Bug 1939704 - Proxy settings are passed to the MTC web console, breaking the user's initial authentication flow
Summary: Proxy settings are passed to the MTC web console, breaking the user's initial...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Migration Toolkit for Containers
Classification: Red Hat
Component: Operator
Version: 1.4.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 1.4.3
Assignee: Ian
QA Contact: Xin jiang
Avital Pinnick
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-03-16 20:55 UTC by Derek Whatley
Modified: 2025-04-04 12:46 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-04-28 05:52:41 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github konveyor mig-ui pull 1142 0 None open Bug 1939704: bypass proxy if the NO_PROXY list contains the clusterapi 2021-03-17 16:52:24 UTC
Github konveyor mig-ui pull 1146 0 None open Bug 1939704: bypass proxy if the NO_PROXY list contains the clusterapi (#1142) 2021-03-26 15:00:42 UTC
Github konveyor mig-ui pull 1172 0 None open Bug 1939704: add axios proxy config 2021-04-16 17:56:17 UTC
Github konveyor mig-ui pull 1174 0 None open Bug 1939704: add axios proxy config (#1172) 2021-04-20 14:01:29 UTC
Red Hat Product Errata RHBA-2021:1439 0 None None None 2021-04-28 05:52:49 UTC

Description Derek Whatley 2021-03-16 20:55:53 UTC
Description of problem:
Cluster-wide proxy settings are passed through to mig-ui in MTC 1.4.2, and this can break the initial authentication flow for the user. 

There is an existing bug filed for this at https://bugzilla.redhat.com/show_bug.cgi?id=1926110, but the workaround described 
 requires reconfiguration of the squid proxy, and this solution is NOT usable for a class of users since the cluster-admins do not have configuration control of company-wide proxies their clusters are required to use.

Guillermo Ojea Quintana reported this issue.

Version-Release number of selected component (if applicable):
Problem exists in MTC 1.4.2

How reproducible:
Always. Workaround is possible by overriding the proxy setting in the mig-ui configmap, but mig-operator will overwrite user settings here, so this is not a viable long-term solution.

Steps to Reproduce:
1. Deploy MTC to cluster with cluster-wide proxy
2. mig-ui will assume cluster-wide proxy setting
3. oauth flow talking to <cluster>:6443/.well-known/oauth-authorization-server will fail with status code 500

Comment 2 Derek Whatley 2021-03-16 20:58:56 UTC
Proxy passthrough to UI implemented in https://github.com/konveyor/mig-operator/pull/579

Comment 3 Derek Whatley 2021-03-16 21:03:40 UTC
Suggested solutions from Guillermo: 
 - Allow configuration of whether proxy setting is passed through to UI
 - Convert URL to internal .svc URL so proxy won't be used for oauth flow

Comment 4 Guillermo Ojea Quitana 2021-03-16 21:41:24 UTC
Another possible solution is to respect the "noProxy" variable.

Comment 6 Guillermo Ojea Quitana 2021-03-17 12:38:52 UTC
I can confirm that these other pods: velero, migration-controller, migration-operator are taking the NO_PROXY variable from the system so they work OK.

The problem is with the migration-ui pod that is only taking in the HTTP_PROXY and HTTPS_PROXY variables.

Comment 10 Sergio 2021-04-16 16:20:36 UTC
Using MTC 1.4.3 stage.
    - name: MIG_UI_REPO
      value: openshift-migration-ui-rhel8@sha256
    - name: MIG_UI_TAG
      value: bde539e7c462ac14ec7752497250ea5575cbdbc3f367fbd1b1dea027c212d219


It seems that the fix is not working.


We move the BZ to ASSIGNED status.

Comment 13 Sergio 2021-04-21 13:47:52 UTC
Verified using MTC 1.4.3

openshift-migration-rhel7-operator@sha256:c95d10c87b796ea2680184cb092ea2dea7ae65194bc829f7a7fb9fe2fbe4f175
    - name: MIG_UI_REPO
      value: openshift-migration-ui-rhel8@sha256
    - name: MIG_UI_TAG
      value: 0c0252c31f58196e2d0336896b254fc0a472d1f9f40df5a85dc6ca166d9bcedf


The UI worked without problems and without any extra configuration

Moved to VERIFIED status.

Comment 19 errata-xmlrpc 2021-04-28 05:52:41 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Migration Toolkit for Containers (MTC) tool image release advisory 1.4.3), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1439


Note You need to log in before you can comment on or make changes to this bug.