Problem
When deploying with exposure: none in the config, roxie fails during secured cluster deployment because it cannot reach Central to generate the CRS (cluster registration secret):
Error: deployment failed: failed to deploy secured cluster: failed to generate CRS: CRS generation failed after 5 attempts: executing HTTP request: Post "https://central.stackrox.svc:443/v1/cluster-init/crs": dial tcp: lookup central.stackrox.svc on 172.30.0.10:53: no such host
With exposure: none, no Central service is created, so the internal DNS name central.<namespace>.svc doesn't resolve.
Expected behavior
Roxie should still be able to deploy a secured cluster with exposure: none by using port-forwarding internally to reach the Central API for CRS generation, similar to how it handles the default (no exposure set) case.
Workaround
Don't set exposure: none — either omit the field (roxie defaults to port-forwarding) or use exposure: loadbalancer.
Context
Discovered while migrating the stackrox perf-scale CI step from helm-based to roxie-based installation in openshift/release#81322
Problem
When deploying with
exposure: nonein the config, roxie fails during secured cluster deployment because it cannot reach Central to generate the CRS (cluster registration secret):With
exposure: none, no Central service is created, so the internal DNS namecentral.<namespace>.svcdoesn't resolve.Expected behavior
Roxie should still be able to deploy a secured cluster with
exposure: noneby using port-forwarding internally to reach the Central API for CRS generation, similar to how it handles the default (no exposure set) case.Workaround
Don't set
exposure: none— either omit the field (roxie defaults to port-forwarding) or useexposure: loadbalancer.Context
Discovered while migrating the stackrox perf-scale CI step from helm-based to roxie-based installation in openshift/release#81322