https communication

[tomassatka]

Hi Team

I have a question regarding setting up the https.
Basically following https://www.apicur.io/registry/docs/apicurio-registry-operator/1.0.0/assembly-registry-maintenance.html#registry-https-in-cluster and https://www.apicur.io/registry/docs/apicurio-registry-operator/1.0.0/assembly-registry-maintenance.html#registry-https-outside-cluster.

The version that i use is apicurio/apicurio-registry-kafkasql:2.0.1.Final

When i install this app into openshift 3.11 in our enterprise and follow the guidance mentioned above i create route api object as following:

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  annotations:
    openshift.io/host.generated: 'true'
  name: apicurio-registry-tls
spec:
  host: apicurio-registry-tls-foo-bar.net
  port:
    targetPort: http
  tls:
    insecureEdgeTerminationPolicy: Redirect
    termination: edge
  to:
    kind: Service
    name: apicurio-registry-apicurio-registry
    weight: 100
  wildcardPolicy: None

now this is working just fine. I can reach the UI. Now i tried to install it also to AKS on azure in enterprise subnet.

The ingress looks following:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    kubernetes.io/ingress.class: azure/application-gateway
  name: apicurio-registry
spec:
  rules:
  - host: apicurio-registry.d.foo-bar.net
    http:
      paths:
      - backend:
          service:
            name: apicurio-registry-apicurio-registry
            port:
              name: http
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - apicurio-registry.d.foo-bar.net
    secretName: agic-tls

Now the issue that i noticed is that since only https 443 port is open by enterprise firewall the UI in AKS is not working.

When i analyzed the connection to AKS i see the switch from 443 to 80 and that gets blocked:

C:\Develop\intelliJ\bin>curl -vvv --insecure -L https://apicurio-registry.d.foo-bar.net/ui
*   Trying xxxxx:443...
* Connected to apicurio-registry.d.foo-bar.net (xxxxx) port 443 (#0)
* schannel: disabled automatic use of client certificate
* ALPN: offers http/1.1
* ALPN: server accepted http/1.1
> GET /ui HTTP/1.1
> Host: apicurio-registry.d.foo-bar.net
> User-Agent: curl/7.83.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Date: Tue, 16 Aug 2022 10:05:22 GMT
< Content-Length: 0
< Connection: keep-alive
< Location: http://apicurio-registry.d.foo-bar.net/ui/
<
* Connection #0 to host apicurio-registry.d.foo-bar.net left intact
* Clear auth, redirects to port from 443 to 80
* Issue another request to this URL: 'http://apicurio-registry.d.foo-bar.net/ui/'
*   Trying xxxxx:80...
* connect to xxxxx port 80 failed: Connection refused
* Failed to connect to apicurio-registry.d.foo-bar.net port 80 after 7063 ms: Connection refused
* Closing connection 1
curl: (7) Failed to connect to apicurio-registry.d.foo-bar.net port 80 after 7063 ms: Connection refused

on Openshift 3.11 where http is enabled i can see that it gets from https to http and then the route switch back to https by rule.

