juice-shop/multi-juicer

Openshift instance issue

sashi-u opened this issue · 20 comments

sashi-u commented

Hi Team,

I have deployed the application in our Enterprise Openshift and I am able to login as admin also. but when I am trying to create a new team, I get "Internal Server Error". I have already tried reproduce the issue by deploying it in different public cloud environments, everywhere the issue is same. Kindly help.

Also it looks like, the repo - https://iteratec.github.io/multi-juicer/ doesn't exist, please check.

Regards,
Sashi
image

J12934 commented

Hi 👋
Can you take a look at the failing request in the browsers network tab and also take a look at the logs of the juice-balancer pod, which is likely the causes of the error. Would also help if you can post both the OpenShift and the underlying kubernetes version.

https://iteratec.github.io/multi-juicer/ is actually working correctly, it's just not a real website, but only a helm repository from which helm downloads the charts. See https://iteratec.github.io/multi-juicer/index.yaml for the repository definition 😀

sashibhusan-u commented

Hi,
Thanks a lot for your prompt response, I need your further cooperation in this regard.
After your response, the helm repo works now, till yesterday it was saying 'repo not valid'.

Following are the details you requested for:

Openshift version -
OpenShift Master: v3.11.188
Kubernetes Master: v1.11.0+d4cacc0
OpenShift Web Console: v3.11.135

Pod log -
1

Browser log -
2

J12934 commented

Ah ok, i've actaully seen this before. I think this is happening because of the pretty old kubernetes version not handling ownerReferences like the newer versions. We added the owner references so that the Juice Shop get automatically deleted when you uninstall MultiJuicer.

I'll try to add a config value so that you can skip these references, which should make it work.

J12934 commented

I've added this option.
Its not released yet, it would be great if you could confirm if this fixes your issues before it publish a release.

You can install the fix by installing MultiJuicer like the following:

# Clone the repo
git clone git@github.com:iteratec/multi-juicer.git

helm install multi-juicer ./helm/multi-juicer/ --set="balancer.skipOwnerReference=true" --set="balancer.tag=skipOwnerReference"
sashibhusan-u commented

I reinstalled the instance with the above command-line options and it seems to have worked. I am able to create teams and login to the team instance(s). Thank you so much for your support. Could you also briefly explain(or share some url) about the functionality of the progress-watchdog ?

J12934 commented

The ProgressWatchdog is basically responsible for the backup and auto apply challenge progress in case of Juice Shop container restarts feature. Its backs up the continue code as an annotation on the Deployment of the Juice Shop instance.

J12934 commented

I've released the option with Release v3.3.0.

Will close the issue now. But if you have more questions feel free to ask them here or the OWASP Slack 🙏

sashibhusan-u commented

When I install v3.4 without the commandline options, it doesn't work, I get the same issue. However it works when I install with the commandline options. I thought the issue was addressed with some permanent config fix, but it seems every time we need to redeploy this way. Is this understanding correct ?

J12934 commented

@sashibhusan-u yeah you will have to pass this option every time when using older kubernetes versions.

MultiJuicer should work on newer kubernetes versions without the option. I'm not really sure which kubernetes version is fixing this, but 1.15 and later should definitely work.

sashibhusan-u commented
J12934 commented

Hi again @sashibhusan-u 👋

Can you take a look at the Juice Shop Deployment and its logs for the team kn01?
Might be a problem with the juice shop configuration that is preventing the pod from starting up. Or something wrong with the cluster.

sashibhusan-u commented
J12934 commented

Mh might be another OpenShift permission issue with JuiceShop, thats kinda weird I dont think this has changed recently...
What Juice Shop version are you using? @sashibhusan-u

sashibhusan-u commented
  • 👍1
J12934 commented

Okay this looks like a general Juice Shop on OpenShift Issue, I'm getting the same error on our OpenShift cluster 😟
Will try to look into this this evening and fix it in Juice Shop.

J12934 commented

@sashibhusan-u I tried it again using bkimminich/juice-shop:v11.1.3 as the version and this seems to be working on our OpenShift version. Would recommend to update to this version.

Thought I'm not really why this version bump fixes this, maybe this was fixed by the downgrade to Node.js from 14 to 12. @bkimminich any other ideas?

I'll update the default Juice Shop version in MultiJuicer to v11.1.3 to avoid this issue for other users.

bkimminich commented

This file copy error seems to be some race condition during server launch scripts, that was reported only occasionally by Linux users in the past. Can't imagine it has something to do with OpenShift in particular.

J12934 commented

Mh doesn't really look like a race condition to me.
I've tried this a couple of times and v11.1.0 is always failing, while v11.1.3 always works...

sashibhusan-u commented
  • 👍1
J12934 commented

Nice 👍
Will close the issue then again. Feel free to reopne if something else goes wrong.