Bug 1431655 – F5-router, Reencrypt routes do not work

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1431655 - F5-router, Reencrypt routes do not work

Summary:	F5-router, Reencrypt routes do not work

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Networking (Show other bugs)
Sub Component:
Version:	3.4.0
Hardware:	Unspecified Unspecified

Priority	high Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Rajat Chopra
QA Contact:	Meng Bo
Docs Contact:

URL:
Whiteboard:
Keywords:

Duplicates:	1434669 (view as bug list)
Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-03-13 10:26 EDT by Alexander Koksharov
Modified:	2017-08-16 15 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	Feature: Support re-encryption of traffic Reason: OpenShift 'route' object has the reencrypt type supported for a long time, the F5 implementation has not had the support. Result: This bz captures the enhancement
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-10 01:18:47 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Origin (Github)	13898	None	None	None	2017-04-26 08:30 EDT
Origin (Github)	14921	None	None	None	2017-06-28 13:47 EDT
Red Hat Product Errata	RHEA-2017:1716	normal	SHIPPED_LIVE	Red Hat OpenShift Container Platform 3.6 RPM Release Advisory	2017-08-10 05:02:50 EDT

Groups: None (edit)

Description Alexander Koksharov 2017-03-13 10:26:15 EDT

Description of problem:
Customer has integrated his OCP cluster with F5 following "native integration" procedure. However it is appear that "Reencrypt routes" do not work at all.


Version-Release number of selected component (if applicable):
3.4

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Ben Bennett 2017-03-28 11:36:30 EDT

*** Bug 1434669 has been marked as a duplicate of this bug. ***

Comment 2 Ben Bennett 2017-04-19 09:53:22 EDT

Rajat has a fix pending.

Comment 3 Rajat Chopra 2017-04-26 00:06:09 EDT

Fix in this PR: https://github.com/openshift/origin/pull/13898

Comment 5 hongli 2017-06-05 02:38:14 EDT

verified in atomic-openshift-3.6.94-1.git.0.ba4aad2.el7.x86_64, the reencrypt route can work with edge/passthrough route at the same time.

But after deleting the reencrypt route, the entry in related Data Group List (ssl_reencrypt_route_dg and ssl_reencrypt_servername_dg) was not removed.

Comment 6 hongli 2017-06-05 02:42:41 EDT

And document is needed for upgrade, because the old openshift_passthrough_irule will not be updated until admin delete irule and restart f5 router pod.

Comment 7 Rajat Chopra 2017-06-27 14:34:29 EDT

Fixed with: https://github.com/openshift/origin/pull/14921

Comment 8 openshift-github-bot 2017-06-30 14:04:38 EDT

Commit pushed to master at https://github.com/openshift/origin

https://github.com/openshift/origin/commit/7f13ab7211d19ee09b1e877c10935bd62a379d5f
fix for bug1431655: delete reencrypt routes

Comment 10 hongli 2017-07-05 04:59:29 EDT

verified in atomic-openshift-3.6.133-1.git.0.524e4c8.el7.x86_64 and the issue has been fixed.

Comment 12 errata-xmlrpc 2017-08-10 01:18:47 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1716

Note You need to log in before you can comment on or make changes to this bug.