Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Create two same route name with different serviceName, the route name would be always traffic to the latest pod, the old one will never be accessed. Version-Release number of selected component (if applicable): $ openshift version openshift v0.4.3-285-geffa12c kubernetes v0.14.1-582-gb12d75d How reproducible: always Steps to Reproduce: 1. Create the pod/service/route with namespace zzhao 2. Check the route if can be worked. 3. Create same route name but service different with step1 with another namespace zzhao2 4. Check the route again Actual results: step2: $osc get pod -n zzhao POD IP CONTAINER(S) IMAGE(S) HOST LABELS STATUS CREATED hello-nginx-docker 172.17.0.4 hello-nginx-docker-pod pweil/hello-nginx-docker ip-10-111-178-146.ec2.internal/10.111.178.146 name=hello-nginx-docker Running 11 minutes $ osc get service -n zzhao NAME LABELS SELECTOR IP PORT(S) hello-nginx <none> name=hello-nginx-docker 172.30.148.128 27017/tcp $ osc get route -n zzhao NAME HOST/PORT PATH SERVICE LABELS route-unsecure www.example.com hello-nginx $ curl --resolve www.example.com:80:10.111.178.146 http://www.example.com Hello World step 3: $ osc get route -n zzhao2 NAME HOST/PORT PATH SERVICE LABELS route-unsecure www.example.com hello2-nginx step 4, the route name will always traffic to www.example.com zzhao2-hello2-nginx and the www.example.com zzhao-hello-nginx will nerver be accessed. $ curl --resolve www.example.com:80:10.111.178.146 http://www.example.com hello openshift Expected results: Should not create same route Additional info: #cat /var/lib/haproxy/conf/os_http_be.map www.example.com zzhao2-hello2-nginx www.example.com zzhao-hello-nginx
ack. Host uniqueness validation has not been addressed yet. The current plan is that we will enforce uniqueness per shard. Related card: https://trello.com/c/DtPlixdb/592-8-router-sharding-routing-future. Perhaps there is a simple short term validation we can put in place since we know we are in a single shard setup.
Discussed with Dan and Paul. Short term plan: 1. Add admission controller to prevent exact duplicate routes (scheme + host:port + path) from being added (scheme and host should be case-insensitive, path should be case-sensitive?) 2. Allow routes with the same host that differ by scheme or by path Post-GA, we can look at enhancing restrictions. For example: 1. Only allow routes with the same host in the same namespace 2. Disallow routes that override subpaths etc.
PR https://github.com/openshift/origin/pull/2606 For Testing: Please test scenarios in the same namespace and across namespaces. This applies to both add and updates (for instance updating an existing route to a scheme/host/path that already exists, even in another namespace). An example of an update being denied: [vagrant@openshiftdev openshift]$ osc create -f route.json routes/route-unsecure [vagrant@openshiftdev openshift]$ osc create -f route_path.json routes/route-unsecure-path [vagrant@openshiftdev openshift]$ osc get routes NAME HOST/PORT PATH SERVICE LABELS route-unsecure www.example.com hello-nginx route-unsecure-path www.example.com /test hello-nginx [vagrant@openshiftdev openshift]$ vi route_path.json <edit to match route-unsecure> [vagrant@openshiftdev openshift]$ osc update -f route_path.json Error from server: Route "route-unsecure-path" is forbidden: Route http://www.example.com already exists in namespace default. If you are the owner of this domain please contact support.
Update: Based on the discussion in GH this is probably not going to be a 3.0 piece and will be in a different form post 3.0. Setting back to assigned for now.
*** Bug 1243664 has been marked as a duplicate of this bug. ***
This issue should be fixed in devenv_fedora-2323 with the latest route images, Could you help change the status to ON_QA to verify this bug. thanks
@zhaozhanqi done - thx.
This bug has been fixed with the latest haproxy router images, when those same route, the later one will refer to the oldest one.