Repository: openshift/openshift-ansible

Issue:
During upgrade registry is made secure but only serving HTTP
This is my rough summarization of a users@lists.openshift.com posting. This may be fixed by now, this is an older version. @gravis can fill in more info
##### Version

openshift-ansible-3.3.22
##### Steps To Reproduce
1. Install 1.2 w/o registry console and secured registry
2. Upgrade to 1.3 using openshift-ansible-3.3.22
##### Current Result

Registry is considered secure but serving HTTP only. Builds, pushes, and pulls fail.
##### Expected Result

Registry is secured and serving HTTPS. Builds, pushes, and pulls work.
##### Additional Information

https://github.com/openshift/origin/issues/11164 maybe related



Discussion:
@gravis can you please fill in any additional details

Thanks a lot @sdodson for taking the time to fill this issue.

Actually, the steps are wrong:
1. Install 1.2 w/o registry console and **IN**secured registry

That's the problem I guess, Ansible thinks the registry IS secured, but it's not.
It was installed / setup by ansible when we created the cluster, and the registry is still not secured today:

```
-bash-4.2# curl -XGET http://172.30.201.95:5000/v2/
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}
```

Maybe we missed something in the playbook?

Thanks

ho "w/o", sorry, was reading too quick

I was able to reproduce this but I'm pretty confused as to what is happening. So, I created a 1.2 cluster using the `release-1.2` branch and then I upgraded to 1.3 with the `openshift-ansible-3.3.22-1` tag and my builds were unable to push to the registry with the error `http: server gave HTTP response to HTTPS client`. No changes were made to the registry DC during upgrade aside from changing the image version so we still have an insecure registry.

I then edited `/etc/sysconfig/docker` to add my specific docker-registry service IP and port as an insecure registry alongside the already present CIDR config.

```
OPTIONS=' --selinux-enabled --insecure-registry=172.30.0.0/16 --insecure-registry=172.30.115.197:5000 --log-driver=json-file --log-opt max-size=50m'
```

After making that change builds/pushes were successful so I tried removing the IP:PORT config and leaving the CIDR config and I was still able to build/push to the registry.

```
OPTIONS=' --selinux-enabled --insecure-registry=172.30.0.0/16 --log-driver=json-file --log-opt max-size=50m'
```

of course adding `--insecure-registry=172.30.0.0/16` fixed the issue, but after a new ansible run, the `OPTIONS` is restored without this param, and builds / deploys / mostly everything will start to fall apart :(

Ah, okay maybe some wires are crossed with that parameter. I will investigate that.

Thanks :)

In the meantime, setting `openshift_docker_hosted_registry_insecure=True` should ensure that `--insecure-registry=172.30.0.0/16` stays in the config on new runs. We default this to false in newer versions since we secure the registry but it needs some more logic.

Bug on this https://bugzilla.redhat.com/show_bug.cgi?id=1388016


Resolving patch:
diff --git a/roles/openshift_facts/library/openshift_facts.py b/roles/openshift_facts/library/openshift_facts.py
--- a/roles/openshift_facts/library/openshift_facts.py
+++ b/roles/openshift_facts/library/openshift_facts.py
@@ -55,7 +55,6 @@ def migrate_docker_facts(facts):
                     facts['docker'][param] = facts[role].pop(old_param)
 
     if 'node' in facts and 'portal_net' in facts['node']:
-        facts['docker']['hosted_registry_insecure'] = True
         facts['docker']['hosted_registry_network'] = facts['node'].pop('portal_net')
 
     # log_options was originally meant to be a comma separated string, but
@@ -1138,6 +1137,24 @@ def get_docker_version_info():
             }
     return result
 
+def get_hosted_registry_insecure():
+    """ Parses OPTIONS from /etc/sysconfig/docker to determine if the
+        registry is currently insecure.
+    """
+    hosted_registry_insecure = None
+    if os.path.exists('/etc/sysconfig/docker'):
+        try:
+            ini_str = unicode('[root]\n' + open('/etc/sysconfig/docker', 'r').read(), 'utf-8')
+            ini_fp = io.StringIO(ini_str)
+            config = ConfigParser.RawConfigParser()
+            config.readfp(ini_fp)
+            options = config.get('root', 'OPTIONS')
+            if 'insecure-registry' in options:
+                hosted_registry_insecure = True
+        except:
+            pass
+    return hosted_registry_insecure
+
 def get_openshift_version(facts):
     """ Get current version of openshift on the host.
 
@@ -1790,13 +1807,15 @@ def get_defaults(self, roles, deployment_type, deployment_subtype):
 
         if 'docker' in roles:
             docker = dict(disable_push_dockerhub=False,
-                          hosted_registry_insecure=True,
                           options='--log-driver=json-file --log-opt max-size=50m')
             version_info = get_docker_version_info()
             if version_info is not None:
                 docker['api_version'] = version_info['api_version']
                 docker['version'] = version_info['version']
                 docker['gte_1_10'] = LooseVersion(version_info['version']) >= LooseVersion('1.10')
+            hosted_registry_insecure = get_hosted_registry_insecure()
+            if hosted_registry_insecure is not None:
+                docker['hosted_registry_insecure'] = hosted_registry_insecure
             defaults['docker'] = docker
 
         if 'clock' in roles:


Test patch: