feat: allow disabling HTTPS redirect#86
Merged
thesuperzapper merged 1 commit intoJan 27, 2024
Merged
Conversation
Signed-off-by: Mathew Wicks <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR makes it possible to disable the HTTP->HTTPS redirect on the gateway with a new
deploykf_core.deploykf_istio_gateway.gateway.tls.redirectvalue (default:true), and thus allows clients to talk over HTTP to the gateway.We also introduced the
deploykf_core.deploykf_istio_gateway.gateway.tls.clientsUseHttpsvalue (default:true) which is how deployKF decides what protocol of links and cookies presented to client browsers.WARNING: There is only ONE case where clients should talk to the gateway over HTTP. When the "client" is a proxy/load-balancer that is providing the actual "end users" its own TLS termination, but is unable to communicate with the backend over HTTPS.
Advanced Stuff:
We implement authentication using EnvoyFilters, we insert a bunch of HTTP_FILTER to the listener chain. These filters are set to do nothing by default, and are enabled per-route by selecting from VirtualServices which select our
deploykf-gatewayGateway.The problem is that we are unable to select routes by Gateway for HTTP listeners (istio/istio#46459), which means that authentication would not be enabled properly over HTTP.
We resolved this issue by simply making the HTTP listener an internal proxy to our HTTPS routes, which means that all HTTP requests end up on the HTTPS routes (which have authentication correctly set up), at the expense of one additional proxy hop.
For this reason, we no longer allow users to set
deploykf_core.deploykf_istio_gateway.gateway.tls.enabledtofalse. However, we have left the value in the templates, so that if in the future, it becomes possible to avoid this work-around, we can more easily return to allowing users to disable the HTTPS listener on the gateway.