Checks
deployKF Version
0.1.2
Kubernetes Version
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.17", GitCommit:"22a9682c8fe855c321be75c5faacde343f909b04", GitTreeState:"clean", BuildDate:"2023-08-25T02:13:39Z", GoVersion:"go1.19.12", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.9+vmware.1", GitCommit:"d1d7c19c9b6265a8dcd1b2ab2620ec0fc7cee784", GitTreeState:"clean", BuildDate:"2022-12-14T06:23:39Z", GoVersion:"go1.18.9", Compiler:"gc", Platform:"linux/amd64"}Description
I regularly get an HTTP ERROR 431 if I re-authenticate after my Keycloak session has expired.
When re-authenticating I have cookies taking up to 12 KB. But Istio default max request headers allowed is 60 KiB.
So I don't quite understand where exactly the error is happening.
Headers from web browser (I shortened the cookies for readability):
Request URL:
https://kubeflow.example.com/
Request Method:
GET
Status Code:
431 Request Header Fields Too Large
Referrer Policy:
no-referrer
Response Headers:
Date: Mon, 05 Feb 2024 07:10:08 GMT
Server: istio-envoy
X-Envoy-Upstream-Service-Time: 4
Request Headers:
:authority: kubeflow.example.com
:method: GET
:path: /
:scheme: https
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,ru;q=0.8
Cache-Control: max-age=0
Cookie:_deploykf_token_csrf_VKAn1hSV=1o5...tdcU=; _deploykf_token_csrf_nVpidspH=0z-WK...Wbg0=; _deploykf_token_csrf_IR4Ry80n=MeeeDcxLqM...sADFoQ_4=; _deploykf_token_csrf_N1tzT4g2=rJ_IkJ...j2fY=; _deploykf_token_csrf_KjON0Iki=i_Sio-1i8oINTp...EXo=; _deploykf_token_csrf_RY4KCmlu=qKg_U...gDE=; _deploykf_token_csrf_5LkCft-w=inY...OzoG8=; _deploykf_token_csrf_KbluAgpv=aCH2aK...kWfFQ=; _deploykf_token_csrf_T4LJnrLo=bKjg7Q...HOFEtk=; _deploykf_token_csrf_d9r7AanU=fR...J-q0oV7dA=; _deploykf_token_csrf_nL3oqHrj=8lN4p...syokh-v90=; _deploykf_token_csrf_Fa--VPTS=Nao...BXJyhYNY=; _deploykf_token_csrf_34b8tK4Z=LdJo3bbcq1YcL...7LKMEsJuZJLo=; _deploykf_token_csrf_boGY58YM=CCL..DZV0=; _deploykf_token_csrf_hkfYh2Yo=F6z..HgXRQcw=; _deploykf_token_csrf_dzYrnVj3=h_f..sFxqpuZ_QQ=; _deploykf_token_csrf_PhZSUxe9=HP..d4W0=; _deploykf_token_csrf_fXiBlrj0=JJ-1..Dg=; _deploykf_token_csrf_TFZ84rFM=DW..E_qC_s=; _deploykf_token_csrf_0oyI..VrV0=; _deploykf_token_csrf_SxK4cyfs=2U..YcMo=; _deploykf_token_csrf_2M0Bji9d=b-i6..d2c0=; _deploykf_token_csrf_NkpC573h=cc...6vc=; _deploykf_token_csrf_28jWR_Dp=mu...KU=; _deploykf_token_csrf_SOzhamEs=9P...r4=; _deploykf_token_csrf_yZdrbvE_=J0...Rs=; _deploykf_token=0k...kbr4=
Sec-Ch-Ua: "Chromium";v="121", "Not A(Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Relevant Logs
No response
deployKF Values (Optional)
## --------------------------------------
## deploykf-auth
## --------------------------------------
deploykf_auth:
namespace: deploykf-auth
## dex configs
##
dex:
## dex connectors
##
connectors:
- type: oidc
id: keycloak
name: keycloak
config:
issuer: "https://keycloak.example.com/realms/kubeflow"
clientID: kubeflow
clientSecret: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
redirectURI: "https://kubeflow.example.com/dex/callback"
scopes:
- openid
- profile
- email
insecureSkipEmailVerified: true
insecureEnableGroups: true
userIDKey: email
userNameKey: email
## dex OpenID Connect clients
##
clients:
## OpenID client for oauth2-proxy (deployKF Dashboard)
oauth2Proxy:
clientId: "oauth2-proxy"
clientSecret:
existingSecret: "generated--dex-oauth2-proxy-client"
existingSecretKey: "client_secret"
generateSecret: true
## oauth2-proxy configs
##
oauth2Proxy:
## oauth2-proxy cookie configs
##
cookie:
secret:
existingSecret: "generated--oauth2-proxy-cookie-secret"
existingSecretKey: "cookie_secret"
generateSecret: true
Checks
deployKF Version
0.1.2
Kubernetes Version
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.17", GitCommit:"22a9682c8fe855c321be75c5faacde343f909b04", GitTreeState:"clean", BuildDate:"2023-08-25T02:13:39Z", GoVersion:"go1.19.12", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.9+vmware.1", GitCommit:"d1d7c19c9b6265a8dcd1b2ab2620ec0fc7cee784", GitTreeState:"clean", BuildDate:"2022-12-14T06:23:39Z", GoVersion:"go1.18.9", Compiler:"gc", Platform:"linux/amd64"}Description
I regularly get an HTTP ERROR 431 if I re-authenticate after my Keycloak session has expired.
When re-authenticating I have cookies taking up to 12 KB. But Istio default max request headers allowed is 60 KiB.
So I don't quite understand where exactly the error is happening.
Headers from web browser (I shortened the cookies for readability):
Relevant Logs
No response
deployKF Values (Optional)