knative / knative/serving

Internal Encryption on/off requires activator restart

Open
#13,754 6 comments 0 reactions 0 assignees View on GitHub
area/networking kind/bug triage/accepted
Dominant language
Go
Stars
6.1k
Forks
1.2k
Avg merge
2d 7h
Merged PRs (30d)
2

Description

Switching `internal-encryption` to true results in a non-functioning service.
/area networking

## What version of Knative?
1.9
Using Kourier

## Expected Behavior

Service should continue to serve ingress traffic.

## Actual Behavior

Service stopped serving ingress traffic.
Clients receive 503

## Steps to Reproduce the Problem
---- Attempt 1:
```sh
kn quickstart kind --install-serving
...
```

Use `kubectl edit cm config-network -n knative-serving` and set `internal-encryption` to "true"

```sh
kn service create hello --image gcr.io/knative-samples/helloworld-go --port 8080 --env TARGET=World
...
19.014s Ingress has not yet been reconciled.
19.101s Waiting for load balancer to be ready
...
```
----- Attempts 2:
```sh
kn quickstart kind --install-serving
...

kn service create hello --image gcr.io/knative-samples/helloworld-go --port 8080 --env TARGET=World
...
Service 'hello' created to latest revision 'hello-00001' is available at URL:
http://hello.default.127.0.0.1.sslip.io

curl http://hello.default.127.0.0.1.sslip.io -v
* Trying 127.0.0.1:80...
...
< HTTP/1.1 200 OK
...
Hello World!
...
```

Use `kubectl edit cm config-network -n knative-serving` and set `internal-encryption` to "true"

```
curl http://hello.default.127.0.0.1.sslip.io -v
...
< HTTP/1.1 503 Service Unavailable
< content-length: 145
< content-type: text/plain
< date: Mon, 27 Feb 2023 23:30:17 GMT
< server: envoy
<
* Connection #0 to host hello.default.127.0.0.1.sslip.io left intact
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: delayed connect error: 111
```

Contributor guide

Open the contributing guide

Research direction

Reproduce with `kn quickstart kind --install-serving`, then edit the `config-network` ConfigMap as described and test the service with `curl`. Trace how the `internal-encryption` setting reaches the Kourier ingress components; done means enabling it does not require an activator restart and ingress continues returning the service response instead of 503.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.