mlbiam
commented
7 months ago Can you please post your Application yaml?
Open tmarback opened 7 months ago
mlbiam
commented
7 months ago Can you please post your Application yaml?
tmarback
commented
7 months ago Right here:
apiVersion: openunison.tremolo.io/v2
kind: Application
metadata:
name: longhorn-dashboard
namespace: openunison
spec:
azTimeoutMillis: 3000
isApp: true
urls:
- hosts:
- "<snip>"
filterChain:
- className: com.tremolosecurity.proxy.filters.XForward
params:
createHeaders: "true"
- className: com.tremolosecurity.proxy.filters.HideCookie
params: {}
uri: "/"
proxyTo: "http://longhorn-frontend.longhorn-system.svc:80${fullURI}"
authChain: longhorn-oidc
azRules:
- scope: filter
constraint: (groups=k8s-admins)
results:
azFail: default-login-failure
overrideHost: true
overrideReferer: true
proxyConfiguration:
connectionTimeoutMillis: 5000
requestTimeoutMillis: 5000
socketTimeoutMillis: 5000
cookieConfig:
sessionCookieName: tremolosession
domain: "<snip>"
secure: true
httpOnly: true
logoutURI: "/logout"
keyAlias: session-unisonWith the proxied service being Longhorn's UI.
Removing the XForward entry in url.filterChain made the websocket errors stop.
mlbiam
commented
7 months ago opened a bug in the core OpenUnison project. We'll get this fixed pretty quickly. I'd like to cut our next release some time in the next week so stay tuned.
mlbiam
commented
7 months ago So I can't reproduce the issue. in my testing environment the URL doesn't come through as wss:// but https://. However the fix for this particlar exception was pretty easy so can you try docker.io/tremolosecurity/betas:1.0.40?
It seems that the
XForwardfilter on the reverse proxy doesn't support WebSocket connections that use a URL with thewss://protocol.I have an application being reverse proxied through the Orchestra pod for authentication, and as per the sample in the documentation I had set it to include the XForward filter in the filter chain.
It worked mostly fine, but eventually I noticed some websocket errors on the console, and after looking through the stack I noticed errors in the orchestra logs:
From the error, it seems to boil down to the
URLclass not supportingwss://.Granted, I'm not sure if this scheme is very common at all, but it would be nice if it was supported. Given that this URL is only being used to populate the
X-Forwarded-Protoheader anyway, maybe theURIclass might work instead? If my memory serves, newer Java versions did deprecate creatingURLinstances directly and instead say to createURIs :)