test issues on 3.6.x

[sjenning]

Identical test failures on 3 different PR for extended_conformance_gce

https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/15880/test_pull_request_origin_extended_conformance_gce/6457/

https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/15886/test_pull_request_origin_extended_conformance_gce/6436/

https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/15889/test_pull_request_origin_extended_conformance_gce/6397/

@joelsmith @derekwaynecarr

[builds][Conformance] oc new-app should succeed with a --name of 58 characters 41s
go run hack/e2e.go -v -test --test_args='--ginkgo.focus=\s\[builds\]\[Conformance\]\soc\snew\-app\sshould\ssucceed\swith\sa\s\-\-name\sof\s58\scharacters$'
/go/src/github.com/openshift/origin/_output/local/go/src/github.com/openshift/origin/test/extended/builds/new_app.go:54
Expected error:
    <*errors.errorString | 0xc4212e6370>: {
        s: "The build \"a234567890123456789012345678901234567890123456789012345678-1\" status is \"Failed\"",
    }
    The build "a234567890123456789012345678901234567890123456789012345678-1" status is "Failed"
not to have occurred
/go/src/github.com/openshift/origin/_output/local/go/src/github.com/openshift/origin/test/extended/builds/new_app.go:49

[builds][Conformance][valueFrom] process valueFrom in build strategy environment variables should successfully resolve valueFrom in s2i build environment variables 51s
go run hack/e2e.go -v -test --test_args='--ginkgo.focus=\s\[builds\]\[Conformance\]\[valueFrom\]\sprocess\svalueFrom\sin\sbuild\sstrategy\senvironment\svariables\sshould\ssuccessfully\sresolve\svalueFrom\sin\ss2i\sbuild\senvironment\svariables$'
/go/src/github.com/openshift/origin/_output/local/go/src/github.com/openshift/origin/test/extended/builds/valuefrom.go:71
Expected
    <bool>: false
to be true
/go/src/github.com/openshift/origin/_output/local/go/src/github.com/openshift/origin/test/extended/builds/valuefrom.go:60

[builds][pullsecret][Conformance] docker build using a pull secret Building from a template should create a docker build that pulls using a secret run it 24s
go run hack/e2e.go -v -test --test_args='--ginkgo.focus=\s\[builds\]\[pullsecret\]\[Conformance\]\sdocker\sbuild\susing\sa\spull\ssecret\sBuilding\sfrom\sa\stemplate\sshould\screate\sa\sdocker\sbuild\sthat\spulls\susing\sa\ssecret\srun\sit$'
/go/src/github.com/openshift/origin/_output/local/go/src/github.com/openshift/origin/test/extended/builds/docker_pullsecret.go:48
Expected
    <bool>: false
to be true
/go/src/github.com/openshift/origin/_output/local/go/src/github.com/openshift/origin/test/extended/builds/docker_pullsecret.go:41

[bparees]

all three of those tests failed due to failed builds and all the builds failed trying to push the output image to the internal registry:

2017-08-23T07:33:48.789229000Z Pushing image docker-registry.default.svc:5000/extended-test-new-app-gb0fp-f1351/a234567890123456789012345678901234567890123456789012345678:latest ...
2017-08-23T07:33:48.912637000Z Registry server Address: 
2017-08-23T07:33:48.913055000Z Registry server User Name: serviceaccount
2017-08-23T07:33:48.913266000Z Registry server Email: serviceaccount@example.org
2017-08-23T07:33:48.913468000Z Registry server Password: <<non-empty>>
2017-08-23T07:33:48.947990000Z error: build error: Failed to push image: Get https://docker-registry.default.svc:5000/v1/_ping: x509: certificate is valid for docker-registry-default.apps.prtest-5a37c28-6397.origin-ci-int-gce.dev.rhcloud.com, 172.30.111.161, not docker-registry.default.svc

@legionus can you take a look? But this seems like a security issue, so might come back to @sjenning and @deads2k ....

[legionus]

Failed to push image: Get https://docker-registry.default.svc:5000/v1/_ping: x509: certificate is valid for docker-registry-default.apps.prtest-5a37c28-6397.origin-ci-int-gce.dev.rhcloud.com, 172.30.111.161, not docker-registry.default.svc

@bparees The server has all reasons to complain :)
Someone added the wrong generated certificates for the tests ?

[bparees]

@legionus seems unlikely we'd be adding the wrong certs in a way that only flaked periodically, but it does look like services are being served using a cert that's intended for the routing domain, not the service.

@liggitt @deads2k any thoughts on this? specifically the fact that we're accessing docker-registry.svc.default and getting presented with a cert that's only valid for docker-registry-default.apps.prtest-5a37c28-6397.origin-ci-int-gce.dev.rhcloud.com ?

[bparees]

@liggitt @deads2k and possibly @knobunc see above question about mixed up certs please.

[deads2k]

@liggitt @deads2k any thoughts on this? specifically the fact that we're accessing docker-registry.svc.default and getting presented with a cert that's only valid for docker-registry-default.apps.prtest-5a37c28-6397.origin-ci-int-gce.dev.rhcloud.com ?

That message indicates that the client is requesting a particular DNS name, but that message does not indicate what IP was actually used to reach the docker registry. A blind guess would say that you ended up hitting an external, re-encrypt route's IP for the docker registry.