fix: remove unreachable code in health checker#69
Merged
Conversation
…ster Backend: - Add multicluster.Manager: per-cluster discovery watchers with kubeconfig or apiServer/token/caBundle auth - Add configmgmt.Store: config push with JSON validation, version history, rollback, and diff - Extend REST API: cluster CRUD (GET/POST/DELETE /clusters), config endpoints (GET/POST .../config, GET .../config/history, POST .../config/rollback) - Wire new deps into lwauth-controlplane main Frontend (SolidJS): - Add Clusters page: list with instance count, add/remove cluster dialog - Add ConfigEditor page: JSON editor with inline validation, version history timeline sidebar, view/rollback per version - Extend API client with cluster and config types + functions - Add /clusters and /instances/:cluster/:name/config routes - Add 'Edit Config' button on instance detail page Ref: UIDESIGN.md Phase 2 (tasks 2.1–2.10)
- ProxyRoute reconciler with allowlist enforcement and health probing - Route REST API (CRUD) with in-memory store and periodic health checks - MeshGraph page: d3-force topology visualization color-coded by health - Routes page: route list table with create/delete - API client route types and functions - Add node_modules/dist to .gitignore
…cisions tail
- Add metrics aggregator (scrapes /healthz from instances, computes rates/rollups)
- Add WebSocket streaming hub for real-time decisions and metrics push
- Add decision collector polling /v1/admin/audit/recent from instances
- Add REST endpoints: GET /metrics, GET /metrics/{cluster}/{name}
- Add WebSocket endpoints: /stream/decisions (filterable), /stream/metrics (2s push)
- Fix health check to use /healthz (unauthenticated) instead of /v1/admin/status
- Fix WebSocket handlers to block (prevent r.Context() cancellation)
- Fix SolidJS routing (define Route components in index.tsx)
- Remove dead routes export from App.tsx
- Add Dockerfile.controlplane for multi-stage build (UI + Go binary)
- Add Helm chart CRDs template for LwauthInstance/ProxyRoute
- Add deploy/values-tenant-a.yaml with networkPolicy disabled for dev
- Dashboard: live KPI cards via WebSocket (total/healthy/unhealthy, rates)
- Decisions page: live tail with pause/resume, cluster/tenant/verdict filters
- InstanceDetail: sparklines via WebSocket metrics stream
- Update .dockerignore for ui/console/node_modules and dist
Tested E2E in Kind cluster (lwauth-dev):
- Control plane + tenant-a deployed, instances registered via API
- Health checks working, UI rendering all pages correctly
- WebSocket streams delivering live metrics to dashboard
## Node Reverse Proxy (primary feature)
- Add /v1/proxy/{cluster}/{name}[/{path}] endpoint in nodeproxy.go
- httputil.ReverseProxy with InsecureSkipVerify transport for internal certs
- Strips CP session cookie from forwarded requests
- Adds X-Lwauth-Node + Cache-Control: no-store response headers
- Per-request ErrorHandler returns 502 with node context on failure
- Fix: X-Forwarded-For correctly appends client IP to existing chain
- Register /v1/proxy/ route OUTSIDE session middleware (nodes handle own auth)
- Add proxyPath field to NodeEndpoints API response
- UI: CP Proxy card in EndpointsPanel (blue callout, base URL, sample curl)
- UI: proxyPath added to NodeEndpoints TypeScript interface
## Console Login Gate
- internal/controlplane/auth/session.go: single-admin bcrypt cookie auth
- Cookie: HttpOnly, Secure, SameSite=Strict, configurable TTL (default 12h)
- Config via CP_AUTH_ENABLED / CP_AUTH_USERNAME / CP_AUTH_PASSWORD_HASH(_FILE)
- Session middleware: guards /v1/controlplane/* except auth/* endpoints
- ui/console/src/auth/AuthGate.tsx: probes session on load, shows Login or App
- ui/console/src/auth/store.ts: shared reactive session signal
- ui/console/src/pages/Login.tsx: dark-themed login form
- ui/console/src/App.tsx: user + Sign Out button in sidebar footer
## JWKS URL Reachability Probe (C.0.5)
- internal/controlplane/api/probe.go: GET /v1/controlplane/probe/url?url=<enc>
- HTTPS-only, 5s timeout, max 2 redirects, blocks known SSRF pivot hostnames
- CreateInstanceWizard: JwksUrlInput with inline Test URL button; blocks
step 1→2 if any JWT module JWKS URL is unreachable
## Full Node Delete Teardown
- handleDeleteInstance: DeleteAllOf Deployment/Service/ConfigMap/Secret
scoped by CP labels; manual instances deregister only; idempotent via
apierrors.IsNotFound checks
- delete_test.go: 3 tests covering full teardown, manual node, not-found
## Health Checker TLS Fix
- discovery.go: HealthChecker client now uses InsecureSkipVerify=true
(same rationale as proxy transport: nodes use self-signed in-cluster certs)
## Verification
- go vet ./...: clean
- go test -race ./internal/...: all pass
- go build ./...: clean
- npx tsc --noEmit: clean
- Smoke tested: proxy 200 OK with X-Lwauth-Node header, auth session, endpoints
vet Summary ReportThis report is generated by vet Policy Checks
Malicious Package AnalysisActive malicious package analysis was disabled. Learn more about enabling active package analysis Malicious Package Analysis Report
Changed PackagesChanged Packages
Policy ViolationsPackages Violating Policy[Npm]
|
- build.yaml: add actions/setup-node + npm ci && npm run build before go vet/test in both test and fips-test jobs; fixes 'ui/embed.go: pattern console/dist/*: no matching files found' - streaming/hub.go: migrate nhooyr.io/websocket -> github.com/coder/websocket (maintained fork, identical API, higher popularity score); resolves Vet OSS Dependencies popularity policy violation - go.mod/go.sum: add coder/websocket v1.8.15 direct; remove nhooyr.io/websocket - mkdocs.yml: add design/node-cluster-auth.md and design/ui-controlplane-node-provisioning.md to Architecture nav; add operations/oci-phase-c-deploy.md to Operations nav; fixes docs/build --strict orphan-file errors - instance_reconciler.go, provisioner/values.go, server.go, CreateInstanceWizard.tsx: replica default 2->1 for 12 GB tier - docs/operations/oci-phase-c-deploy.md: OCI DNS -> HTTP-01 / external DNS
go mod tidy is platform-sensitive: on Windows it adds OS-specific indirect deps (github.com/Microsoft/go-winio, pulled in transitively by go-spiffe on Windows) that Linux tidy removes. Running tidy on the CI platform before go vet/test keeps the module graph consistent without requiring developers to use a Linux machine for every tidy.
- Delete pkg/spire/ (source_spire.go, source_nospire.go, spire.go) - Remove github.com/spiffe/go-spiffe/v2 from go.mod - Prunes github.com/Microsoft/go-winio (transitive via go-spiffe) - Remove go mod tidy steps from CI workflow to isolate build failures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.