apache / apache/openwhisk-deploy-kube

EKS deployment does not accept https requests, only http

Open
#747 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
309
Forks
231
PR merge metrics
No merged PRs in 30d

Description

## Steps to reproduce the issue
1. Create EKS cluster: `eksctl create cluster --name test-cluster-1 --region eu-central-1 --node-type t2.large --nodes 1`
2. Label nodes: `kubectl label nodes --all openwhisk-role=invoker`
3. Install Helm chart: `helm install owdev openwhisk-deploy-kube/helm/openwhisk -n openwhisk --create-namespace -f mycluster.yaml`
4. Setup WSK CLI as the [docs ](https://github.com/apache/openwhisk-deploy-kube#configure-the-wsk-cli) say, using the load balancer's DNS: `wsk -i property set --apihost https://:443`
5. Run WSK command: `wsk list -v`

## Observations
* Output of `wsk list -v`:
![image](https://user-images.githubusercontent.com/31116930/185684271-f9f3954a-9a5c-40a5-a0fa-f18b3e7ceb2d.png)
* Load balancer's info from AWS Console:
![image](https://user-images.githubusercontent.com/31116930/185683692-b7709ff2-d2d0-4f0f-8bef-dfda8209e392.png)
* Api calls work when setting up the WSK CLI using http instead of https.

### mycluster.yaml
```yaml
k8s:
persistence:
enabled: false

whisk:
ingress:
type: LoadBalancer
annotations:
service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:iam::XXXXXXXXXXXX:server-certificate/ow-self-signed

whisk:
ingress:
awsSSL: "true"
type: LoadBalancer
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https-api
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:eu-central-1:XXXXXXXXXXXX:certificate/YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY # AWS Certificate Manager (ow-self-signed).
```

## Reason of interest
I want to use the OpenWhisk deployment as an endpoint for *AWS EventBridge*, but currently it is only possible to add *API Destinations* that use https endpoints.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the deployment with the supplied mycluster.yaml, then inspect the Helm chart's ingress settings and AWS load-balancer annotations. Compare the resulting HTTP and HTTPS endpoints and use `wsk list -v` against the HTTPS load-balancer DNS to verify that HTTPS requests succeed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, helm, kubernetes
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.