3.1.3-1.git.0.86dc49a.el7.x86_64
atomic-openshift-sdn-ovs-3.3.1.3-1.git.0.86dc49a.el7.x86_64
[root@ip-172-31-55-141 ~]# oc get dc router -n default -o yaml | grep SNI -A1
[root@ip-172-31-55-141 ~]# oc get dc router2 -n default -o yaml | grep SNI -A1
- name: ROUTER_SERVICE_NO_SNI_PORT
value: "11443"
- name: ROUTER_SERVICE_SNI_PORT
value: "11444"
[root@ip-172-31-55-141 ~]# oc get dc router2 -n default -o yaml | grep haproxy
image: registry.ops.openshift.com/openshift3/ose-haproxy-router:v3.3.1.3
Ah, sorry... we added those in 3.3. Your best option is to upgrade. Failing that you could use a 3.3 router image with a 3.2 release. |