deepfence / deepfence/ThreatMapper
deepfence-router service doesn't seem to work with istio-gateway - too many redirects
- Dominant language
- TypeScript
- Stars
- 5.3k
- Forks
- 631
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When trying to configure the deepfence-router service as `type: ClusterIP` and then define a VirtualService and Gateway using Istio in the cluster, I am unable to route the application to a URL in our domain. When I configure it to use port 80 with no redirects the page produces `ERR_TOO_MANY_REDIRECTS`. This has been configured almost identically with other services we run out of the box, but doesn't work with this one.
At the moment, the only way to access the console is by port-forwarding and I believe there may be some routing done within the container image and would like to double check if this is true.
**To Reproduce**
Steps to reproduce the behavior:
1. Have Istio configured in the cluster and be able to serve traffic via routing services through the VirtualService and Gateway resources.
2. Deploy the deepfence-router with the variables seen in screenshots.
3. Deploy virtualService and Gateway seen in screenshots.
4. Access URL which you own and are able to route to in order to see error also in screenshots below.
**Expected behavior**
deepfence-router service able to be routed via Istio to a desired URL in a domain we own.
**Screenshots**

**Components/Services affected**
- [ ] UI/Frontend
- [ ] API/Backend
- [ ] Agent
- [ ] Deployment/YAMLs
- [ ] CI/CD Integration
- [X] Other (specify) - Router service
**Additional context**
here is the yaml of the deepfence-router:
```
Name: deepfence-router
Namespace: threatmapper
Labels: app=deepfence-router
app.kubernetes.io/instance=deepfence-router
app.kubernetes.io/managed-by=Helm
app.kubernetes.io/name=deepfence-router
app.kubernetes.io/version=1.4.1
helm.sh/chart=deepfence-router-1.4.8
helm.toolkit.fluxcd.io/name=deepfence-router
helm.toolkit.fluxcd.io/namespace=threatmapper
Annotations: meta.helm.sh/release-name: deepfence-router
meta.helm.sh/release-namespace: threatmapper
service.beta.kubernetes.io/aws-load-balancer-type:
Selector: name=deepfence-router
Type: ClusterIP
IP Family Policy: SingleStack
IP Families: IPv4
IP: xxx.xx.xxx.xxx
IPs: xxx.xx.xxx.xxx
Port: https-port 443/TCP
TargetPort: 443/TCP
Endpoints: xxx.xx.xx.xxx:443
Port: http-port 80/TCP
TargetPort: 80/TCP
Endpoints: xxx.xx.xx.xxx:80
Session Affinity: None
Events:
```
Contributor guide
Research direction
Start by inspecting the deepfence-router Helm service configuration and the Istio VirtualService and Gateway YAML described in the report, focusing on the port 80 and 443 routes. Reproduce the URL access with the service configured as ClusterIP and determine whether the container or routing configuration causes the redirect loop; done means the router is reachable through the desired domain without repeated redirects.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100