Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1431655

Summary:	F5-router, Reencrypt routes do not work
Product:	OpenShift Container Platform	Reporter:	Alexander Koksharov <akokshar>
Component:	Networking	Assignee:	Rajat Chopra <rchopra>
Status:	CLOSED ERRATA	QA Contact:	Meng Bo <bmeng>
Severity:	medium	Docs Contact:
Priority:	high
Version:	3.4.0	CC:	aos-bugs, bbennett, doh, eparis, hongli, smunilla, xtian
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:	Feature: Support re-encryption of traffic Reason: OpenShift 'route' object has the reencrypt type supported for a long time, the F5 implementation has not had the support. Result: This bz captures the enhancement	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-10 05:18:47 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alexander Koksharov 2017-03-13 14:26:15 UTC

Description of problem:
Customer has integrated his OCP cluster with F5 following "native integration" procedure. However it is appear that "Reencrypt routes" do not work at all.


Version-Release number of selected component (if applicable):
3.4

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Ben Bennett 2017-03-28 15:36:30 UTC

*** Bug 1434669 has been marked as a duplicate of this bug. ***

Comment 2 Ben Bennett 2017-04-19 13:53:22 UTC

Rajat has a fix pending.

Comment 3 Rajat Chopra 2017-04-26 04:06:09 UTC

Fix in this PR: https://github.com/openshift/origin/pull/13898

Comment 5 Hongan Li 2017-06-05 06:38:14 UTC

verified in atomic-openshift-3.6.94-1.git.0.ba4aad2.el7.x86_64, the reencrypt route can work with edge/passthrough route at the same time.

But after deleting the reencrypt route, the entry in related Data Group List (ssl_reencrypt_route_dg and ssl_reencrypt_servername_dg) was not removed.

Comment 6 Hongan Li 2017-06-05 06:42:41 UTC

And document is needed for upgrade, because the old openshift_passthrough_irule will not be updated until admin delete irule and restart f5 router pod.

Comment 7 Rajat Chopra 2017-06-27 18:34:29 UTC

Fixed with: https://github.com/openshift/origin/pull/14921

Comment 8 openshift-github-bot 2017-06-30 18:04:38 UTC

Commit pushed to master at https://github.com/openshift/origin

https://github.com/openshift/origin/commit/7f13ab7211d19ee09b1e877c10935bd62a379d5f
fix for bug1431655: delete reencrypt routes

Comment 10 Hongan Li 2017-07-05 08:59:29 UTC

verified in atomic-openshift-3.6.133-1.git.0.524e4c8.el7.x86_64 and the issue has been fixed.

Comment 12 errata-xmlrpc 2017-08-10 05:18:47 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1716