Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Cluster-wide proxy settings are passed through to mig-ui in MTC 1.4.2, and this can break the initial authentication flow for the user. There is an existing bug filed for this at https://bugzilla.redhat.com/show_bug.cgi?id=1926110, but the workaround described requires reconfiguration of the squid proxy, and this solution is NOT usable for a class of users since the cluster-admins do not have configuration control of company-wide proxies their clusters are required to use. Guillermo Ojea Quintana reported this issue. Version-Release number of selected component (if applicable): Problem exists in MTC 1.4.2 How reproducible: Always. Workaround is possible by overriding the proxy setting in the mig-ui configmap, but mig-operator will overwrite user settings here, so this is not a viable long-term solution. Steps to Reproduce: 1. Deploy MTC to cluster with cluster-wide proxy 2. mig-ui will assume cluster-wide proxy setting 3. oauth flow talking to <cluster>:6443/.well-known/oauth-authorization-server will fail with status code 500
Proxy passthrough to UI implemented in https://github.com/konveyor/mig-operator/pull/579
Suggested solutions from Guillermo: - Allow configuration of whether proxy setting is passed through to UI - Convert URL to internal .svc URL so proxy won't be used for oauth flow
Another possible solution is to respect the "noProxy" variable.
I can confirm that these other pods: velero, migration-controller, migration-operator are taking the NO_PROXY variable from the system so they work OK. The problem is with the migration-ui pod that is only taking in the HTTP_PROXY and HTTPS_PROXY variables.
Using MTC 1.4.3 stage. - name: MIG_UI_REPO value: openshift-migration-ui-rhel8@sha256 - name: MIG_UI_TAG value: bde539e7c462ac14ec7752497250ea5575cbdbc3f367fbd1b1dea027c212d219 It seems that the fix is not working. We move the BZ to ASSIGNED status.
Verified using MTC 1.4.3 openshift-migration-rhel7-operator@sha256:c95d10c87b796ea2680184cb092ea2dea7ae65194bc829f7a7fb9fe2fbe4f175 - name: MIG_UI_REPO value: openshift-migration-ui-rhel8@sha256 - name: MIG_UI_TAG value: 0c0252c31f58196e2d0336896b254fc0a472d1f9f40df5a85dc6ca166d9bcedf The UI worked without problems and without any extra configuration Moved to VERIFIED status.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Migration Toolkit for Containers (MTC) tool image release advisory 1.4.3), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1439