-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
'docker push' w/ docker-registry on reencrypt route with SSL certs fails with "unauthorized: authentication required" #14249
Labels
Comments
Does this has a workaround now? |
Bizarre thing is that some of the layers managed to land in the filesystem:
and docker cli:
Logs:
|
Resolved in 3.7 via #15694. See bz#1471707 for more details. If you need it in earlier release, please clone the bugzilla with a desired target release. |
rlaurika
added a commit
to CSCfi/pouta-openshift-cluster
that referenced
this issue
Oct 30, 2017
The registry is by default deployed using a certificate signed by the OpenShift CA. As this is not generally recognized, create a new re-encrypting edge route to the registry that uses a proper certificate. This way it is possible to login to the registry normally. Using the re-encrypting route triggers a bug in the Docker registry that is fixed in a newer version. To work around this bug, manually update the Docker image used for the registry to a newer one. See: openshift/origin#14249 and also openshift/origin#11391. The registry console also needs to be reconfigured with the new route to the registry. Make this configuration change using the oc_env module from openshift-ansible. For this to work, add modules from the lib_openshift role into the library path. Replace the certificate of the registry console with a proper recognized certificate so that warnings are not shown when accessing the console from a browser. Write tests for checking correct connectivity to the routes used for the registry and the registry console. These should verify that there are no certificate issues with the endpoints.
rlaurika
added a commit
to CSCfi/pouta-openshift-cluster
that referenced
this issue
Oct 30, 2017
The registry is by default deployed using a certificate signed by the OpenShift CA. As this is not generally recognized, create a new re-encrypting edge route to the registry that uses a proper certificate. This way it is possible to login to the registry normally. Using the re-encrypting route triggers a bug in the Docker registry that is fixed in a newer version. To work around this bug, manually update the Docker image used for the registry to a newer one. See: openshift/origin#14249 and also openshift/origin#11391. The registry console also needs to be reconfigured with the new route to the registry. Make this configuration change using the oc_env module from openshift-ansible. For this to work, add modules from the lib_openshift role into the library path. Replace the certificate of the registry console with a proper recognized certificate so that warnings are not shown when accessing the console from a browser. Write tests for checking correct connectivity to the routes used for the registry and the registry console. These should verify that there are no certificate issues with the endpoints. Split the registry config changes into their own playbook from the post-install playbook to keep things tidy.
rdoproject
pushed a commit
to rdo-infra/rdo-container-registry
that referenced
this issue
Nov 6, 2017
This commits allows to deploy the RDO registry with OpenShift 3.7. It currently uses the "rdo-test" branch because there is still one unmerged pull request upstream that hasn't merged yet upstream. Delta from OpenShift 3.5 that is interesting to us: - Significant improvements for registry and image pruning see [1][2][3][4] - docker-registry can now use reencrypt routes [5] - Metrics and logging were deployed by default in 3.5, this is no longer the case in 3.7, avoiding an unnecessary impact on performance. [6] - We're now deploying a persistent volume for the docker-registry service on the local filesystem. [1]: openshift/origin#13671 [2]: openshift/origin#16717 [3]: openshift/origin#16656 [4]: openshift/origin#17020 [5]: openshift/origin#14249 [6]: openshift/openshift-ansible@660bafe Change-Id: I5c364a1aab883b6af061051bf190ce857bf2e1f9
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
In summary, a docker-registry service on a reencrypt route (with proper certificates) and self-signed certificates mounted in /etc/secrets will let you login successfully but pushes will fail with a client-side error:
unauthorized: authentication required
Switching the route to passthrough and re-mounting /etc/secrets with the proper certificates lets you both log in and push.
Reproducible every time when deploying origin 1.5 with openshift-ansible on CentOS mostly following instructions provided for standalone registry setup.
Version
Steps To Reproduce
Create proper certificates
Configure openshift-ansible to set up route host, termination and ssl certs, for example:
Run openshift-ansible to set up a standalone registry+console as per documentation
Create user and project
Retrieve user token and login successfully
Push fails with:
Current Result
Login works but push fails
Expected Result
Login and push both work
Additional Information
Here's a side-by-side diff of route/svc/pod export as well as master-config.yml for the exact same deployment configuration except one is passthrough (left), the other is reencrypt (right):
https://www.diffchecker.com/wzWtOFmJ
Here's the docker-registry logs on a successful docker login:
Here's the docker-registry logs on a failed docker push:
The text was updated successfully, but these errors were encountered: