hasura / hasura/graphql-engine

[v2.0.0-alpha.6] Auth hook no longer respects K8 DNS SRV endpoints

Open
#6,752 0 comments 0 reactions 1 assignee Claimed by @tirumaraiselvan View on GitHub
a/security c/server k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

Hello Hasura team!

We have recently upgraded to v2.0.0. We've noticed that our K8 DNS SRV endpoints no longer work after upgrading. Example:

This environment variable value used to work:
```
HASURA_GRAPHQL_AUTH_HOOK=http://_http._tcp.core-service.api-services/graphql
```

But now we need to use our public domain, causing unnecessary network latency:
```
HASURA_GRAPHQL_AUTH_HOOK=https://gateway.foo.com/graphql
```

The precise behavior we're seeing is a network request failure and our remote schemas being inaccessible by Hasura. Switching to the public endpoint fixes it. Downgrading back to Hasura 1.3 also fixes the issue (we have to do a DB restore to downgrade, but we have tried it just to confirm the issue isn't on our side).

Other internal services we have are still able to access our DNS SRV endpoints just fine.

I am wondering if this might be due to some sort of endpoint validation logic that is inaccurately determining the SRV domains are invalid?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.