C:\Users\tk9at>curl --insecure -vvv -L https://apicurio-registry-tls-foo-bar.net/ui
*   Trying xxxxx:443...
* Connected to apicurio-registry-tls-foo-bar.net (10.22.189.251) port 443 (#0)
* schannel: disabled automatic use of client certificate
* ALPN: offers http/1.1
* ALPN: server did not agree on a protocol. Uses default.
> GET /ui HTTP/1.1
> Host: apicurio-registry-tls-foo-bar.net
> User-Agent: curl/7.83.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Location: http://apicurio-registry-tls-foo-bar.net/ui/
< Content-Length: 0
< Set-Cookie: 7ca504b12d2ffff4640288bb61c6d948=0b01752b5ac10d0d3198a72dd03c2f9e; path=/; HttpOnly; Secure
<
* Connection #0 to host apicurio-registry-tls-foo-bar.net left intact
* Clear auth, redirects to port from 443 to 80
* Issue another request to this URL: 'http://apicurio-registry-tls-foo-bar.net/ui/'
*   Trying xxxx:80...
* Connected to apicurio-registry-tls-foo-bar.net (xxxxx) port 80 (#1)
> GET /ui/ HTTP/1.1
> Host: apicurio-registry-tls-foo-bar.net
> User-Agent: curl/7.83.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Cache-Control: no-cache
< Content-length: 0
< Location: https://apicurio-registry-tls-foo-bar.net/ui/
<
* Connection #1 to host apicurio-registry-tls-foo-bar.net left intact
* Clear auth, redirects to port from 80 to 443
* Issue another request to this URL: 'https://apicurio-registry-tls-foo-bar.net/ui/'
* Found bundle for host: 0x2512972c6b0 [serially]
* Re-using existing connection #0 with host apicurio-registry-tls-foo-bar.net
* Connected to apicurio-registry-tls-foo-bar.net (xxxxx) port 443 (#0)
> GET /ui/ HTTP/1.1
> Host: apicurio-registry-tls-foo-bar.net
> User-Agent: curl/7.83.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Tue, 16 Aug 2022 13:08:09 GMT
< Expires: Mon, 15 Aug 2022 13:08:09 GMT
< Pragma: no-cache
< Cache-control: no-cache, no-store, must-revalidate
< Content-Type: text/html
< Last-Modified: Wed, 30 Jun 2021 10:43:31 GMT
< Accept-Ranges: bytes
< Content-Length: 828
< Set-Cookie: 7ca504b12d2ffff4640288bb61c6d948=0b01752b5ac10d0d3198a72dd03c2f9e; path=/; HttpOnly; Secure
<
<!DOCTYPE html>
<html lang="en-US">

<head>
  <meta charset="utf-8">
  <title>Apicurio Registry</title>
  <base href="/ui/">

  <meta id="appName" name="application-name" content="Apicurio Registry">
  <link rel="icon" type="image/png" href="favicon.ico">

  <script type="text/javascript" src="version.js"></script>
  <script type="text/javascript" src="config.js"></script>
<link href="2.css" rel="stylesheet"><link href="0.css" rel="stylesheet"></head>

<body>
  <noscript>Enabling JavaScript is required to run this app.</noscript>
  <div id="root"></div>
<script type="text/javascript" src="runtime.bundle.d943a51f72c6a4214716.js"></script><script type="text/javascript" src="vendors.bundle.6d2827a430030ba927f6.js"></script><script type="text/javascript" src="app.bundle.10027cb6dacb97fde7d0.js"></script></body>

</html>
* Connection #0 to host apicurio-registry-tls-foo-bar.net left intact

Now comes my question. Could it be set up to only use https for every subrequest? Enabling http on firewall wont get accepted so the route/ingress rules come too late. Or did i understand the routing of the app wrong? My goal is simply to use only https that is allowed. Is that possible?

thx
tomas

[EricWittmann]

One quick observation is that you're using a rather old version of Apicurio Registry. I would definitely suggest deploying 2.2.5.Final if you can.

@andreaTP or @jsenko or @riprasad any insight into the deployment and SSL?

[andreaTP]

I'm not sure I completely understand this question:

My goal is simply to use only https that is allowed

If your goal is to Deploy Apicurio Registry with https enabled you need to configure your Route as a passthrough, here you have the relevant documentation:
https://docs.openshift.com/container-platform/4.8/networking/routes/secured-routes.html

[tomassatka]

Hi @andreaTP

The version of apicurio that i use was redirecting for subpages to http and then route suppose to switch the protocol.

Basically hitting / on https will trigger redirect on apicurio to /ui on http and route receiving http request shall switch to https again as if apicurio was not aware that the request to it came from https protocol.
https://www.apicur.io/registry/docs/apicurio-registry-operator/1.0.0/assembly-registry-maintenance.html#registry-https-outside-cluster

That was achieved by using insecureEdgeTerminationPolicy: Redirect

Thats what i can see in documentation.

Our fw will block http so the subrequests will not get to route so it wont work. Does newer version of apicurio stay on https so redirects are to the same protocol as the source?

[EricWittmann]

Ah this is the old Quarkus redirect issue. Here is a github issue that might help:

#1959

Again, you'll likely need to upgrade to a more recent version of Registry for the information in that issue to be helpful.