kubesphere / kubesphere/ks-devops

The redirect location returned by `DownloadS2iBinaryHandler` is an in-cluster service domain

Open
#758 0 comments 1 reaction 1 assignee View on GitHub

@yudong2015 is already working on this.

Since Mar 12, 2024.

kind/bug
Dominant language
Go
Stars
164
Forks
140
PR merge metrics
No merged PRs in 30d

Description

What is version of KubeSphere DevOps has the issue?

All versions

How did you install the Kubernetes? Or what is the Kubernetes distribution?

No response

What happened?

In:
https://github.com/kubesphere/ks-devops/blob/4c6a153555b85a321fad7fca2e2aaf681f858dcb/pkg/kapis/devops/v1alpha2/s2ibinary.go#L97-L108

A redirect http response is returned, telling the client to download the object directly from the s3 bucket, which, in KubeSphere, is a built-in minio deployment, accessed by a k8s service domain, typically minio.kubesphere-system.svc.

The serivce domain cannot be accessed from outside the cluster, so a special proxy route that follows this redirect is implemented in ks-console, which solves this issue:
https://github.com/kubesphere/console/blob/cb54d9d52115cba77133cd758fc8ae91ec4acf29/server/proxy.js#L71-L82

Unfortunately, in a multi-cluster enviroment, when the ks-console tries to follow the redirect, it'll always end up in its own cluster (host cluster, if client is visiting from browser), and if there happens to be a minio too, a Object Not Found error might be returned, or a falsely positive file which coincidently has the same name might be downloaded.

Relevant log output

No response

Additional information
IMO, this proxy to minio should be handled by the backend apiserver in the first place to avoid this kind of problems.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.