Yarp ServiceDiscovery not working in azure app service
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
Hi,
I'm having trouble applying service discovery to my BFF app running inside a docker container in an azure app service, using yarp to connect to a remote api,
Locally everything is working fine though, using an aspire app host project. However, when running it inside a docker container within an azure app service, I get an error message, stating that there is something wrong with the SSL connection.
### Expected Behavior
I expected the remote api url to be accessible through Service discovery.
### Steps To Reproduce
In the BFF app, the following configuration in the appsettings.json exists:
```
"ReverseProxy": {
"Routes": {
"remoteapiexample": {
"ClusterId": "remoteapiexample",
"Match": {
"Path": "/api/{**catch-all}"
}
}
},
"Clusters": {
"remoteapiexample": {
"Destinations": {
"remote": {
"Address": "https+http://remoteapiurl"
}
}
}
}
```
And loading it in code as such:
```
var reverseProxyBuilder = builder.Services.AddReverseProxy()
.AddTransforms(); // This is from the Duende.Bff.Yarp package.
reverseProxyBuilder
.LoadFromConfig(builder.Configuration.GetSection("ReverseProxy"))
.AddServiceDiscoveryDestinationResolver();
```
Finally to configure the real remote endpoint, this is configured with an environment setting:
services__remoteapiurl__https__0: https://remoteapiexample.azurewebsites.net
### Exceptions (if any)
The error log in the azure app service:
```
2025-01-22T20:41:33.7358732Z [20:41:33 INF] Proxying to https://remoteapiexample.azurewebsites.net/api/profile HTTP/2 RequestVersionOrLower
2025-01-22T20:41:35.4101773Z [20:41:34 WRN] Request: An error was encountered before receiving a response.
2025-01-22T20:41:35.4102279Z System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
2025-01-22T20:41:35.4102310Z ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch
2025-01-22T20:41:35.4102332Z at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
2025-01-22T20:41:35.4102352Z at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
2025-01-22T20:41:35.4102375Z at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102404Z at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102474Z --- End of inner exception stack trace ---
2025-01-22T20:41:35.4102500Z at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102521Z at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102542Z at System.Net.Http.HttpConnectionPool.InjectNewHttp2ConnectionAsync(QueueItem queueItem)
2025-01-22T20:41:35.4102563Z at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
2025-01-22T20:41:35.4102587Z at System.Net.Http.HttpConnectionWaiter`1.WaitForConnectionWithTelemetryAsync(HttpRequestMessage request, HttpConnectionPool pool, Boolean async, CancellationToken requestCancellationToken)
2025-01-22T20:41:35.4102610Z at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102657Z at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2025-01-22T20:41:35.4102684Z at Yarp.ReverseProxy.Forwarder.HttpForwarder.SendAsync(HttpContext context, String destinationPrefix, HttpMessageInvoker httpClient, ForwarderRequestConfig requestConfig, HttpTransformer transformer, CancellationToken cancellationToken)
2025-01-22T20:41:35.4432113Z [20:41:35 INF] Executed endpoint 'remoteapiurl'
```
### .NET Version info
Using dotnet version 9.0.102.
### Anything else?
Currently my app is working fine without service discovery, by passing down the remote api endpoint address to the in-memory yarp configuration directly though.
However, I'm trying to understand why this doesn't work using service discovery, and why the SSL connection error is thrown.
Contributor guide
Assessment
This issue has not been assessed yet.