microsoft / microsoft/aspire

Yarp ServiceDiscovery not working in azure app service

Open
#7,307 2 comments 0 reactions 0 assignees View on GitHub
area-service-discovery
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

Hi,

I'm having trouble applying service discovery to my BFF app running inside a docker container in an azure app service, using yarp to connect to a remote api,

Locally everything is working fine though, using an aspire app host project. However, when running it inside a docker container within an azure app service, I get an error message, stating that there is something wrong with the SSL connection.

### Expected Behavior

I expected the remote api url to be accessible through Service discovery.

### Steps To Reproduce

In the BFF app, the following configuration in the appsettings.json exists:

```
"ReverseProxy": {
"Routes": {
"remoteapiexample": {
"ClusterId": "remoteapiexample",
"Match": {
"Path": "/api/{**catch-all}"
}
}
},

"Clusters": {
"remoteapiexample": {
"Destinations": {
"remote": {
"Address": "https+http://remoteapiurl"
}
}
}
}
```

And loading it in code as such:

```
var reverseProxyBuilder = builder.Services.AddReverseProxy()
.AddTransforms(); // This is from the Duende.Bff.Yarp package.

reverseProxyBuilder
.LoadFromConfig(builder.Configuration.GetSection("ReverseProxy"))
.AddServiceDiscoveryDestinationResolver();
```

Finally to configure the real remote endpoint, this is configured with an environment setting:
services__remoteapiurl__https__0: https://remoteapiexample.azurewebsites.net

### Exceptions (if any)

The error log in the azure app service:

```
2025-01-22T20:41:33.7358732Z [20:41:33 INF] Proxying to https://remoteapiexample.azurewebsites.net/api/profile HTTP/2 RequestVersionOrLower
2025-01-22T20:41:35.4101773Z [20:41:34 WRN] Request: An error was encountered before receiving a response.
2025-01-22T20:41:35.4102279Z System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
2025-01-22T20:41:35.4102310Z ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch
2025-01-22T20:41:35.4102332Z at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
2025-01-22T20:41:35.4102352Z at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
2025-01-22T20:41:35.4102375Z at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102404Z at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102474Z --- End of inner exception stack trace ---
2025-01-22T20:41:35.4102500Z at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102521Z at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102542Z at System.Net.Http.HttpConnectionPool.InjectNewHttp2ConnectionAsync(QueueItem queueItem)
2025-01-22T20:41:35.4102563Z at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
2025-01-22T20:41:35.4102587Z at System.Net.Http.HttpConnectionWaiter`1.WaitForConnectionWithTelemetryAsync(HttpRequestMessage request, HttpConnectionPool pool, Boolean async, CancellationToken requestCancellationToken)
2025-01-22T20:41:35.4102610Z at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102657Z at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102684Z at Yarp.ReverseProxy.Forwarder.HttpForwarder.SendAsync(HttpContext context, String destinationPrefix, HttpMessageInvoker httpClient, ForwarderRequestConfig requestConfig, HttpTransformer transformer, CancellationToken cancellationToken)
2025-01-22T20:41:35.4432113Z [20:41:35 INF] Executed endpoint 'remoteapiurl'
```

### .NET Version info

Using dotnet version 9.0.102.

### Anything else?

Currently my app is working fine without service discovery, by passing down the remote api endpoint address to the in-memory yarp configuration directly though.

However, I'm trying to understand why this doesn't work using service discovery, and why the SSL connection error is thrown.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.