Bug 1466427

Summary: Registry console fails to accept self-signed cert
Product: OpenShift Container Platform Reporter: Marko Myllynen <myllynen>
Component: Registry ConsoleAssignee: Martin Pitt <mpitt>
Status: CLOSED CANTFIX QA Contact: Yanping Zhang <yanpzhan>
Severity: medium Docs Contact:
Priority: low    
Version: 3.5.0CC: aos-bugs, bparees, jokerman, mmccomas, mpitt, trankin
Target Milestone: ---   
Target Release: 3.11.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-05-13 18:09:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marko Myllynen 2017-06-29 14:38:14 UTC
Description of problem:
In a containerized 3.5 installation Docker and other parts work well with a self-signed cert after doing something like:

    - name: Create Docker registry certificate directory
      file: path=/etc/docker/certs.d/{{ openshift_docker_additional_registries }} state=directory
      when: openshift_docker_additional_registries is defined

    - name: Copy Docker registry certificate for Docker
      copy: src=cert.crt dest=/etc/docker/certs.d/{{ openshift_docker_additional_registries }} follow=yes
      when: openshift_docker_additional_registries is defined

    - name: Copy Docker registry certificate for OpenShift tools
      copy: src=cert.crt dest=/etc/pki/ca-trust/source/anchors/registry.crt follow=yes
      register: certificate_update
      when: openshift_docker_additional_registries is defined

    - name: Update CA trust store
      command: /usr/bin/update-ca-trust
      when: certificate_update | changed

However, when accessing the registry console, and clicking Images on the left, the following error is displayed:

 Internal error occurred: Get https://registry.example.com:5000/v2/: x509: certificate signed by unknown authority. Timestamp: 2017-06-29T14:08:39Z Error count: 2 Edit image stream 

Once configured on the host, the registry-console container should recognize the self-signed cert as well, like other components do.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Marko Myllynen 2017-06-29 14:41:09 UTC
(In reply to Marko Myllynen from comment #0)
> 
> However, when accessing the registry console, and clicking Images on the
> left, the following error is displayed:
> 
>  Internal error occurred: Get https://registry.example.com:5000/v2/: x509:
> certificate signed by unknown authority. Timestamp: 2017-06-29T14:08:39Z
> Error count: 2 Edit image stream 

Minor clarification: to see the error, click on Images and then try to expand the default/registry-console shown on the right. Thanks.

Comment 7 Martin Pitt 2020-05-13 18:09:08 UTC
Not relevant any more for current OpenShift, and this is indeed quite stale, so closing. Thanks!