Bug 1380342 - Cannot deploy docker-registry "Readiness probe failed: HTTP probe failed with statuscode: 403" [NEEDINFO]
Summary: Cannot deploy docker-registry "Readiness probe failed: HTTP probe failed with...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.2.1
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
: 3.4.z
Assignee: Phil Cameron
QA Contact: Meng Bo
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-29 11:05 UTC by Miheer Salunke
Modified: 2017-05-18 09:27 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
PR 3405 documented the work
Clone Of:
Environment:
Last Closed: 2017-05-18 09:27:04 UTC
Target Upstream Version:
pcameron: needinfo? (misalunk)

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1235 0 normal SHIPPED_LIVE OpenShift Container Platform 3.5, 3.4, 3.3, and 3.1 bug fix update 2017-05-18 13:15:52 UTC

Description Miheer Salunke 2016-09-29 11:05:57 UTC 
Description of problem:

Cannot deploy docker-registry. The registry pod after getting created gets killed in sometime.

 
 Readiness probe failed: HTTP probe failed with statuscode: 403

 Liveness probe failed: HTTP probe failed with statuscode: 403




Version-Release number of selected component (if applicable):
atomic-openshift-3.2.1.13-1

How reproducible:
Always on customer end

Steps to Reproduce:
1.Create a registry
2.
3.

Actual results:
The registry pod gets created and the again gets killed. 
We can see the readiness and liveness probe failing with 403 error.

Expected results:
The registry pod shall not get killed after getting created. The Liveness and Readiness probe shall not give 403 error.

Additional info:
Comment 4 Michal Minar 2016-10-04 08:31:52 UTC 
Miheer, is some kind of network filtering proxy running on the host?

The readiness probe receives (from node.log):

    <HTML><HEAD><TITLE>Access Denied</TITLE></HEAD>
    <BODY>
    <FONT face="Helvetica"><big><strong></strong></big><BR></FONT>
    <blockquote>
    <TABLE border=0 cellPadding=1 width="80%">
    <TR><TD><FONT face="Helvetica"><big>Access Denied (policy_denied)</big><BR><BR></FONT></TD></TR>
    <TR><TD><FONT face="Helvetica">Your system policy has denied access to the requested URL.</FONT></TD></TR>
    <TR><TD><FONT face="Helvetica"></FONT></TD></TR>
    <TR><TD><FONT face="Helvetica" SIZE=2><BR>For assistance, contact your network support team.</FONT></TD></TR>
    </TABLE>
    </blockquote>
    </FONT>
    </BODY>
    </HTML>

Which means the request didn't event make it to the registry.
Comment 5 Michal Fojtik 2016-10-31 11:39:51 UTC 
ping?
Comment 6 Michal Fojtik 2016-10-31 11:39:52 UTC 
ping?
Comment 12 Phil Cameron 2016-12-16 18:40:24 UTC 
I have changed the "Working with HTTP Proxies" documentation
https://github.com/openshift/openshift-docs/pull/3405

Please take a look. I can make further edits.
Comment 13 Phil Cameron 2017-01-06 14:48:06 UTC 
PR#3405 MERGED
Comment 14 Troy Dawson 2017-03-07 19:54:04 UTC 
This should have gone to QA a while ago, moving it on.
Comment 15 Meng Bo 2017-03-08 10:45:32 UTC 
The doc looks good to me.
Comment 17 errata-xmlrpc 2017-05-18 09:27:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1235
Note You need to log in before you can comment on or make changes to this bug.