Bug 1408129 – [Backport] Change haproxy router to use a certificate list/map file.

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1408129 - [Backport] Change haproxy router to use a certificate list/map file.

Summary:	[Backport] Change haproxy router to use a certificate list/map file.

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Routing (Show other bugs)
Sub Component:
Version:	3.3.0
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	---
Target Release:	3.3.1
Assigned To:	Ram Ranganathan
QA Contact:	zhaozhanqi
Docs Contact:

URL:
Whiteboard:
Keywords:

Duplicates:	1428233 (view as bug list)
Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2016-12-22 03:50 EST by Carsten Lichy-Bittendorf
Modified:	2017-03-03 09:24 EST (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Previously, the haproxy router config used to specify the directory from where certificates would be used for serving. Based on the SNI header, haproxy would pick up the first certificate that matched the secure request and use that as the serving certificate. This was an indeterministic method if multiple routes specified the same certificate/expired versions of the same certificate. The backport/fix now uses a new map and serves the certificate based on the SNI header/host in a deterministic fashion.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-02-22 13:10:43 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2017:0289	normal	SHIPPED_LIVE	OpenShift Container Platform 3.4.1.7, 3.3.1.14, and 3.2.1.26 bug fix update	2017-02-22 18:10:04 EST

Groups: None (edit)

Description Carsten Lichy-Bittendorf 2016-12-22 03:50:44 EST

Customer requests to backport https://github.com/openshift/origin/commit/5ce393cd760c07f993e1bf07ab010239662617bd into OCP 3.3.
Depending on other open router issues he might need a backport into OCP
3.2.

Comment 3 Ram Ranganathan 2017-01-24 20:19:10 EST

Backported https://github.com/openshift/origin/pull/11217 to  OSE 3.3
The OSE 3.3 specific PR is: https://github.com/openshift/ose/pull/578

Comment 5 zhaozhanqi 2017-02-02 21:14:38 EST

since this PR https://github.com/openshift/ose/pull/578 has not been merged. so mark this bug to 'assigned' for now. feel free to change back to 'ON_QA' once it is merged to OCP 3.3

Comment 9 Troy Dawson 2017-02-08 17:24:29 EST

This has been merged into ocp and is in OCP v3.3.1.13 or newer.

Comment 10 zhaozhanqi 2017-02-09 02:21:26 EST

hi, tested this bug on OCP v3.3.1.13 , the router cannot be running with the following logs.

E0209 07:13:26.497584       1 ratelimiter.go:52] error creating config file /var/lib/haproxy/conf/cert_config.map: open /var/lib/haproxy/conf/cert_config.map: permission denied

Comment 11 Ram Ranganathan 2017-02-10 01:33:00 EST

@Troy, that looks the Dockerfile changes were not picked up. There is a change to the 
Dockerfile to touch/create the cert_config.map file. Thx

Comment 12 Troy Dawson 2017-02-10 10:16:44 EST

@Ram
You are correct.  I'm sorry about that.
I have updated the Dockerfile, making sure it's correct and rebuilt the image.
openshift3/ose-haproxy-router:v3.3.1.13-3
It should be available in all the usual testing areas.

Comment 13 zhaozhanqi 2017-02-13 02:54:14 EST

Verified this bug on 3.3.1.13 with haproxy image id(726deac0cf76), it works well

steps:

1. Create app and edge/reencrypt route with custom cert
2. Check the route can work well
3. check the cert_config.map in haproxy pod
  cat cert_config.map 
/var/lib/haproxy/router/certs/z1_reencrypt-route-no-path.pem reen.example.com
/var/lib/haproxy/router/certs/z1_edge-route-no-path.pem edge.example.com

Comment 15 errata-xmlrpc 2017-02-22 13:10:43 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0289

Comment 16 Ben Bennett 2017-03-03 09:24:38 EST

*** Bug 1428233 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.