Load system cert pool for image push to accommodate direct cloud storage access#3067
Conversation
There is an issue where after some period of time,(usually around 20 minutes of the cluster being up) the requests to images start getting forwarded directly to the cloud storage buckets wherethey reside. Those endpoints present certificates that are signed by the cloud provider (e.g. amazon,google,microsoft,etc) and not by our cluster certificates. We did not previously load the system cert pool, so those requests would fail. This makes sure we also load our system cert pool so we can verify those certificates and don't fail with x509 errors when we attempt to communicate with the registry.
|
/lgtm |
|
Excellent commit message! |
|
Just to make sure, this only affects master branch? (Since whatever changed presumably only in 4.11) |
|
Ah oops this is against layering |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jkyros, mkenigs, yuqi-zhang The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/retest-required |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
1 similar comment
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
6 similar comments
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
@jkyros: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
6 participants
Something changed in openshift last week to where after about 20 minutes or so of the cluster being up, requests to/for images start getting forwarded directly to the cloud storage endpoint (signed by aws/google/whoever) intead of being proxied by the cluster (endpoint signed by our cluster signer).
This should have been fine, and probably was fine everywhere else, except for our hacky scratch image push, where we weren't loading the
SystemCertPool, which meant we couldn't verify those cloud provider certificates.We only loaded one of our cluster signer certificates because we didn't know we would ever be talking to the clouds directly (and, well, we weren't until other non-MCO changes last week).
This loads the
SystemCertPoolso we can verify those cloud certificates instead of failing with x509 errors.