deepfence / deepfence/ThreatMapper

deepfence-router service doesn't seem to work with istio-gateway - too many redirects

Open
#785 0 comments 0 reactions 0 assignees View on GitHub
bug needs-triage
Dominant language
TypeScript
Stars
5.3k
Forks
631
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When trying to configure the deepfence-router service as `type: ClusterIP` and then define a VirtualService and Gateway using Istio in the cluster, I am unable to route the application to a URL in our domain. When I configure it to use port 80 with no redirects the page produces `ERR_TOO_MANY_REDIRECTS`. This has been configured almost identically with other services we run out of the box, but doesn't work with this one.

At the moment, the only way to access the console is by port-forwarding and I believe there may be some routing done within the container image and would like to double check if this is true.

**To Reproduce**
Steps to reproduce the behavior:
1. Have Istio configured in the cluster and be able to serve traffic via routing services through the VirtualService and Gateway resources.
2. Deploy the deepfence-router with the variables seen in screenshots.
3. Deploy virtualService and Gateway seen in screenshots.
4. Access URL which you own and are able to route to in order to see error also in screenshots below.

**Expected behavior**
deepfence-router service able to be routed via Istio to a desired URL in a domain we own.

**Screenshots**
Screenshot 2023-01-05 at 15 34 59
Screenshot 2023-01-05 at 15 37 09

**Components/Services affected**

- [ ] UI/Frontend
- [ ] API/Backend
- [ ] Agent
- [ ] Deployment/YAMLs
- [ ] CI/CD Integration
- [X] Other (specify) - Router service

**Additional context**
here is the yaml of the deepfence-router:
```
Name: deepfence-router
Namespace: threatmapper
Labels: app=deepfence-router
app.kubernetes.io/instance=deepfence-router
app.kubernetes.io/managed-by=Helm
app.kubernetes.io/name=deepfence-router
app.kubernetes.io/version=1.4.1
helm.sh/chart=deepfence-router-1.4.8
helm.toolkit.fluxcd.io/name=deepfence-router
helm.toolkit.fluxcd.io/namespace=threatmapper
Annotations: meta.helm.sh/release-name: deepfence-router
meta.helm.sh/release-namespace: threatmapper
service.beta.kubernetes.io/aws-load-balancer-type:
Selector: name=deepfence-router
Type: ClusterIP
IP Family Policy: SingleStack
IP Families: IPv4
IP: xxx.xx.xxx.xxx
IPs: xxx.xx.xxx.xxx
Port: https-port 443/TCP
TargetPort: 443/TCP
Endpoints: xxx.xx.xx.xxx:443
Port: http-port 80/TCP
TargetPort: 80/TCP
Endpoints: xxx.xx.xx.xxx:80
Session Affinity: None
Events:
```

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the deepfence-router Helm service configuration and the Istio VirtualService and Gateway YAML described in the report, focusing on the port 80 and 443 routes. Reproduce the URL access with the service configured as ClusterIP and determine whether the container or routing configuration causes the redirect loop; done means the router is reachable through the desired domain without repeated redirects.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
infrastructure, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.