Bug 1961644 - NodeAuthenticator tests are failing in IPv6
Summary: NodeAuthenticator tests are failing in IPv6
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 4.8
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.8.0
Assignee: Ryan Phillips
QA Contact: liyao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-05-18 11:56 UTC by Arda Guclu
Modified: 2021-07-27 23:09 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-27 23:08:55 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift kubernetes pull 760 0 None open UPSTREAM 102089: Bug 1961644: Add Node IP IPv6 formatting in NodeAuthenticator tests 2021-05-21 13:01:47 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 23:09:17 UTC

Description Arda Guclu 2021-05-18 11:56:24 UTC
Description of problem:
[sig-auth] [Feature:NodeAuthenticator] The kubelet can delegate ServiceAccount tokens to the API server
[sig-auth] [Feature:NodeAuthenticator] The kubelet's main port 10250 should reject requests with no credentials

tests are failing in IPv6.

Version-Release number of selected component (if applicable):
4.8+

How reproducible:
Run e2e-metal-ipi-ovn-ipv6 by enabling these 2 tests.

Actual results:
Tests are getting error;

Err: {
            s: "error running /usr/local/bin/kubectl --server=https://api.ostest.test.metalkube.org:6443 --kubeconfig=ocp/ostest/auth/kubeconfig --namespace=e2e-node-authn-205 exec agnhost-pod -- /bin/sh -x -c curl -sIk -o /dev/null -w '%{http_code}' --header \"Authorization: Bearer `cat /var/run/secrets/kubernetes.io/serviceaccount/token`\" https://fd2e:6f44:5dd8:c956::14:10250/metrics:\nCommand stdout:\n000\nstderr:\n+ cat /var/run/secrets/kubernetes.io/serviceaccount/token\n+ curl -sIk -o /dev/null -w '%{http_code}' --header 'Authorization: Bearer XXXXXXXX https://fd2e:6f44:5dd8:c956::14:10250/metrics\ncommand terminated with exit code 3\n\nerror:\nexit status 3",
        },
        Code: 3,
    }


Expected results:
Tests are passing in IPv6 configuration.

Additional info:

This is a bug in upstream.

Comment 1 Arda Guclu 2021-05-18 11:57:27 UTC
Upstream fix is https://github.com/kubernetes/kubernetes/pull/102089

Comment 2 Ryan Phillips 2021-05-20 22:03:39 UTC
PR is attached (lgtm)... Moving over to the auth team to review/approve the upstream patch and backport in.

Comment 9 errata-xmlrpc 2021-07-27 23:08:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.