Bug 1939704

Summary:	Proxy settings are passed to the MTC web console, breaking the user's initial authentication flow
Product:	Migration Toolkit for Containers	Reporter:	Derek Whatley <dwhatley>
Component:	Operator	Assignee:	Ian <ibolton>
Status:	CLOSED ERRATA	QA Contact:	Xin jiang <xjiang>
Severity:	unspecified	Docs Contact:	Avital Pinnick <apinnick>
Priority:	unspecified
Version:	1.4.3	CC:	ernelson, gojeaqui, midays, rjohnson, sregidor
Target Milestone:	---
Target Release:	1.4.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-04-28 05:52:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Derek Whatley 2021-03-16 20:55:53 UTC

Description of problem:
Cluster-wide proxy settings are passed through to mig-ui in MTC 1.4.2, and this can break the initial authentication flow for the user. 

There is an existing bug filed for this at https://bugzilla.redhat.com/show_bug.cgi?id=1926110, but the workaround described 
 requires reconfiguration of the squid proxy, and this solution is NOT usable for a class of users since the cluster-admins do not have configuration control of company-wide proxies their clusters are required to use.

Guillermo Ojea Quintana reported this issue.

Version-Release number of selected component (if applicable):
Problem exists in MTC 1.4.2

How reproducible:
Always. Workaround is possible by overriding the proxy setting in the mig-ui configmap, but mig-operator will overwrite user settings here, so this is not a viable long-term solution.

Steps to Reproduce:
1. Deploy MTC to cluster with cluster-wide proxy
2. mig-ui will assume cluster-wide proxy setting
3. oauth flow talking to <cluster>:6443/.well-known/oauth-authorization-server will fail with status code 500

Comment 2 Derek Whatley 2021-03-16 20:58:56 UTC

Proxy passthrough to UI implemented in https://github.com/konveyor/mig-operator/pull/579

Comment 3 Derek Whatley 2021-03-16 21:03:40 UTC

Suggested solutions from Guillermo: 
 - Allow configuration of whether proxy setting is passed through to UI
 - Convert URL to internal .svc URL so proxy won't be used for oauth flow

Comment 4 Guillermo Ojea Quitana 2021-03-16 21:41:24 UTC

Another possible solution is to respect the "noProxy" variable.

Comment 6 Guillermo Ojea Quitana 2021-03-17 12:38:52 UTC

I can confirm that these other pods: velero, migration-controller, migration-operator are taking the NO_PROXY variable from the system so they work OK.

The problem is with the migration-ui pod that is only taking in the HTTP_PROXY and HTTPS_PROXY variables.

Comment 10 Sergio 2021-04-16 16:20:36 UTC

Using MTC 1.4.3 stage.
    - name: MIG_UI_REPO
      value: openshift-migration-ui-rhel8@sha256
    - name: MIG_UI_TAG
      value: bde539e7c462ac14ec7752497250ea5575cbdbc3f367fbd1b1dea027c212d219


It seems that the fix is not working.


We move the BZ to ASSIGNED status.

Comment 13 Sergio 2021-04-21 13:47:52 UTC

Verified using MTC 1.4.3

openshift-migration-rhel7-operator@sha256:c95d10c87b796ea2680184cb092ea2dea7ae65194bc829f7a7fb9fe2fbe4f175
    - name: MIG_UI_REPO
      value: openshift-migration-ui-rhel8@sha256
    - name: MIG_UI_TAG
      value: 0c0252c31f58196e2d0336896b254fc0a472d1f9f40df5a85dc6ca166d9bcedf


The UI worked without problems and without any extra configuration

Moved to VERIFIED status.

Comment 19 errata-xmlrpc 2021-04-28 05:52:41 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Migration Toolkit for Containers (MTC) tool image release advisory 1.4.3), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1439