Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: disable https and allow disabling ipv6 on eda-ui #136

Merged
merged 2 commits into from
Oct 16, 2023

Conversation

kurokobo
Copy link
Contributor

Closes #134, closes #135

In ansible/ansible-ui#927, EDA UI was changed to listen on both HTTP (80) and HTTPS (443), and to redirect HTTP to HTTPS. However, in typical deployment, SSL termination on K8s is processed not on application container but on Ingress/Route, and implementing HTTPS passthrough on Ingress/Route require additional configuration.

This PR adds configmap to allow customize default.conf for Nginx, and stop listening HTTPS in eda-ui container.

Changes:

  • Add configmap for default.conf.template for nginx and mount it on eda-ui
    • This file is based on eda.conf on ansible-ui repo that used as /etc/nginx/templates/default.conf.template to generate /etc/nginx/conf.d/default.conf on its startup
    • Use 8080 for HTTP, and remove SSL related configuration
  • Allow disabling IPv6 listener on eda-ui by spec.ipv6_disabled for EDA CR
    • As the same as AWX Operator

Tested:

  • Web UI can be accessed (/)
  • API docs can be accessed (/api/eda/v1/docs)
  • Project can be added
  • IPv6 listener is enabled by default
    $ kubectl -n eda exec -it deployment/eda-ui -- cat /etc/nginx/conf.d/default.conf
    server {
        listen 8080;
        listen [::]:8080;
    
        server_name _;
        server_tokens off;
    ...
  • With spec.ipv6_disabled: true, IPv6 listener is disabled
    $ kubectl -n eda exec -it deployment/eda-ui -- cat /etc/nginx/conf.d/default.conf
    server {
        listen 8080;
        
        server_name _;
        server_tokens off;
    ...

@kurokobo kurokobo changed the title Nginx feat: disable https and allow disabling ipv6 on eda-ui Oct 14, 2023
@rooftopcellist
Copy link
Member

I tested this out on my cluster and it works. Thank you @kurokobo for the fix!

Sorry for the wait, I was OOO, back now. I will rebase #137 so that we can truly support Edge and Passthrough termination.

@rooftopcellist rooftopcellist merged commit 7c1cb1b into ansible:main Oct 16, 2023
@kurokobo kurokobo deleted the nginx branch October 16, 2023 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants