Internal Encryption on/off requires activator restart
- Dominant language
- Go
- Stars
- 6.1k
- Forks
- 1.2k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 2
Description
Switching `internal-encryption` to true results in a non-functioning service.
/area networking
## What version of Knative?
1.9
Using Kourier
## Expected Behavior
Service should continue to serve ingress traffic.
## Actual Behavior
Service stopped serving ingress traffic.
Clients receive 503
## Steps to Reproduce the Problem
---- Attempt 1:
```sh
kn quickstart kind --install-serving
...
```
Use `kubectl edit cm config-network -n knative-serving` and set `internal-encryption` to "true"
```sh
kn service create hello --image gcr.io/knative-samples/helloworld-go --port 8080 --env TARGET=World
...
19.014s Ingress has not yet been reconciled.
19.101s Waiting for load balancer to be ready
...
```
----- Attempts 2:
```sh
kn quickstart kind --install-serving
...
kn service create hello --image gcr.io/knative-samples/helloworld-go --port 8080 --env TARGET=World
...
Service 'hello' created to latest revision 'hello-00001' is available at URL:
http://hello.default.127.0.0.1.sslip.io
curl http://hello.default.127.0.0.1.sslip.io -v
* Trying 127.0.0.1:80...
...
< HTTP/1.1 200 OK
...
Hello World!
...
```
Use `kubectl edit cm config-network -n knative-serving` and set `internal-encryption` to "true"
```
curl http://hello.default.127.0.0.1.sslip.io -v
...
< HTTP/1.1 503 Service Unavailable
< content-length: 145
< content-type: text/plain
< date: Mon, 27 Feb 2023 23:30:17 GMT
< server: envoy
<
* Connection #0 to host hello.default.127.0.0.1.sslip.io left intact
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: delayed connect error: 111
```
Contributor guide
Research direction
Reproduce with `kn quickstart kind --install-serving`, then edit the `config-network` ConfigMap as described and test the service with `curl`. Trace how the `internal-encryption` setting reaches the Kourier ingress components; done means enabling it does not require an activator restart and ingress continues returning the service response instead of 503.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100