Description of problem: When setting the "passthrough" termination policy via annotation feature for the ingress object (Jira: NE-359). The ingress and the corresponding route object gets created but the "route" object does not have the "termination type" field set. This as a result cause the route to be unreachable. Version-Release number of selected component (if applicable): * 4.6.0-0.nightly-2020-08-03-025909 How reproducible: * Always when creating ingress object with "passthrough" annotation. Steps to Reproduce: 1.Create and deploy ingress resource with "passthrough" annotation: ---- apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress-secure annotations: route.openshift.io/termination: "passthrough" spec: rules: - host: service-secure-pr-124.internalapps.aiyengar-cioc46-3007.qe.devcluster.openshift.com http: paths: - backend: serviceName: service-secure servicePort: 27443 $ oc create -f ingress-passthrough.yaml ingress.extensions/ingress-secure created ---- 2. Check the output of "get" ingress and route commands: 3. Test the connection through the route. Actual results: * The ingress and the corresponding route object gets created but the "termination type" is missing in the route: ---- $ oc get ingress NAME CLASS HOSTS ADDRESS PORTS AGE ingress-secure <none> service-secure-pr-124.internalapps.aiyengar-cioc46-3007.qe.devcluster.openshift.com 80 5s $ oc get route NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD ingress-secure-ptmlq service-secure-pr-124.internalapps.aiyengar-cioc46-3007.qe.devcluster.openshift.com ... 1 more service-secure https None <-- $ oc get route ingress-secure-ptmlq -o yaml spec: host: service-secure-test-1.internalapps.aiyengar-oc46-0308.qe.devcluster.openshift.com port: targetPort: https to: kind: Service name: service-secure weight: 100 wildcardPolicy: None ---- Expected results: The termination type should be present in the route object for the router to identify it as passthrough. Reference to creating a default route object: ----- $ oc create route passthrough passth --hostname=service-secure-test-1.internalapps.aiyengar-oc46-0308.qe.devcluster.openshift.com --service=service-secure route.route.openshift.io/passth created $ oc get route NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD passth service-secure-test-1.internalapps.aiyengar-oc46-0308.qe.devcluster.openshift.com ... 1 more service-secure https passthrough None $ oc get route passth -o yaml spec: host: service-secure-test-1.internalapps.aiyengar-oc46-0308.qe.devcluster.openshift.com port: targetPort: https tls: termination: passthrough <--- to: kind: Service name: service-secure weight: 100 wildcardPolicy: None -----
openshift openshift-controller-manager pull 128 is being worked and Miciah plans to review again.
A fix for the issue is in progress; we'll continue working on it this upcoming sprint.
The merge made into "4.6.0-0.nightly-2020-08-26-022604" release version. It is noted that with the fix in place, ingress object with passthrough annotation now works properly and the corresponding route object get created correctly with the "termination" field set: ----- $ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.6.0-0.nightly-2020-08-26-022604 True False 26m Cluster version is 4.6.0-0.nightly-2020-08-26-022604 $ cat ingress-passthrough.yaml apiVersion: extensions/v1beta1 kind: Ingress metadata: name: ingress-secure annotations: route.openshift.io/termination: "passthrough" spec: rules: - host: service-secure-blue-proj1.internalapps.oc46-1865784-patched.qe.devcluster.openshift.com http: paths: - backend: serviceName: service-secure servicePort: 27443 $ oc create -f ingress-passthrough.yaml ingress.extensions/ingress-secure created $ oc get ingress NAME CLASS HOSTS ADDRESS PORTS AGE ingress-secure <none> service-secure-blue-proj1.internalapps.oc46-1865784-patched.qe.devcluster.openshift.com 80 12m $ oc get route NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD ingress-secure-przm4 service-secure-blue-proj1.internalapps.oc46-1865784-patched.qe.devcluster.openshift.com ... 1 more service-secure https passthrough/Redirect None $ curl https://service-secure-blue-proj1.internalapps.oc46-1865784-patched.qe.devcluster.openshift.com/ -k Hello-OpenShift-1 https-8443 -----
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4196