Known issues

This section describes the MSR known issues with available workarounds, along with a list of current product limitations.

Note

When malware is present in customer images, malware scanners operating on MSR Nodes at runtime can wrongly report MSR as a bad actor. If your malware scanner detects any issue in a running instance of MSR, refer to Vulnerability scanning.

Known issues with workaround solutions

[ENGDTR-2906] Initialization failure

initialization fails when the RethinkDB cluster has an even number of servers.

The workaround is to set the Helm chart value rethinkdb.cluster.replicaCount to an odd number.

Permissions tab lists only 10 repositories

Important

Erroneously reported as a known issue, the Permissions tab bug was resolved prior to the initial MSR 3.0 release.

The Permissions tab for team pages in the MSR web UI does not list more than 10 repositories.

Workaround:

You can access the full list of repositories for the team through the API:

GET /api/v0/accounts/{orgname}/teams/{teamname}/repositoryAccess

Using this command, you can rotate the certificates that provide intra-cluster communication between the MSR system containers and RethinkDB.

Teams page lists only 10 repositories

Important

Erroneously reported as a known issue, the team page bug was resolved prior to the initial MSR 3.0 release.

When you want to add repository permission to a team by clicking the Add Repository Permissions on the team page, for example, https://<msr-host>/orgs/<orgname>/teams/<teamname>/permissions/new, the Organization Repository dropdown does not list more than 10 repositories.

As a workaround, use the API to add team permissions to the repository:

PUT /api/v0/repositories/{namespace}/{reponame}/teamAccess/{teamname})

Nonfunctional /ca endpoint

The /ca endpoint is not functional in the 3.0.0 release and will be re-enabled in MSR 3.0.1.

Workaround:

To obtain the MSR CA certificate, run:

kubectl get secret msr-nginx-ca-cert \
-o go-template='{{ index .data "ca.crt" | base64decode }}'

eNZi configuration changes require manual intervention

Changes to eNZi configuration are not live-reloaded.

As a workaround, restart the *-api, *-enzi-api, *-garant, and *-registry Pods every time you change your eNZi registration using the administrative commands.

Product limitations

  • Integration with MKE authentication is not yet supported.

  • Existing MSR 2.x installations cannot currently be upgraded to MSR 3.0.0.

  • Client-certificate authentication for MSR users is not currently available.

  • MSR operators cannot currently specify passwords for the MSR administrators, and the Helm chart configures MSR with a static default password at install.