Bug 1489039
| Summary: | [3.5][Backport] exposing docker-registry with a non tls-passthrough route does not work | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Michal Minar <miminar> |
| Component: | Image Registry | Assignee: | Michal Minar <miminar> |
| Status: | CLOSED ERRATA | QA Contact: | Dongbo Yan <dyan> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.5.1 | CC: | akokshar, aos-bugs, bparees, dyan, geliu, haowang, mfojtik, miminar, obulatov, peasters, pweil |
| Target Milestone: | --- | ||
| Target Release: | 3.5.z | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: The registry used to append forwarded target port to redirected location urls. Registry client gets confused by the received location containing superfluous port and cannot match it against the original host. This happened when exposed with tls-termination other than passthrough.
Consequence: Client's new request to the target location lacks credentials. As a consequence, image push fails due to authorization error.
Fix: Registry was rebased to newer version which fixes forwarding processing logic.
Result: Registry now doesn't confuse its clients. Clients can push images successfully to the exposed registry using arbitrary tls-termination.
|
Story Points: | --- |
| Clone Of: | 1471707 | Environment: | |
| Last Closed: | 2017-10-25 13:06:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1471707, 1489042 | ||
| Bug Blocks: | |||
|
Comment 1
Michal Minar
2017-09-06 15:47:54 UTC
Was this backport requested by a customer? If not, why are we doing it? Back-port PR: https://github.com/openshift/ose/pull/882 Verified $ ./oc version oc v3.5.5.31.34 kubernetes v1.5.2+43a9be4 features: Basic-Auth GSSAPI Kerberos SPNEGO Server https://:8443 openshift v3.5.5.31.34 kubernetes v1.5.2+43a9be4 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:3049 |