Bug 1435803 - Egress routing does not work with SSL endpoints
Summary: Egress routing does not work with SSL endpoints
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: RFE
Version: 3.4.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Eric Paris
QA Contact: Xiaoli Tian
URL:
Whiteboard:
Depends On:
Blocks: 1475417
TreeView+ depends on / blocked
 
Reported: 2017-03-24 20:26 UTC by Eric Rich
Modified: 2021-08-30 13:00 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1475417 (view as bug list)
Environment:
Last Closed: 2017-08-16 19:18:07 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Origin (Github) 13586 0 None None None 2017-07-26 15:45:43 UTC
Red Hat Knowledge Base (Solution) 3054431 0 None None None 2017-05-25 03:01:34 UTC

Description Eric Rich 2017-03-24 20:26:41 UTC 
Description of problem:

When trying to Talk to SNL endpoints using the egress routing solution you cant get SNI/HOST identification to work because, the endpoints on the egress router make connection to an IP address. 

https://docs.openshift.com/container-platform/3.4/admin_guide/managing_pods.html#admin-guide-deploying-an-egress-router-pod
Comment 4 Dan Winship 2017-04-13 14:03:30 UTC 
We've been talking about solving this with an HTTP proxy mode (which is also useful for other reasons), but that only solves HTTPS, not TLS in general. Adding a link to another Trello card for an egress-router mode using haproxy in TLS-terminating mode, so that the client pod can make a TLS connection to the egress-router and then the egress-router makes a separate TLS connection to the destination server.
Comment 5 Ben Bennett 2017-04-19 14:03:05 UTC 
Moving to RFE since it is really a feature request.
Comment 6 Ben Bennett 2017-07-26 15:43:18 UTC 
I've cloned this to https://bugzilla.redhat.com/show_bug.cgi?id=1475417 to handle the non-HTTP TLS case (https://trello.com/c/0B7cFaKA)
Comment 7 Ben Bennett 2017-07-26 15:45:43 UTC 
Resolved by https://github.com/openshift/origin/pull/13586
Comment 8 Bryan Yount 2017-08-10 16:49:47 UTC 
Did this BZ make the 3.6 release?
Note You need to log in before you can comment on or make changes to this bug.