Known issues¶
This section describes the MSR known issues with available workarounds, along with a list of current product limitations.
Note
When malware is present in customer images, malware scanners operating on MSR Nodes at runtime can wrongly report MSR as a bad actor. If your malware scanner detects any issue in a running instance of MSR, refer to Vulnerability scanning.
Known issues with workaround solutions¶
[ENGDTR-2906] Initialization failure¶
initialization fails when the RethinkDB cluster has an even number of servers.
The workaround is to set the Helm chart value
rethinkdb.cluster.replicaCount
to an odd number.
Permissions tab lists only 10 repositories¶
Important
Erroneously reported as a known issue, the Permissions tab bug was resolved prior to the initial MSR 3.0 release.
The Permissions tab for team pages in the MSR web UI does not list more than 10 repositories.
Workaround:
You can access the full list of repositories for the team through the API:
GET /api/v0/accounts/{orgname}/teams/{teamname}/repositoryAccess
Using this command, you can rotate the certificates that provide intra-cluster communication between the MSR system containers and RethinkDB.
Teams page lists only 10 repositories¶
Important
Erroneously reported as a known issue, the team page bug was resolved prior to the initial MSR 3.0 release.
When you want to add repository permission to a team by clicking the
Add Repository Permissions on the team page, for example,
https://<msr-host>/orgs/<orgname>/teams/<teamname>/permissions/new
,
the Organization Repository dropdown does not list more than 10
repositories.
As a workaround, use the API to add team permissions to the repository:
PUT /api/v0/repositories/{namespace}/{reponame}/teamAccess/{teamname})
Nonfunctional /ca endpoint¶
The /ca
endpoint is not functional in the 3.0.0 release and will be
re-enabled in MSR 3.0.1.
Workaround:
To obtain the MSR CA certificate, run:
kubectl get secret msr-nginx-ca-cert \
-o go-template='{{ index .data "ca.crt" | base64decode }}'
eNZi configuration changes require manual intervention¶
Changes to eNZi configuration are not live-reloaded.
As a workaround, restart the *-api
, *-enzi-api
, *-garant
, and
*-registry
Pods every time you change your eNZi registration using
the administrative commands.
Product limitations¶
Integration with MKE authentication is not yet supported.
Existing MSR 2.x installations cannot currently be upgraded to MSR 3.0.0.
Client-certificate authentication for MSR users is not currently available.
MSR operators cannot currently specify passwords for the MSR administrators, and the Helm chart configures MSR with a static default password at install.