Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-22487

certificate signed by unknown authority while uninstalling operators from console.

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Major Major
    • 4.16.0
    • 4.13
    • Management Console
    • None
    • No
    • False
    • Hide

      None

      Show
      None
    • Hide
      * Previously, the console backend was proxying operand list requests to the public API server endpoint, which caused CA certificate issues under some circumstances. With this update, the proxy configuration was updated to point to the internal API server endpoint which fixed this issue. (link:https://issues.redhat.com/browse/OCPBUGS-22487[*OCPBUGS-22487*])
      Show
      * Previously, the console backend was proxying operand list requests to the public API server endpoint, which caused CA certificate issues under some circumstances. With this update, the proxy configuration was updated to point to the internal API server endpoint which fixed this issue. (link: https://issues.redhat.com/browse/OCPBUGS-22487 [* OCPBUGS-22487 *])
    • Bug Fix
    • Done
    • Customer Escalated

      Description of problem:

      
      

      The customer has a custom apiserver certificate.

      This error can be found while trying to uninstall any operator by console:

      openshift-console/pods/console-56494b7977-d7r76/console/console/logs/current.log:

      2023-10-24T14:13:21.797447921+07:00 E1024 07:13:21.797400 1 operands_handler.go:67] Failed to get new client for listing operands: Get "https://api.<cluster>.<domain>:6443/api?timeout=32s": x509: certificate signed by unknown authority

      when trying the same request from the console pod we can see no issue.

      We see the root ca that signs apiserver certificate and this CA is trusted in the pod.

      It seems the code that provokes this issue is:

      https://github.com/openshift/console/blob/master/pkg/server/operands_handler.go#L62-L70

            rh-ee-jonjacks Jon Jackson
            rhn-support-gparente German Parente
            Yanping Zhang Yanping Zhang
            Votes:
            2 Vote for this issue
            Watchers:
            12 Start watching this issue

              Created:
              Updated:
              Resolved: