Bug 1489042 - [3.6][Backport] exposing docker-registry with a non tls-passthrough route does not work
Summary: [3.6][Backport] exposing docker-registry with a non tls-passthrough route doe...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Image Registry
Version: 3.6.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 3.6.z
Assignee: Michal Minar
QA Contact: Dongbo Yan
URL:
Whiteboard:
Depends On: 1471707
Blocks: 1489039
TreeView+ depends on / blocked
 
Reported: 2017-09-06 15:48 UTC by Michal Minar
Modified: 2021-06-10 12:57 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: The registry used to append forwarded target port to redirected location urls. Registry client gets confused by the received location containing superfluous port and cannot match it against the original host. This happened when exposed with tls-termination other than passthrough. Consequence: Client's new request to the target location lacks credentials. As a consequence, image push fails due to authorization error. Fix: Registry was rebased to newer version which fixes forwarding processing logic. Result: Registry now doesn't confuse its clients. Clients can push images successfully to the exposed registry using arbitrary tls-termination.
Clone Of: 1471707
Environment:
Last Closed: 2017-10-25 13:06:40 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:3049 0 normal SHIPPED_LIVE OpenShift Container Platform 3.6, 3.5, and 3.4 bug fix and enhancement update 2017-10-25 15:57:15 UTC

Comment 1 Michal Minar 2017-09-06 15:50:11 UTC 
PR https://github.com/docker/distribution/pull/2219 will be back-ported to fix the issue.
Comment 2 Michal Minar 2017-09-08 14:24:23 UTC 
Thomas found out that with the fix in question, :443 suffix added to registry names causes timeouts.

We need to make sure that our registry can be addressed both with&without the :443 suffix because many customers added it to their external registries as a work-around for the broken port forwarding.

This needs to be further investigated.
Comment 3 Michal Minar 2017-09-27 16:31:16 UTC 
I could not confirm the registry has issues with push-specs with or without the :443 on the latest master. Therefore, I'll continue with the back-port.
Comment 4 Ben Parees 2017-10-02 19:46:37 UTC 
Was this backport requested by a customer?  If not, why are we doing it?
Comment 6 Michal Minar 2017-10-03 10:00:48 UTC 
Back-port PR: https://github.com/openshift/ose/pull/883
Comment 8 Dongbo Yan 2017-10-13 08:02:53 UTC 
wait for available puddle
Comment 11 Dongbo Yan 2017-10-17 05:59:40 UTC 
Verified
$ ./oc version
oc v3.6.173.0.49
kubernetes v1.6.1+5115d708d7
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://:8443
openshift v3.6.173.0.49
kubernetes v1.6.1+5115d708d7
Comment 13 errata-xmlrpc 2017-10-25 13:06:40 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:3049
Note You need to log in before you can comment on or make changes to this bug.