Bug 1977657 - Accessing web console from "forklift-ui" route causes a loop with certificate error messages
Summary: Accessing web console from "forklift-ui" route causes a loop with certificate...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Migration Toolkit for Virtualization
Classification: Red Hat
Component: User Experience
Version: 2.0.0
Hardware: All
OS: Linux
urgent
high
Target Milestone: ---
: 2.1.0
Assignee: Fabien Dupont
QA Contact: Ilanit Stein
Avital Pinnick
URL:
Whiteboard:
Depends On:
Blocks: 1986314
TreeView+ depends on / blocked
 
Reported: 2021-06-30 08:43 UTC by August Simonelli
Modified: 2021-08-26 07:09 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-08-26 07:09:10 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github konveyor forklift-operator pull 131 0 None open Bug 1977657 - Use ca.crt instead of service-ca.crt for UI 2021-07-02 15:52:47 UTC
Github konveyor forklift-operator pull 132 0 None open Bug 1977657 - Set CA bundle to /opt/app-root/src/ca.crt 2021-07-02 16:52:28 UTC
Github konveyor forklift-operator pull 133 0 None open Bug 1977657: Set CA bundle to /opt/app-root/src/ca.crt 2021-07-02 18:03:19 UTC
Github konveyor forklift-ui pull 680 0 None open Bug 1977657 - Concatenate Service Signing CA to global CA bundle 2021-07-02 15:52:47 UTC
Github konveyor forklift-ui pull 681 0 None open Bug 1977657 - Put CA bundle in a writable folder 2021-07-02 16:52:28 UTC
Red Hat Product Errata RHEA-2021:3278 0 None None None 2021-08-26 07:09:18 UTC

Description August Simonelli 2021-06-30 08:43:21 UTC
Description of problem:

Install a SNO 4.8.0-rc.1 cluster and then install MTV 2.0.0. Install completes successfully with no errors. However clicking/opening the published route for the forklift-ui goes into a rewrite loop going through this URL:

..../handle-login?error=%7B%22message%22%3A%22request+to+https%3A%2F%2Fkubernetes.default.svc.cluster.local%2F.well-known%2Foauth-authorization-server+failed%2C+reason%3A+self+signed+certificate+in+certificate+chain%22%2C%22type%22%3A%22system%22%2C%22errno%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%2C%22code%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%7D

Version-Release number of selected component (if applicable):
2.0.0

How reproducible:
Deploy operator. Follow published route for forklift-ui:

https://virt-openshift-mtv.apps.august.example.redhat.com

this appears to go to

https://virt-openshift-mtv.apps.august.example.redhat.com/welcome

and then goes to

https://virt-openshift-mtv.apps.august.example.redhat.com/handle-login?error=%7B%22message%22%3A%22request+to+https%3A%2F%2Fkubernetes.default.svc.cluster.local%2F.well-known%2Foauth-authorization-server+failed%2C+reason%3A+self+signed+certificate+in+certificate+chain%22%2C%22type%22%3A%22system%22%2C%22errno%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%2C%22code%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%7D

And then back to /welcome and around in a loop.

The UI never opens.


Steps to Reproduce:
1. As above
2.
3.

Actual results:
As above

Expected results:
Forklift UI opens.

Additional info:

Comment 1 Fabien Dupont 2021-07-02 15:52:47 UTC
In OpenShift 4.8, the service-ca.crt file contains only one CA certificate, the one for Service Serving Certificates, and this breaks the ability for NodeJS to verify Kubernetes API certificate.
Previously, all the internal CA certificates were present in service-ca.crt. Now, they are only present in ca.crt.
The quickest fix is to add the Service Serving CA certificate to ca.crt and use ca.crt as the bundle NodeJS trusts.

Comment 2 Fabien Dupont 2021-07-05 19:47:36 UTC
Please verify with build 2.10-19 / iib:88267.

Comment 3 Mike Turley 2021-07-21 15:17:42 UTC
As part of verifying this, can you also please try this to make sure we won't get redirect loops on login errors anymore?

* Make sure you are NOT logged in.
* Go to https://virt-openshift-mtv.apps.august.example.redhat.com/handle-login?error=%7B%22message%22%3A%22request+to+https%3A%2F%2Fkubernetes.default.svc.cluster.local%2F.well-known%2Foauth-authorization-server+failed%2C+reason%3A+self+signed+certificate+in+certificate+chain%22%2C%22type%22%3A%22system%22%2C%22errno%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%2C%22code%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%7D
* Verify that you see an error message on the page and you are not redirected to the login page.

That redirect loop was fixed in https://github.com/konveyor/forklift-ui/pull/665 and should not be present in 2.1.0 even if we get these errors at login time.

Comment 4 August Simonelli 2021-07-22 02:59:47 UTC
(In reply to Mike Turley from comment #3)
> As part of verifying this, can you also please try this to make sure we
> won't get redirect loops on login errors anymore?
> 
> * Make sure you are NOT logged in.
> * Go to
> https://virt-openshift-mtv.apps.august.example.redhat.com/handle-
> login?error=%7B%22message%22%3A%22request+to+https%3A%2F%2Fkubernetes.
> default.svc.cluster.local%2F.well-known%2Foauth-authorization-
> server+failed%2C+reason%3A+self+signed+certificate+in+certificate+chain%22%2C
> %22type%22%3A%22system%22%2C%22errno%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%2C%
> 22code%22%3A%22SELF_SIGNED_CERT_IN_CHAIN%22%7D
> * Verify that you see an error message on the page and you are not
> redirected to the login page.
> 
> That redirect loop was fixed in
> https://github.com/konveyor/forklift-ui/pull/665 and should not be present
> in 2.1.0 even if we get these errors at login time.

Just tested on OCP 4.8.0-rc.3 with Konveyor 2.1.0 installed as per https://github.com/konveyor/forklift-operator/blob/main/README.md#installing-latest and it worked perfectly.
 
Next, went to the link above in a private browser (ie to ensure not logged in or aware) and it gave me the error:

Could not log in
request to https://kubernetes.default.svc.cluster.local/.well-known/oauth-authorization-server failed, reason: self signed certificate in certificate chain

Try Again

And did not redirect automatically.

Clicking *Try Again* brought me to the OCP oauth login page and I could authenticate properly.

So everything appears to be working with 2.1.0 

Very cool and thanks!

Comment 9 Ilanit Stein 2021-08-06 09:25:11 UTC
Moving to verified based on that QE has been testing recently OCP-4.8/CNV-4.8 with MTV-2.1.0-19 till MTV-2.1.0-40,
and the migration ui works fine on all those versions.

Comment 13 errata-xmlrpc 2021-08-26 07:09:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Migration Toolkit for Virtualization 2.1.0), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2021:3278


Note You need to log in before you can comment on or make changes to this bug.