Bug 1467776 - .svc should be added to no_proxy list by default
.svc should be added to no_proxy list by default
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer (Show other bugs)
Unspecified Unspecified
high Severity high
: ---
: 3.7.0
Assigned To: Tim Bielawa
Gaoyun Pei
: Regression, TestBlocker
Depends On:
  Show dependency treegraph
Reported: 2017-07-05 02:03 EDT by Gaoyun Pei
Modified: 2017-11-28 17:00 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: OpenShift Ansible facts was now adding the 'svc' domain to the NO_PROXY settings. Consequence: Users behind proxies are unable to push to registry by DNS. Fix: Added the '.svc' domain to the openshift ansible facts code which generates the NO_PROXY settings string. Result: Users behind a proxy can now push to registry by DNS.
Story Points: ---
Clone Of:
Last Closed: 2017-11-28 17:00:15 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Gaoyun Pei 2017-07-05 02:03:31 EDT
Description of problem:
Setup an ocp-3.6 cluster behind proxy, after installation, found it's failed to 
push image to docker-registry
[root@openshift-138 ~]# oc logs nodejs-mongodb-example-1-build -n install-test
Pushing image docker-registry.default.svc:5000/install-test/nodejs-mongodb-example:latest ...
Registry server Address: 
Registry server User Name: serviceaccount
Registry server Email: serviceaccount@example.org
Registry server Password: <<non-empty>>
error: build error: Failed to push image: Get https://docker-registry.default.svc:5000/v1/_ping: Forbidden

[root@openshift-138 ~]# docker info |grep "No Proxy"
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
No Proxy: .cluster.local,,openshift-138.x.com,openshift-144.x.com,openshift-145.x.com,openshift-148.x.com,openshift-151.x.com

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Build ocp-3.6 env behind proxy with the following options in inventory:

Actual results:
See Description

Expected results:

Additional info:
Comment 1 Gaoyun Pei 2017-07-05 02:04:28 EDT
This bug blocks the testing on 3.6 env behind proxy.
Comment 2 Tim Bielawa 2017-07-05 09:32:37 EDT
Fix submitted here 

Comment 4 Gaoyun Pei 2017-07-06 04:49:19 EDT
Verify this bug with openshift-ansible-3.6.135-1.git.0.5533fe3.el7.noarch

.svc domain was added into service env file after installation.

[root@qe-gpei-etcd-sc-master-1 sysconfig]# grep NO_PROXY * -r
[root@qe-gpei-etcd-sc-master-1 sysconfig]# docker info |grep "No Proxy"
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
No Proxy: .cluster.local,.svc,qe-gpei-etcd-sc-master-1
Comment 8 errata-xmlrpc 2017-11-28 17:00:15 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.