console
console copied to clipboard
openshift
CONSOLE-3241: Use cluster proxy for managed cluster API server requests
Update server to remove original multicluster proxying implementation and instead proxy managed cluster requests to the MCE cluster proxy service
QE Approver /assign @yapei
Docs Approver: /assign @opayne1
PX Approver: /assign @RickJWagner
/retest
Panic in openshift operator controller manager pod. Reported in Slack.
@TheRealJon wheh navigating through manged cluster pages, it seems managed cluster pages can not be loaded successfully and I can see some errors in console log
I0920 10:01:32.237240 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/uscluster/apis/project.openshift.io/v1/projects`
I0920 10:01:32.500360 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/uscluster/apis/apps/v1/namespaces/openshift-console/deployments`
I0920 10:01:32.503337 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/uscluster/apis/authorization.k8s.io/v1/selfsubjectaccessreviews`
2022/09/20 10:01:34 http: proxy error: context canceled
I0920 10:03:03.027486 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/uscluster/apis/apps/v1/namespaces/openshift-console/deployments`
2022/09/20 10:03:03 http: proxy error: context canceled
I0920 10:03:03.529456 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/uscluster/apis/project.openshift.io/v1/projects`
2022/09/20 10:03:03 http: proxy error: context canceled
@yapei This is likely because your managed cluster has not been imported through ACM or the cluster name in ACM is different from the cluster name in the managed cluster config consumed by the console back end. So, in order for multicluster to work when running bridge locally, you'll have to follow these steps:
- Provision or use existing cluster with ACM installed
- Provision or use an existing second cluster as the managed cluster
- Follow the instructions in the
contrib/multicluster-environment.shscript to init your local multicluster environment variables - Import the managed cluster to the ACM cluster, using the same cluster name found in the BRIDGE_MANAGED_CLUSTERS env var
- Set
BRIDGE_K8S_MODE_OFF_CLUSTER_MANAGED_CLUSTER_PROXYenv var to the public cluster proxy route (on ACM clusteroc get route cluster-proxy-addon-user -n multicluster-engine) - Build the backend with the changes in this PR and run bridge
You should then be able to visit localhost:9000 authenticate as kubeadmin on the hub cluster, use the cluster dropdown to select the managed cluster, authenticate again with the kubeadmin creds for that cluster, then test to make sure requests are being proxied appropriately. I was able to follow these steps myself and get this working. I did run into the exact issue above before realizing that I had not imported the managed cluster through ACM.
tested again today
- Enable multi cluster on Hub cluster
- Import one managed cluster with name 'test-cluster-one'
- Visit 'test-cluster-one' from All Clusters dropdown, check console pod logs and we can see that console backend makes managed cluster API server requests through the cluster proxy that the MCE operator provides
I0921 13:34:38.657877 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/test-cluster-one/apis/project.openshift.io/v1/projects/yapei-test-one-project`
I0921 13:34:39.231052 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/test-cluster-one/api/v1/namespaces/yapei-test-one-project/resourcequotas`
I0921 13:34:39.569416 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/test-cluster-one/apis/quota.openshift.io/v1/namespaces/yapei-test-one-project/appliedclusterresourcequotas`
I0921 13:34:39.573411 1 proxy.go:105] PROXY: `https://cluster-proxy-addon-user.multicluster-engine.svc:9092/test-cluster-one/apis/apps/v1/namespaces/yapei-test-one-project/deployments`
/label qe-approved
/retest-required
Remaining retests: 0 against base HEAD 98523601dd716b8b479e3b0112eaaeda83bf39ee and 2 for PR HEAD f24e592e1b067666f94b5fe2ccdb2f3316fbbceb in total
/retest-required
Remaining retests: 0 against base HEAD 0780f4cd7b3c60c052c3764fe15a25b1b884b6e8 and 1 for PR HEAD f24e592e1b067666f94b5fe2ccdb2f3316fbbceb in total
/retest-required
Remaining retests: 0 against base HEAD 3ebee34394e1a1498dd9f6e090c29b8af11e8028 and 2 for PR HEAD 4fa255cbf1ab8683dc235d5d4307165421bf42a8 in total
/retest-required
Remaining retests: 0 against base HEAD 887b2fccaa5e9ce15be9b6fc6f1ab67586cf4d88 and 1 for PR HEAD 4fa255cbf1ab8683dc235d5d4307165421bf42a8 in total
/retest-required
Remaining retests: 0 against base HEAD 747b86657bda31424a6c2fde82ee8a25e569bbbc and 0 for PR HEAD 4fa255cbf1ab8683dc235d5d4307165421bf42a8 in total
/hold
Revision 4fa255cbf1ab8683dc235d5d4307165421bf42a8 was retested 3 times: holding
/retest-required
Remaining retests: 0 against base HEAD 5ba18580676a25e4304df78253aad6a9832d4d56 and 2 for PR HEAD 4fa255cbf1ab8683dc235d5d4307165421bf42a8 in total