Bug 1664424 - [RFE] TLS Configuration for Undercloud should make docker-distribution (registry) serve its registry over HTTPS
Summary: [RFE] TLS Configuration for Undercloud should make docker-distribution (regis...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-tripleoclient
Version: 13.0 (Queens)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: ---
Assignee: OSP Team
QA Contact: Jad Haj Yahya
URL:
Whiteboard:
Depends On: 1547826 1664423
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-01-08 18:01 UTC by Nathan Kinder
Modified: 2023-01-10 15:34 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1664423
Environment:
Last Closed: 2023-01-10 15:34:06 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker OSP-203 0 None None None 2022-03-10 23:44:06 UTC

Description Nathan Kinder 2019-01-08 18:01:11 UTC
+++ This bug was initially created as a clone of Bug #1664423 +++

+++ This bug was initially created as a clone of Bug #1547826 +++

Description of problem:
If I configure OSP12 for TLS, or TLS everywhere, docker-distribution serves the docker registry over an unencrypted port by default on the provisioning network.  This network is (mostly) routable in production instances.

Version-Release number of selected component (if applicable):
python-tripleoclient-7.3.3-7.el7ost.noarch

How reproducible:
100%

Steps to Reproduce:
1. deploy OSP12 with TLS enabled, or do TLS everywhere config and add TLS after deployment
2. Create a local container registry
3. registry is served on a (usually) routable network over HTTP

Actual results:
registry is served over https

Expected results:
encrypted registry as there is transit across wires between nodes on encrypted protocol

Additional info:
Adding these lines to /etc/docker-distribution/registry would fix the issue (assuming your ssl cert is in /etc/pki/instack-certs/undercloud.pem
---
    tls:
        certificate: /etc/pki/instack-certs/undercloud.pem
        key: /etc/pki/instack-certs/undercloud.pem
---


Note You need to log in before you can comment on or make changes to this bug.