Bug 2032179

Summary:	[PROXY] external dns pod cannot reach to cloud API in the cluster behind a proxy
Product:	OpenShift Container Platform	Reporter:	Hongan Li <hongli>
Component:	Networking	Assignee:	Andrey Lebedev <alebedev>
Networking sub component:	DNS	QA Contact:	Hongan Li <hongli>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	high	CC:	aos-bugs, luzuccar, mmasters
Version:	4.10
Target Milestone:	---
Target Release:	4.10.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-08 16:03:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2041999

Description Hongan Li 2021-12-14 07:30:50 UTC

Description of problem:
External dns pod cannot reach to cloud API in the cluster behind a proxy, see log as below:
time="2021-12-14T03:40:06Z" level=error msg="records retrieval failed: failed to list hosted zones: RequestError: send request failed\ncaused by: Get \"https://route53.amazonaws.com/2013-04-01/hostedzone\": dial tcp 52.46.154.111:443: i/o timeout"


OpenShift release version:
4.10.0-0.nightly-2021-12-12-232810

Cluster Platform:
tested on AWS, but should has the same issue on Azure/GCP

How reproducible:
100%

Steps to Reproduce (in detail):
1. install a cluster with proxy setting

$ oc get proxies.config.openshift.io cluster -oyaml
<--snip--->
spec:
  httpProxy: http://user:xxxx@ec2-x-x-x-x.us-east-2.compute.amazonaws.com:xxxx
  httpsProxy: http://user:xxxx@ec2-x-x-x-x.us-east-2.compute.amazonaws.com:xxxx
  noProxy: test.no-proxy.com
  trustedCA:
    name: ""

2. install external-dns-operator 
3. create externaldns


Actual results:
$ oc -n external-dns logs external-dns-sample-aws-d5c5cbc5-xl6jl
<---snip--->
time="2021-12-14T03:32:05Z" level=debug msg="Refreshing zones list cache"
time="2021-12-14T03:34:05Z" level=error msg="records retrieval failed: failed to list hosted zones: RequestError: send request failed\ncaused by: Get \"https://route53.amazonaws.com/2013-04-01/hostedzone\": dial tcp 52.94.235.198:443: i/o timeout"


Expected results:
external-dns pod should work well in the cluster behind a proxy


Impact of the problem:
external-dns doesn't work

Additional info:

1) checked the Env variables in the external-dns pod but no any proxy settings
$ oc -n external-dns rsh external-dns-sample-aws-d5c5cbc5-xl6jl
sh-4.4$ env | grep -i proxy
sh-4.4$


2) checked the Env var in the operator pod and found the proxy settings
$ oc -n external-dns-operator rsh -c operator external-dns-operator-55db947d66-d9jkm
sh-4.4$ env | grep -i proxy
HTTP_PROXY=http://<......>
NO_PROXY=.cluster.local,.svc,.<......>
HTTPS_PROXY=http://<......>
sh-4.4$ 



** Please do not disregard the report template; filling the template out as much as possible will allow us to help you. Please consider attaching a must-gather archive (via `oc adm must-gather`). Please review must-gather contents for sensitive information before attaching any must-gathers to a bugzilla report.  You may also mark the bug private if you wish.

Comment 2 Hongan Li 2022-01-17 10:10:38 UTC

verified with 4.10.0-0.nightly-2022-01-16-191814 and external-dns-operator.v0.1.2, it works well.

$ oc -n external-dns rsh external-dns-sample-aws-75d7bb464-6bhlr 
sh-4.4$ env | grep -i proxy
HTTP_PROXY=http://user:xxx@ec2-x-x-x-x.us-east-2.compute.amazonaws.com:xxxx
NO_PROXY=.cluster.local,.svc,.us-east-2.compute.internal,10.0.0.0/16,10.128.0.0/14,127.0.0.1,169.254.169.254,172.30.0.0/16,api-int.hongli-pxy.xxxx.com,localhost,test.no-proxy.com
HTTPS_PROXY=http://user:xxxx@ec2-x-x-x-x.us-east-2.compute.amazonaws.com:xxxx

Comment 6 errata-xmlrpc 2022-03-08 16:03:07 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of ExternalDNS Operator on OperatorHub), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:0781