kiali: Kiali deployed behind proxy does not work as expected
Description
Starting in Kiali 1.35, Kiali’s pod was changed to a read-only file system https://github.com/kiali/kiali/pull/4022/files. This is now causing issues for deployments of Kiali that are behind a proxy as there is no way to specify the proxy path as well as a server.web_root.
Prior to this change, I was utilizing the env.js file to manually override the window.WEB_ROOT value. This meant that I was able to leave the server.web_root value as the default value of /kiali and also have the window.WEB_ROOT be my proxy path + the server.web_root.
Example
http://localhost:2001/kiali is where the UI is accessible from. This means server.web_root=/kiali.
http://localhost:8080/proxy is the endpoint that will proxy http://localhost:2001/kiali so my window.WEB_ROOT would need to be /proxy/kiali. Since the window.WEB_ROOT is set by the server.web_root, then there is no value that I can set the server.web_root that will work for kiali to still be served from /kiali but my window root to be /proxy/kiali.
If I set server.web_root=/proxy/kialiin an attempt to include my proxy path, then when I hit my proxy endpoint http://localhost:8080/proxy it will redirect the traffic to http://localhost:8080/proxy/proxy/kiali because kiali is being served from /proxy/kiali, then the window.WEB_ROOT will overwrite the url path and it will be left at http://localhost:8080/proxy/kiali which is my proxy end point, but not the path where kiali is currently being served up from because we set that to /proxy/kiali and with the window.WEB_ROOT rewrite we are now only hitting /kiali.
https://github.com/brendarearden/example-kiali-redirect I have created a simple proxy example using python to help explain this a little more and you can see how the path overwrite is occurring.
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 16 (3 by maintainers)
Even though this is uniquely targeted to a specific use-case and not generally needed, we could support it. But to support this use-case it sounds like we need a new CR setting
server.redirect_path(or whatever we think it should be called - I don’t know a good name for it) and have the server use that for the in-memory replace within the env.js file. If it isn’t specified, use web_root as the default value for it.This new config setting would be needed to be added to the server helm chart as well as the operator. See: https://github.com/kiali/kiali-operator/blob/master/DEVELOPING.adoc#are-you-altering-a-kiali-server-configuration-setting
If you want this capability, feel free to contribute a PR on this.