[BZ1810461] ShiftStack - Add procedure to allow Image Registry Operator to trust Swift#39641
Conversation
maxwelldb
added
the
do-not-merge/work-in-progress
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
✔️ Deploy Preview for osdocs ready! 🔨 Explore the source changes: fbc46fe 🔍 Inspect the deploy log: https://app.netlify.com/sites/osdocs/deploys/622250d04799be00087ca33b 😎 Browse the preview: https://deploy-preview-39641--osdocs.netlify.app |
openshift-ci
bot
added
the
size/M
There was a problem hiding this comment.
disableRedirect is in config.imageregistry, not image.config.
There was a problem hiding this comment.
According to https://bugzilla.redhat.com/show_bug.cgi?id=1810461#c13, the following should be all that is needed:
$ oc patch configs.imageregistry.operator.openshift.io cluster --type merge --patch '{"spec":{"disableRedirect":"true"}}'
There was a problem hiding this comment.
@mandre As in that command should be almost the entirety of this PR? Easy enough, if so.
Any thoughts on the second part of this comment? https://bugzilla.redhat.com/show_bug.cgi?id=1810461#c14
There was a problem hiding this comment.
@mandre As in that command should be almost the entirety of this PR? Easy enough, if so.
Any thoughts on the second part of this comment? https://bugzilla.redhat.com/show_bug.cgi?id=1810461#c14
If I understand comment 14 correctly what we're doing here (disable redirect) is what the customer has confirmed fixes the issue. I do not think we want to document the other suggested solution as it's a lot more complex and forces the nodes to trust the CA ultimately (while we trust it only when initiating connections to OpenStack otherwise).
maxwelldb
left a comment
maxwelldb
left a comment
There was a problem hiding this comment.
Made a few suggestions for syntax
There was a problem hiding this comment.
@mandre Could you confirm this command given this comment? https://github.com/openshift/openshift-docs/pull/39641/files#r765059344
There was a problem hiding this comment.
This is redundant with what you're doing on line 23.
maxwelldb
force-pushed
the
ocponosp-swift-self-cert-bz1810461
branch
2 times, most recently
from
577a4df to
450b525
Compare
maxwelldb
added
the
peer-review-needed
|
LGTM |
kalexand-rh
left a comment
kalexand-rh
left a comment
There was a problem hiding this comment.
This is looking good!
There was a problem hiding this comment.
Does this procedure have prereqs? It looks like there's nothing to change in the command itself, so I suspect there might be. You might want to add them at some point.
...configuring_registry_storage/configuring-registry-storage-openstack-user-infrastructure.adoc
Outdated
Show resolved
Hide resolved
kalexand-rh
added
peer-review-done
maxwelldb
force-pushed
the
ocponosp-swift-self-cert-bz1810461
branch
from
7a887e3 to
fbc46fe
Compare
|
/cherry-pick enterprise-4.10 |
|
@maxwelldb: new pull request created: #42840 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@xiuwang Can you confirm that this procedure is valid for 4.6-4.10? This PR has a 4.10 label on it, though I'm not sure if I made a mistake at some point. |
|
/cherry-pick enterprise-4.10 |
|
@maxwelldb: new pull request could not be created: failed to create pull request against openshift/openshift-docs#enterprise-4.10 from head openshift-cherrypick-robot:cherry-pick-39641-to-enterprise-4.10: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for openshift-cherrypick-robot:cherry-pick-39641-to-enterprise-4.10."}],"documentation_url":"https://docs.github.com/rest/reference/pulls#create-a-pull-request"} DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
7 participants
Re: self-signed certs
Context: https://bugzilla.redhat.com/show_bug.cgi?id=1810461
Preview: https://deploy-preview-39641--osdocs.netlify.app/openshift-enterprise/latest/registry/configuring_registry_storage/configuring-registry-storage-openstack-user-infrastructure.html