Bug 1756475 - Cannot disable S3 redirect via operator
Summary: Cannot disable S3 redirect via operator
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Image Registry
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.3.0
Assignee: Oleg Bulatov
QA Contact: Wenjing Zheng
Depends On:
Blocks: 1756478
TreeView+ depends on / blocked
Reported: 2019-09-27 17:39 UTC by Adam Kaplan
Modified: 2020-05-13 21:25 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1756478 (view as bug list)
Last Closed: 2020-05-13 21:25:54 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Github openshift cluster-image-registry-operator pull 385 None closed Bug 1756475: Add flag 'DisableRedirect', decide to route all data through the registry 2020-02-20 15:23:48 UTC
Red Hat Product Errata RHBA-2020:0062 None None None 2020-05-13 21:25:56 UTC

Description Adam Kaplan 2019-09-27 17:39:12 UTC
Description of problem:
docker/distribution supports a "redirect" option for supported drivers like s3 [1].
In this case read requests (HEAD, GET) are redirected to the storage provider. This is enabled by default in the image registry.

There are several cases where the redirect breaks either Docker clients, or storage providers which implement the s3 API. Cluster admins should be able to disable this behavior.

Version-Release number of selected component (if applicable): 4.3.0

Additional info:

[1] https://docs.docker.com/registry/configuration/#redirect

Comment 2 XiuJuan Wang 2019-10-16 06:43:12 UTC
Verified this issue in 4.3.0-0.nightly-2019-10-15-180816 version
Could disable redirect via operator.
$oc patch config.image/cluster -p '{"spec":{"disableRedirect":true}}' --type=merge
$ oc get pods
 NAME                                               READY   STATUS    RESTARTS   AGE
cluster-image-registry-operator-5df46d9fc7-554j4   2/2     Running   0          3h54m
image-registry-564cc67cd6-8gdb9                    1/1     Running   0          22s
node-ca-4gxqt                                      1/1     Running   0          3h53m
node-ca-fgqs2                                      1/1     Running   0          3h53m
node-ca-q5h84                                      1/1     Running   0          3h52m
node-ca-q5pr4                                      1/1     Running   0          3h52m
node-ca-w4kkn                                      1/1     Running   0          3h53m

$oc set env deployment image-registry  --list | grep -i redirect

$ oc logs -f image-registry-564cc67cd6-8gdb9   | grep -i redirect
time="2019-10-16T06:22:03.080131701Z" level=info msg="backend redirection disabled" go.version=go1.12.8

Comment 4 errata-xmlrpc 2020-05-13 21:25:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.