Bug 1727834
| Summary: | oauth didn't work with http2.0 | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | xpflying |
| Component: | apiserver-auth | Assignee: | Standa Laznicka <slaznick> |
| Status: | CLOSED WONTFIX | QA Contact: | scheng |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 4.1.0 | CC: | amcdermo, aos-bugs, dhansen, gblomqui, lszaszki, mfojtik, mmasters, nagrawal, slaznick |
| Target Milestone: | --- | Flags: | mfojtik:
needinfo?
|
| Target Release: | 4.6.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | 4.5 LifecycleReset | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-08-31 14:00:11 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
xpflying
2019-07-08 10:23:16 UTC
This is probably happening because the OAuth server will always force HTTP 1.1 (as seen in the log - `I0708 06:46:30.531942 1 secure_serving.go:66] Forcing use of http/1.1 only`). This had to be done because of the issues we encountered during the development of the authentication-operator for 4.1. You can read about them in https://bugzilla.redhat.com/show_bug.cgi?id=1686476#c16. The OAuth server as deployed in the cluster today fulfills all the requirements to be hitting the mentioned bug. This bug hasn't had any activity in the last 30 days. Maybe the problem got resolved, was a duplicate of something else, or became less pressing for some reason - or maybe it's still relevant but just hasn't been looked at yet. As such, we're marking this bug as "LifecycleStale". If you have further information on the current state of the bug, please update it, otherwise this bug will be automatically closed in 7 days. The information can be, for example, that the problem still occurs, that you still want the feature, that more information is needed, or that the bug is (for whatever reason) no longer relevant. There is no plan to fix this in 4.5. *** Bug 1826994 has been marked as a duplicate of this bug. *** I’m adding UpcomingSprint, because I was occupied by fixing bugs with higher priority/severity, developing new features with higher priority, or developing new features to improve stability at a macro level. I will revisit this bug next sprint. Setting "ROUTER_ENABLE_HTTP2=TRUE" was removed in 4.4. And in 4.5 we are enabling HTTP/2 by default for re-encrypt and passthrough routes that use a custom certificate. The general goal of supporting HTTP/2 for OAuth is reasonable. One way to achieve that goal would be to implement https://issues.redhat.com/browse/RFE-507 so that the cluster administrator could configure a custom host and certificate for OAuth. If the OAuth route had a custom host and certificate, we could then enable HTTP/2 for that route.  This is blocked by custom cert support, as comment #14 suggests. I’m adding UpcomingSprint, because I was occupied by fixing bugs with higher priority/severity, developing new features with higher priority, or developing new features to improve stability at a macro level. I will revisit this bug next sprint. I’m adding UpcomingSprint, because I was occupied by fixing bugs with higher priority/severity, developing new features with higher priority, or developing new features to improve stability at a macro level. I will revisit this bug next sprint. This bug will be evaluated next sprint. This bug hasn't had any activity in the last 30 days. Maybe the problem got resolved, was a duplicate of something else, or became less pressing for some reason - or maybe it's still relevant but just hasn't been looked at yet. As such, we're marking this bug as "LifecycleStale" and decreasing the severity/priority. If you have further information on the current state of the bug, please update it, otherwise this bug can be closed in about 7 days. The information can be, for example, that the problem still occurs, that you still want the feature, that more information is needed, or that the bug is (for whatever reason) no longer relevant. This bug hasn't had any activity 7 days after it was marked as LifecycleStale, so we are closing this bug as WONTFIX. If you consider this bug still valuable, please reopen it or create new bug. The LifecycleStale keyword was removed because the bug got commented on recently. The bug assignee was notified. |