Bug 1892799 - Mounting additionalTrustBundle in the operator
Summary: Mounting additionalTrustBundle in the operator
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Image Registry
Version: 4.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.7.0
Assignee: Oleg Bulatov
QA Contact: Wenjing Zheng
URL:
Whiteboard:
Depends On:
Blocks: 1894195 1896423
TreeView+ depends on / blocked
 
Reported: 2020-10-29 16:30 UTC by Oleg Bulatov
Modified: 2022-10-12 03:26 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: the image registry operator did not use its entrypoint because an explicit command was provided Consequence: cluster-wide trusted-ca was not used by the operator and the operator couldn't connect to storage providers that don't work without custom trusted-ca Fix: remove explicit command from the pod spec Result: the image entrypoint is used by the container that applies trusted-ca
Clone Of:
: 1896423 (view as bug list)
Environment:
Last Closed: 2021-02-24 15:29:18 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cluster-image-registry-operator pull 631 0 None closed Bug 1892799: Operator should use entrypoint script 2021-02-17 18:22:34 UTC
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:29:47 UTC

Description Oleg Bulatov 2020-10-29 16:30:14 UTC 
Description of problem:

The cluster-image-registry-operator does not trust the cluster's CA trust bundle.

Version-Release number of selected component (if applicable):

4.6.0, 4.6.1

How reproducible:

Always

Steps to Reproduce:

1. install the cluster

Actual results:

The cluster-image-registry-operator doesn't have the message
Overwriting root TLS certificate authority trust
in its logs and it doesn't trust the cluster's CA trust bundle.

Expected results:

The operator overwrites TLS certificate authority trust with the user-provided CA bundle and uses it.

Additional info:

Initially reported on GitHub: https://github.com/openshift/cluster-image-registry-operator/issues/630
Comment 3 Wenjing Zheng 2020-11-10 10:07:46 UTC 
Below warning can be found in operator log and I can see user-ca-bundle content in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem:
Overwriting root TLS certificate authority trust store
sh-4.4$ diff /var/run/configmaps/trusted-ca/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem 
sh-4.4$

Verified on 4.7.0-0.nightly-2020-11-09-190845.
Comment 8 errata-xmlrpc 2021-02-24 15:29:18 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633
Note You need to log in before you can comment on or make changes to this bug.