Skip to content

Conversation

@kurokobo
Copy link
Contributor

Closes #134, closes #135

In ansible/ansible-ui#927, EDA UI was changed to listen on both HTTP (80) and HTTPS (443), and to redirect HTTP to HTTPS. However, in typical deployment, SSL termination on K8s is processed not on application container but on Ingress/Route, and implementing HTTPS passthrough on Ingress/Route require additional configuration.

This PR adds configmap to allow customize default.conf for Nginx, and stop listening HTTPS in eda-ui container.

Changes:

  • Add configmap for default.conf.template for nginx and mount it on eda-ui
    • This file is based on eda.conf on ansible-ui repo that used as /etc/nginx/templates/default.conf.template to generate /etc/nginx/conf.d/default.conf on its startup
    • Use 8080 for HTTP, and remove SSL related configuration
  • Allow disabling IPv6 listener on eda-ui by spec.ipv6_disabled for EDA CR
    • As the same as AWX Operator

Tested:

  • Web UI can be accessed (/)
  • API docs can be accessed (/api/eda/v1/docs)
  • Project can be added
  • IPv6 listener is enabled by default
    $ kubectl -n eda exec -it deployment/eda-ui -- cat /etc/nginx/conf.d/default.conf
    server {
        listen 8080;
        listen [::]:8080;
    
        server_name _;
        server_tokens off;
    ...
  • With spec.ipv6_disabled: true, IPv6 listener is disabled
    $ kubectl -n eda exec -it deployment/eda-ui -- cat /etc/nginx/conf.d/default.conf
    server {
        listen 8080;
        
        server_name _;
        server_tokens off;
    ...

@kurokobo kurokobo changed the title Nginx feat: disable https and allow disabling ipv6 on eda-ui Oct 14, 2023
@rooftopcellist
Copy link
Member

I tested this out on my cluster and it works. Thank you @kurokobo for the fix!

Sorry for the wait, I was OOO, back now. I will rebase #137 so that we can truly support Edge and Passthrough termination.

@rooftopcellist rooftopcellist merged commit 7c1cb1b into ansible:main Oct 16, 2023
@kurokobo kurokobo deleted the nginx branch October 16, 2023 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

IPv6 is always enabled by default for eda-ui The ports and scheme for UI has been changed to 80/443 and HTTPS

2 participants