Description of problem: Setup an ocp-3.6 cluster behind proxy, after installation, found it's failed to push image to docker-registry [root@openshift-138 ~]# oc logs nodejs-mongodb-example-1-build -n install-test <snip> Pushing image docker-registry.default.svc:5000/install-test/nodejs-mongodb-example:latest ... Registry server Address: Registry server User Name: serviceaccount Registry server Email: serviceaccount Registry server Password: <<non-empty>> error: build error: Failed to push image: Get https://docker-registry.default.svc:5000/v1/_ping: Forbidden [root@openshift-138 ~]# docker info |grep "No Proxy" WARNING: bridge-nf-call-iptables is disabled WARNING: bridge-nf-call-ip6tables is disabled No Proxy: .cluster.local,169.254.169.254,openshift-138.x.com,openshift-144.x.com,openshift-145.x.com,openshift-148.x.com,openshift-151.x.com Version-Release number of selected component (if applicable): openshift-ansible-3.6.133-1.git.0.950bb48.el7.noarch.rpm How reproducible: Always Steps to Reproduce: 1. Build ocp-3.6 env behind proxy with the following options in inventory: openshift_http_proxy=http://xxx.redhat.com:x openshift_https_proxy=http://xxx.redhat.com:x openshift_no_proxy="169.254.169.254" Actual results: See Description Expected results: Additional info:
This bug blocks the testing on 3.6 env behind proxy.
Fix submitted here https://github.com/openshift/openshift-ansible/pull/4678
Verify this bug with openshift-ansible-3.6.135-1.git.0.5533fe3.el7.noarch .svc domain was added into service env file after installation. [root@qe-gpei-etcd-sc-master-1 sysconfig]# grep NO_PROXY * -r atomic-openshift-master:NO_PROXY=.cluster.local,.svc,qe-gpei-etcd-sc-master-1,172.30.0.0/16,10.128.0.0/14 docker:NO_PROXY='.cluster.local,.svc,qe-gpei-etcd-sc-master-1' [root@qe-gpei-etcd-sc-master-1 sysconfig]# docker info |grep "No Proxy" WARNING: bridge-nf-call-iptables is disabled WARNING: bridge-nf-call-ip6tables is disabled No Proxy: .cluster.local,.svc,qe-gpei-etcd-sc-master-1
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:3188