Description of problem: When replacing default ingress certificate with custom organization root CA, added root CA into proxies/config. Grafana pod did not take the root CA into it pod CA bundle. Hence grafana proxy POST call auth URL returned below error: 2020/01/07 10:14:11 oauthproxy.go:645: error redeeming code (client:10.9.0.1:43806): Post https://oauth-openshift.apps.ocp4.local.bytewise.my/oauth/token: x509: certificate signed by unknown authority 2020/01/07 10:14:11 oauthproxy.go:438: ErrorPage 500 Internal Error Internal Error Version-Release number of selected component (if applicable): 4.1.12 How reproducible: Follow this guide[1] to add cluster wide new custom root CA and then replace default ingress certificate from here[2]. Login to the cluster and open up Grafana dashboard will shown above error. [1]: https://docs.openshift.com/container-platform/4.2/networking/enable-cluster-wide-proxy.html [2]: https://docs.openshift.com/container-platform/4.2/authentication/certificates/replacing-default-ingress-certificate.html Steps to Reproduce: 1. 2. 3. Actual results: Grafana CA trust bundle did not include proxies certificate for trusting custom root CA. Expected results: Grafana CA trust bundle should include proxies certificate and trust the custom root CA. Additional info:
1. The custom root CA: mzali ~ cat CA-Auth/rootCA.crt | head -n 2 -----BEGIN CERTIFICATE----- MIIFxTCCA62gAwIBAgIUIQeGpl00JG5PC1Db0xrNpW9aiu0wDQYJKoZIhvcNAQEL 2. The trust bundle does not include the root CA: mzali ~ oc rsh grafana-6cc69d4d4b-5xc7b Defaulting container name to grafana. Use 'oc describe pod/grafana-6cc69d4d4b-5xc7b -n openshift-monitoring' to see all of the containers in this pod. sh-4.2$ cat /etc/pki/tls/certs/ca-bundle.crt | grep MIIFxTCCA62gAwIBAgIUIQeGpl00JG5PC1Db0xrNpW9aiu0wDQYJKoZIhvcNAQEL sh-4.2$
Setting target to active development branch (4.4). Fixes (if any) will result in cloned BZs for backports (where required/requested) for prior versions.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0107