pomerium: Websocket error with linkerd dashboard
What happened?
I cannot get the linkerd dashboard live stream of calls to work. I get "websocket error: undefined`.
What did you expect to happen?
I expect to see a stream of calls to my service. I see the live stream if I port-forward. I do not see the live stream if I proxy with pomerium.
What’s your environment like?
- Pomerium version (retrieve with
pomerium --version
or/ping
endpoint): v0.5.1 - Server Operating System/Architecture/Cloud: K8s Rev: v1.14.9-eks-ba3d77
What’s your config.yaml?
apiVersion: v1
data:
config.yaml: "policy: \n - allow_websockets: true\n allowed_groups:\n - eng@tidepool.org\n
\ allowed_users: []\n from: https://glooe-monitoring.production.tidepool.org\n
\ to: http://glooe-grafana.gloo-system.svc.cluster.local\n - allow_websockets:
true\n allowed_groups:\n - eng@tidepool.org\n allowed_users: []\n from:
https://linkerd-dashboard.production.tidepool.org\n to: http://linkerd-dashboard.linkerd.svc.cluster.local:8080\n"
kind: ConfigMap
metadata:
annotations:
flux.weave.works/antecedent: pomerium:helmrelease/pomerium
creationTimestamp: "2019-12-12T18:50:52Z"
labels:
app.kubernetes.io/instance: pomerium
app.kubernetes.io/managed-by: Tiller
app.kubernetes.io/name: pomerium
helm.sh/chart: pomerium-4.1.2
name: pomerium
namespace: pomerium
resourceVersion: "26735217"
selfLink: /api/v1/namespaces/pomerium/configmaps/pomerium
uid: 525ccabf-1d10-11ea-abeb-02c077500bb6
Additional context
Add any other context about the problem here.
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 26 (8 by maintainers)
Problem SOLVED!
I had my gateway remove the
Origin
header BEFORE the request is passed to the Pomerium Proxy.I deleted the post. Red herring.
@derrickburns I was about to ask if you had any other infrastructure items between the user, pomerium, and the downstream application.
For example, I know that (pomerium aside) running websockets behind nginx requires some extra markup.
PS. I removed the pomerium cookie you posted above. Though there are no access tokens in there, I just wanted to be on the safe side, as it does contain groups / users.
I think this may be a configuration issue with my API gateway…
The problem appears to occur immediately upon access to a link that uses web sockets.