Bug 1504464
| Summary: | docker-registry pod does not uniformly use hostnames - docker push fails with proxy config | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Paul Armstrong <parmstro> |
| Component: | Installer | Assignee: | Fabian von Feilitzsch <fabian> |
| Status: | CLOSED ERRATA | QA Contact: | Gan Huang <ghuang> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 3.6.1 | CC: | aos-bugs, bparees, ghuang, jokerman, mmariyan, mmccomas, parmstro |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | 3.9.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: Kubernetes service IP was not added to no_proxy list for the docker-registry
Consequence: Internal registry requests would be forced to use the proxy, preventing logins and pushes to the internal registry.
Fix: Added the kubernetes service IP to the no_proxy list
Result: The internal registry requests are no longer proxied, and logins and pushes to the internal registry succeed as expected.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-05-03 20:12:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Paul Armstrong
2017-10-20 00:59:33 UTC
You can set KUBERNETES_MASTER on the registry pod to tell the registry how to reach the master, but using the kube service ip (172.30.0.1) in this case is the way we will continue to initialize our client as it is the value k8s has told us to use to reach the master. Adding 172.30.0.1 to NO_PROXY is the correct solution. It looks like this is the default behavior for the installer: https://docs.openshift.org/latest/install_config/http_proxies.html#configuring-no-proxy https://docs.openshift.org/latest/install_config/install/advanced_install.html#advanced-install-configuring-global-proxy Given that you have openshift_generate_no_proxy_hosts=true set, it seems like this should have happened automatically, so i'm going to transfer this to the installer. (possible the installer did not add the no_proxy env to the registry pod) Ben, Has the registry always communicated with the API via IP rather than hostname? Paul, Can you get the NO_PROXY environment variable for the registry? We've As far as i know, yes it's always used the k8s service host variable Is that before or after you manually added NO_PROXY to the registry pod? I don't know why you're blaming the build pod when you were able to fix the problem by editing your registry pod. The fundamental issue here is that the ansible installer did not configure the system to add the NO_PROXY env variable to the registry pod (but apparently did add the HTTP_PROXY/HTTPS_PROXY env variables to the registry pod) Does the builder pod use a hard-coded ip address for the registry? Yes, or no? In https://bugzilla.redhat.com/show_bug.cgi?id=1527210 we're adding the kube service ip address to the list of NO_PROXY entries which should resolve this issue as well. https://github.com/openshift/openshift-ansible/pull/6215 Verified in openshift-ansible-3.9.0-0.34.0.git.0.c7d9585.el7.noarch.rpm 172.30.0.1 is added to docker-registry NO_PROXY env variable successfully. And S2I build succeeded. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0489 |