Description of problem:

I configured Image Registry to use S3 provided by Noobaa (from OCS installation). 

The operator succeed, but unable to push image to the registry. Getting error 500. 

I realized this is caused by the switch "encrypt" from the s3 configuration in configs.imageregistry.operator.openshift.io cluster. When trying to set encrypt to false, the configuration always goes back to true. 

The only way I found out to set the encrypt flag to false is to configure image registry to use pvc claim and then, once image registry is back, update the configuration with s3 with then flag encrypt explicitly set to false. 

The documentation state that the default for encrypt is false. 


Version-Release number of selected component (if applicable):
4.5.14

I know this was working fine in 4.4. I cannot say if this encrypt feature appear in 4.5 or in a sub-version of 4.5. 


Steps to Reproduce:

Install OCP 4.5.14
Install OCS 4.5
create an object bucket claim ( or a bucket directly in noobaa )
Configure image registry to use the new bucket
 - Create secret image-registry-private-configuration-user with bucket creds.
 - edit configs.imageregistry.operator.openshift.io cluster
 - example:

  storage:
    s3:
      bucket: image-registry-395028b0-141b-4242-84a1-1f4a9099aa7c
      encrypt: false
      region: noobaa
      regionEndpoint: https://s3-openshift-storage.apps.ocp-east.mouimetlab.com
      virtualHostedStyle: false

Actual results:

 - Image registry status will be ok, since access to bucket works.
 - Create an image stream in a project
 - try to podman push to the image stream ( should get 500 )

 - try to update configs.imageregistry.operator.openshift.io cluster and change the flag encrypt to false. 

 - check the output of 
   oc get configs.imageregistry.operator.openshift.io cluster -o yaml

  the flag encrypt will be true

 

Expected results:

- Expected to be able to set encrypt flag to false. 


Additional info:

Looks like Noobaa does not support the encrypt feature. It only works when encrypt flag is false. 

I can expect that a customer could face this issue using any local compatible s3 devices for image registry backend. 

Same behaviour on AWS, Bare-metal and UPI VMWare.