Questo contenuto non è disponibile nella lingua selezionata.
Chapter 7. Known issues
If you create a site in an OpenShift Container Platform version 4.12 namespace, a message starting with the following warning is displayed:
W0320 15:27:27.446084 48301 warnings.go:70] would violate PodSecurity "restricted:v1.24"
You can ignore this message as it relates to a future restriction in OpenShift.
SKUPPER-2077 - Skupper Console Prometheus scrape configuration broken for openshift auth
If you configure a site to use OpenShift authenication for console access, metrics are not displayed in the console.
Workaround
If you require console metrics, use
internalauthenication for the site where the console is enablePd. Another option isunsecured, however if you use that option, the console is available to unauthenticated users.SKUPPER-869 - Enable idle connection timeouts for the TCP transport
If an endpoint is terminated, for example a client is killed, the other endpoint observes a half-closed connection. If the other endpoint does not close the connection or attempt to send data to the connection, the Skupper router does not release the memory allocated to that connection
Workaround
Avoid client server configurations that use this behavior if possible. For example, if a server automatically closes dormant connections, or attempts to communicate with client, the Skupper router frees the memory when a client is terminated.
SKUPPER-805 - skupper init doesn’t work for ordinary user on OCP 3.11
Workaround
Two workarounds are available:
- Use YAML to configure a site.
-
Create a service account with the following permissions to run the
skupperCLI:
--- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: skupper-non-admin rules: - apiGroups: - "" resources: - configmaps - pods - pods/exec - services - secrets - serviceaccounts verbs: - get - list - watch - create - update - delete - apiGroups: - apps resources: - deployments - statefulsets - daemonsets verbs: - get - list - watch - create - update - delete - apiGroups: - route.openshift.io resources: - routes verbs: - get - list - watch - create - delete - apiGroups: - networking.k8s.io resources: - ingresses - networkpolicies verbs: - get - list - watch - create - delete - apiGroups: - projectcontour.io resources: - httpproxies verbs: - get - list - watch - create - delete - apiGroups: - rbac.authorization.k8s.io resources: - rolebindings - roles verbs: - get - list - watch - create - delete
You can save the YAML above to
role.yaml, apply it and bind the role to a username using:$ oc apply -f role.yaml $ oc policy add-role-to-user skupper-non-admin <username> -n <namespace-name> --role-namespace=<namespace-name>
