Bug 1762145 - TLS handshake error breaking multus admission controller functionality
Summary: TLS handshake error breaking multus admission controller functionality
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 4.3.0
Assignee: Tomofumi Hayashi
QA Contact: Anurag saxena
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-10-16 03:12 UTC by Anurag saxena
Modified: 2020-05-19 18:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-01-23 11:07:48 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-network-operator pull 362 0 'None' closed Bug 1762145: TLS handshake error breaking multus admission controller functionality 2020-09-18 22:56:01 UTC
Red Hat Product Errata RHBA-2020:0062 0 None None None 2020-01-23 11:08:15 UTC

Description Anurag saxena 2019-10-16 03:12:08 UTC
Description of problem: While trying to observe multus admission controller functionality, TLS handshake errors are preventing it to catch bad config defined under network attachment definitions.

Version-Release number of selected component (if applicable):


How reproducible: Always


Steps to Reproduce:
1. Define bad config in net-attach-def

$ cat def.yaml 
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: macvlan-bridge
spec:
  config: 'asdf'


2. 
$ oc create -f def.yaml 
networkattachmentdefinition.k8s.cni.cncf.io/macvlan-bridge created


3.
$ oc logs multus-admission-controller-gssgv --namespace=openshift-multus
I1016 02:37:18.023175       1 main.go:41] starting net-attach-def-admission-controller webhook server
2019/10/16 02:58:35 http: TLS handshake error from 10.128.0.1:50478: remote error: tls: bad certificate

Actual results: TLS handshae errors in step 3 preventing multus to catch error in step 2


Expected results:Admission controller should throw following error but TLS error above ceasing its functionality 

"Error from server: error when creating "def.yaml": admission webhook "net-attach-def-admission-controller-validating-config.k8s.io" denied the request: invalid config: error parsing configuration: invalid character 'a' looking for beginning of value

Above has been alaysed in bug defined in Additional info

Additional info: Check referenced BZ https://bugzilla.redhat.com/show_bug.cgi?id=1758702#c11

Comment 1 Tomofumi Hayashi 2019-10-23 08:26:22 UTC
PR Ready: https://github.com/openshift/cluster-network-operator/pull/362

Comment 3 Anurag saxena 2019-10-28 15:09:15 UTC
Verified on 4.3.0-0.nightly-2019-10-28-083944. Thanks for the fixes, this looks great now. mulktus ac now throwing expected errors ithout any tls errors


$ cat def.yaml 
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: macvlan-bridge
spec:
  config: 'asdf'


$ oc create -f def.yaml 
Error from server: error when creating "def.yaml": admission webhook "multus-validating-config.k8s.io" denied the request: invalid config: error parsing configuration: invalid character 'a' looking for beginning of value

$ cat def.yaml 
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: macvlan-bridge@$
spec:
  config: ''


$ oc create -f def.yaml 
The NetworkAttachmentDefinition "macvlan-bridge@$" is invalid: metadata.name: Invalid value: "macvlan-bridge@$": a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')

Comment 5 errata-xmlrpc 2020-01-23 11:07:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0062


Note You need to log in before you can comment on or make changes to this bug.