fix(codeserver): fix 502 bad gateway for culling probe#3092
fix(codeserver): fix 502 bad gateway for culling probe#3092EdisonSu768 wants to merge 1 commit intoopendatahub-io:mainfrom
Conversation
Add mod_unixd, remove mod_mime, and add DirectoryIndex to httpd.conf to ensure the CGI server starts and correctly routes /api/kernels to access.cgi for Activity Culling.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
github-actions
Bot
added
the
review-requested
|
Hi @EdisonSu768. Thanks for your PR. I'm waiting for a opendatahub-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
📝 WalkthroughWalkthroughModified Apache httpd configuration file to load the unixd_module, remove mime_module, and set access.cgi as the directory index for the /opt/app-root directory. Total of 2 lines added and 1 line removed. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@codeserver/ubi9-python-3.12/httpd/httpd.conf`:
- Around line 6-10: The Apache config is missing the LoadModule mime_module
declaration required for AddHandler cgi-script .cgi to work; add a LoadModule
mime_module modules/mod_mime.so entry alongside the other LoadModule lines (near
the existing mpm_prefork_module, unixd_module, authz_core_module, dir_module,
cgi_module entries) so mod_mime is loaded before the AddHandler registration and
the config can be parsed successfully.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 936cacc7-5b37-4634-84cf-48e3868b1d8c
📒 Files selected for processing (1)
codeserver/ubi9-python-3.12/httpd/httpd.conf
| LoadModule mpm_prefork_module modules/mod_mpm_prefork.so | ||
| LoadModule unixd_module modules/mod_unixd.so | ||
| LoadModule authz_core_module modules/mod_authz_core.so | ||
| LoadModule mime_module modules/mod_mime.so | ||
| LoadModule dir_module modules/mod_dir.so | ||
| LoadModule cgi_module modules/mod_cgi.so |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether AddHandler is present without mod_mime being loaded.
rg -nP '^\s*LoadModule\s+mime_module\b|^\s*AddHandler\s+cgi-script\b' \
codeserver/ubi9-python-3.12/httpd/httpd.conf \
codeserver/ubi9-python-3.12/httpd/codeserver-cgi.confRepository: opendatahub-io/notebooks
Length of output: 234
🏁 Script executed:
head -n 40 codeserver/ubi9-python-3.12/httpd/httpd.conf | cat -nRepository: opendatahub-io/notebooks
Length of output: 1298
Re-add LoadModule mime_module to prevent Apache config parse failure.
AddHandler cgi-script .cgi at line 34 requires mod_mime to function. This module is not currently loaded in lines 6–11. Apache will fail to parse the config and the CGI handler registration will not occur, blocking the probe endpoint.
Proposed fix
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule dir_module modules/mod_dir.so
+LoadModule mime_module modules/mod_mime.so
LoadModule cgi_module modules/mod_cgi.so🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@codeserver/ubi9-python-3.12/httpd/httpd.conf` around lines 6 - 10, The Apache
config is missing the LoadModule mime_module declaration required for AddHandler
cgi-script .cgi to work; add a LoadModule mime_module modules/mod_mime.so entry
alongside the other LoadModule lines (near the existing mpm_prefork_module,
unixd_module, authz_core_module, dir_module, cgi_module entries) so mod_mime is
loaded before the AddHandler registration and the config can be parsed
successfully.
There was a problem hiding this comment.
Confirmed. Removing mod_mime causes Apache to fail at config parse time with:
AH00526: Syntax error on line 34 of /etc/httpd/conf/httpd.conf:
Invalid command 'AddHandler', perhaps misspelled or defined by a module not included in the server configuration
This means httpd never starts, and nginx returns 502 for every request to /api/kernels/. mod_mime must be kept (or AddHandler replaced with SetHandler, which is provided by the core and does not require mod_mime).
|
/ok-to-test |
|
@EdisonSu768: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
|
||
| # Load modules | ||
| LoadModule mpm_prefork_module modules/mod_mpm_prefork.so | ||
| LoadModule unixd_module modules/mod_unixd.so |
There was a problem hiding this comment.
@coderabbitai isn't this only needed if httpd is started as root? and in our containers we never do that
There was a problem hiding this comment.
@jiridanek — That's a great observation. You're partially correct:
- The
mod_unixdmodule provides theUserandGroupdirectives, whose primary purpose is to drop privileges after Apache starts as root (which is needed to bind to privileged ports like 80/443). - For those specific directives, the server must be run initially as root — if started as a non-root user, the
User/Groupdrop is simply skipped.
However, mod_unixd goes beyond just User/Group. On Unix-like systems, it is classified as a Base module and also provides lower-level OS environment initialization functions (such as os_init_job_environment) that the mpm_prefork_module calls during startup, regardless of whether httpd is running as root. That is why you typically see mod_unixd listed as a hard dependency in Unix Apache configurations even in containerized, non-root environments.
Notably, mod_fcgid explicitly requires mod_unixd to be loaded before itself in the httpd config — and similar internal linkage exists for prefork-based CGI setups.
So while the User/Group directives are indeed no-ops in an OpenShift container (since httpd starts as a random non-root UID), mod_unixd itself is still a required module for the prefork MPM to initialize correctly on Unix. That said, it would be worth the PR author (@EdisonSu768) confirming whether the actual fix for the 502 was:
- Adding
mod_unixd(fixing a startup/initialization failure), or - Adding
DirectoryIndex access.cgi(fixing the routing of requests to the CGI script).
The DirectoryIndex change looks like the more directly impactful fix for ensuring the culling probe reaches access.cgi.
2 participants
Fixes #3091
Summary
Fix 502 Bad Gateway error that occurs during Activity Culling probe in Code Server workbench.
Changes
mod_unixdmodule to httpd.conf (required for CGI execution on Unix systems)mod_mimemodule (not needed for this use case)DirectoryIndex access.cgito ensure proper routing to the CGI scriptProblem
The culling probe was returning 502 errors because the Apache httpd server wasn't properly configured to execute CGI scripts. The missing
mod_unixdmodule prevented the CGI server from starting correctly.Solution
This fix ensures the
/api/kernelsendpoint correctly routes toaccess.cgifor Activity Culling functionality.