Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-44233

Public HCP clusters do not work correctly with cluster-wide proxy set

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Major Major
    • None
    • 4.16, 4.17
    • HyperShift / ROSA
    • None
    • None
    • False
    • Hide

      None

      Show
      None

      Description of problem:

          Public HCP cluster using cluster wide proxy results in console pods unable to start, other systems do not work accurately (ingress controller operator in degraded state)

      Version-Release number of selected component (if applicable):

          4.16.X, 4.17.X

      How reproducible:

          Always

      Steps to Reproduce:

          1. Make a public HCP cluster with cluster-wide-proxy set
          2. Cluster console pods will not start with an error similar to:
      
      `failed to construct oauth endpoint cache`    

      Actual results:

          Cluster does not come up correctly

      Expected results:

          Cluster comes up correctly

      Additional info:

          
      • An HCP Cluster forces the $cluster_id.p3.openshiftapps.com to be added to the NOPROXY settings, which means that `api.$cluster_name.$cluster_id.p3.openshiftapps.com` will never correctly route through the proxy. This means that the console pods cannot communicate with api.$cluster_name.p3.openshiftapps.com and thus crash
      • The console seems to always use `api.$cluster_name.$cluster_id.p3.openshiftapps.com`, if it instead used `api.$cluster_name.hypershift.local` it's possible this would resolve the issue.
      • Communication that occurs via `api.$cluster_name.hypershift.local` (like that of the OVNKubernetes pods) continues to work correctly.

       
      Potential Fix: * Either route console traffic via the api.$cluster_name.hypershift.local service endpoint, or, allow an override for this to work with a proxy.

       
      Workarounds attempted: * Putting the cluster into private mode seems to allow this to work, but as soon as you move it back to public mode it will stop working again.

       

      Hypothesis: we have not yet experienced a customer who would like both a public HCP cluster that also wants a proxy, which may mean we haven't tested this combination.

              cewong@redhat.com Cesar Wong
              rh-ee-arepton Andy Repton
              Jie Zhao Jie Zhao
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: