Bug 1489042
| Summary: | [3.6][Backport] exposing docker-registry with a non tls-passthrough route does not work | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Michal Minar <miminar> |
| Component: | Image Registry | Assignee: | Michal Minar <miminar> |
| Status: | CLOSED ERRATA | QA Contact: | Dongbo Yan <dyan> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.6.1 | CC: | akokshar, aos-bugs, bparees, dyan, geliu, haowang, mfojtik, miminar, obulatov, peasters, pweil, sjr, tomckay |
| Target Milestone: | --- | ||
| Target Release: | 3.6.z | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: The registry used to append forwarded target port to redirected location urls. Registry client gets confused by the received location containing superfluous port and cannot match it against the original host. This happened when exposed with tls-termination other than passthrough.
Consequence: Client's new request to the target location lacks credentials. As a consequence, image push fails due to authorization error.
Fix: Registry was rebased to newer version which fixes forwarding processing logic.
Result: Registry now doesn't confuse its clients. Clients can push images successfully to the exposed registry using arbitrary tls-termination.
|
Story Points: | --- |
| Clone Of: | 1471707 | Environment: | |
| Last Closed: | 2017-10-25 13:06:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1471707 | ||
| Bug Blocks: | 1489039 | ||
|
Comment 1
Michal Minar
2017-09-06 15:50:11 UTC
Thomas found out that with the fix in question, :443 suffix added to registry names causes timeouts. We need to make sure that our registry can be addressed both with&without the :443 suffix because many customers added it to their external registries as a work-around for the broken port forwarding. This needs to be further investigated. I could not confirm the registry has issues with push-specs with or without the :443 on the latest master. Therefore, I'll continue with the back-port. Was this backport requested by a customer? If not, why are we doing it? Back-port PR: https://github.com/openshift/ose/pull/883 wait for available puddle Verified $ ./oc version oc v3.6.173.0.49 kubernetes v1.6.1+5115d708d7 features: Basic-Auth GSSAPI Kerberos SPNEGO Server https://:8443 openshift v3.6.173.0.49 kubernetes v1.6.1+5115d708d7 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:3049 |