Bug 1692717
| Summary: | Certificate can't pass verification by httpclient | ||
|---|---|---|---|
| Product: | Container Native Virtualization (CNV) | Reporter: | Qixuan Wang <qixuan.wang> |
| Component: | Storage | Assignee: | Michael Henriksen <mhenriks> |
| Status: | CLOSED NOTABUG | QA Contact: | Qixuan Wang <qixuan.wang> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 1.4 | CC: | cnv-qe-bugs, igoihman, mhenriks, ncredi, ycui |
| Target Milestone: | --- | ||
| Target Release: | 2.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-05-13 18:18:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Qixuan Wang
2019-03-26 09:53:24 UTC
Michael, can you take a look? Hi, it would appear that the system running virtctl/curl was not configured to trust the Openshift router's default wildcard certificate (see *.cloudapps.example.com above). Is that true?
If so, you can extract the wildcard cert by running 'oc get secret -n default router-certs -o=jsonpath="{.data['tls\.crt']}" | base64 -d > router.crt'. Then add that cert to the system trust store (drop the file in /etc/pki/ca-trust/source/anchors/ and run 'sudo update-ca-trust').
Be aware that the hostname virtctl/curl is connecting to must match the "*.cloudapps.example.com" domain. Otherwise you will have to do some dns configuration to avoid hostname validation failure.
Michael, yes, you are right. It worked for me. Shall we add the configuration to the document?
[root@cnv-executor-qwang-master1 ~]# oc get secret -n default router-certs -o=jsonpath="{.data['tls\.crt']}" | base64 -d > router.crt
[root@cnv-executor-qwang-master1 ~]# cp router.crt /etc/pki/ca-trust/source/anchors/
[root@cnv-executor-qwang-master1 ~]# update-ca-trust
[root@cnv-executor-qwang-master1 ~]# oc get secret -n cdi cdi-upload-proxy-ca-key -o=jsonpath="{.data['tls\.crt']}" | base64 -d > tls.crt
[root@cnv-executor-qwang-master1 ~]# oc create route reencrypt -n cdi --service=cdi-uploadproxy --dest-ca-cert=tls.crt
route.route.openshift.io/cdi-uploadproxy created
[root@cnv-executor-qwang-master1 ~]# virtctl image-upload --uploadproxy-url=https://$(oc get route cdi-uploadproxy -n cdi -o=jsonpath='{.status.ingress[0].host}') --pvc-size=1Gi --image-path=cirros-0.4.0-x86_64-disk.img --pvc-name=upload-reencrypt-1
PVC cdi/upload-reencrypt-1 created
Waiting for PVC upload-reencrypt-1 upload pod to be running...
Pod now running
Uploading data to https://cdi-uploadproxy-cdi.cloudapps.example.com
12.13 MiB / 12.13 MiB [===========================================================================================================] 100.00% 0s
Uploading cirros-0.4.0-x86_64-disk.img completed successfully
The reencrypt route is now created by default by the CDI operator. So there should be no need to document how to create the route. Adding the router wildcard cert to the system trust store is something that varies based on the system. And I don't see that topic covered in OpenShift docs anywhere. But I can add a note stating that the router wildcard cert should be added to the system CA trust store. closing since the reported issue can be solved with a proper configuration. |