Set http proxy with kiali

[Mickaël Roger BESSE]

Hello

I installed kiali using the operator deployed with helm.

I want to configure openid authentication in kiali as our kubernetes cluster is already configure using openid. 

We are using azure AD and the issuer_uri is something like https://login.microsoftonline.com/XXXX

Kiali pods doesn't have direct access to internet, we have to use a proxy for that.

I need to find a way to configure kiali to use a proxy to be able to reach https://login.microsoftonline.com.

I tried to add https_proxy (also try in upper case) in the env of the deployment of kiali but it doesn't work.

Do you know if it's possible to use http proxy in kiali ?

Regards

Mickael 

[Mickaël Roger BESSE]

Just want to add a comment. 

https_proxy defined in the deployment is use by kiali but it is not use to reach the  issuer_uri  URL.

Regards

Mickael 

[John Mazzitelli]

Have you reviewed the docs here?

https://kiali.io/documentation/latest/configuration/authentication/openid/

We also have this in the FAQ:

https://kiali.io/documentation/latest/faq/#x-forwarded-port

Related to that FAQ, we also have just introduced this port config to Kiali in case you don't want to use the solution described in the FAQ above. This feature will be in the next Kiali release (to be released tomorrow):

https://github.com/kiali/kiali-operator/pull/190/files

(note to Edgar - we might want to update that FAQ after tomorrow's release to mention this new web_port)

> --
> You received this message because you are subscribed to the Google Groups
> "kiali-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to kiali-users...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/kiali-users/5ae45c33-b4f1-4c01-b689-c3cd6498e7cen%40googlegroups.com.
>

[Mickaël Roger BESSE]

Hi

Thanks for the answer.

Yes, I reviewed the doc https://kiali.io/documentation/latest/configuration/authentication/openid/  and use it to do my openid configuration.

x-forwarded-port and port config is note related to my issue, for the moment i am using kubectl port-forward svc/kiali 20001:20001 -n istio-system to directly reach kiali from my browser.

The problem is that kiali try to reach the URL https://login.microsoftonline.com/XXXXX/v2.0/.well-known/openid-configuration just after clicing the button "log in with openID"

It's not possible as the pod doesn't not have direct access to internet and the http_proxy environment variable is ignored.

I have this error just after clicing the button "log in with openID"

  {"error":"Error fetching OpenID provider metadata.","detail":"Get \"https://login.microsoftonline.com/XXXXXX/v2.0/.well-known/openid-configuration\": dial tcp 40.126.1.167:443: i/o timeout (Client.Timeout exceeded while awaiting headers)"}  

Regards

Mickael

[John Mazzitelli]

(message to Edgar H. -> I think we may need more docs/FAQ on configuring with http proxies.)

This has come up many times in the past; unfortunately, I do not know enough about it to suggest anything. Let's see if Edgar can chime you. You also might want to search the kiali-users google group for past threads on this (also check the kiali-dev google group in case the threads I'm thinking of were over there).

> https://groups.google.com/d/msgid/kiali-users/a356b46e-eb61-4315-9b3c-e1ccac34437cn%40googlegroups.com.
>

[Edgar Hernández]

Hi, Mickaël

You will need to open a new GitHub issue asking for this support.
Most of the time, Kiali only "talks" to in-cluster services, so the forward proxy is usually not needed.

It's the first time we heard that somebody is using a forward proxy to reach the internet. It, anyway should honor the environment variables, but since Kiali is creating a customized transport, I think we omitted this important detail of grabbing what is defined in the environment (see: https://github.com/kiali/kiali/blob/d13dc407c71ded8a6a456f2679e5efde3b86e546/business/openid_auth.go#L281-L292).

To view this discussion on the web visit https://groups.google.com/d/msgid/kiali-users/a356b46e-eb61-4315-9b3c-e1ccac34437cn%40googlegroups.com.

[Nathan Flynn]

We've the same issue as above. No direct internet access but need Kiali to use a proxy to retrieve the OIDC files;

Raised ticket at https://github.com/kiali/kiali/issues/3451