wave Hello team I am getting this error Ignoring ingress be GoodData #gooddata-cn

:wave: Hello, team! I am getting this error: "Igno...

Hamid Narimani

08/27/2021, 4:55 AM

👋 Hello, team! I am getting this error: "Ignoring ingress because of error while validating ingress class" ingress="gooddata-cn/managed-alpha-org" error="ingress does not contain a valid IngressClass" $kubectl -n ingress-nginx get svc ingress-nginx-controller NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ingress-nginx-controller LoadBalancer 172.20.141.216 <http://***-2.elb.amazonaws.com|***-2.elb.amazonaws.com> 8032663/TCP,44330230/TCP 13m Follow https://www.gooddata.com/developers/cloud-native/doc/1.1/installation/k8s/helm-chart-installation/ ----- # file name: customized-values-gooddata-cn.yaml deployRedisHA: true deployPostgresHA: true dex: ingress: authHost: 'auth.mydomain.com' tls: authSecretName: gooddata-cn-auth-tls license: key: "key/***" ----------- # helm-charts/helmfile-values/values-ingress.yaml controller: service: targetPorts: http: http https: http annotations: # SSL is terminated on ELB, so HTTP will be used downstram to our services service.beta.kubernetes.io/aws-load-balancer-backend-protocol: 'http' # only 'https' port will use SSL protocol service.beta.kubernetes.io/aws-load-balancer-ssl-ports: 'https' # keep connections open upto 1 hour service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' #AMC AWS SSL service.beta.kubernetes.io/aws-load-balancer-ssl-cert: 'arnawsacm:us-****' # Disable TLS1.1 and lower protocols on TLS handshake service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: 'ELBSecurityPolicy-TLS-1-2-2017-01' publishService: enabled: true ------------------ #your-org-definition.yaml apiVersion: controllers.gooddata.com/v1 kind: Organization metadata: name: alpha-org spec: id: alpha name: "Alpha, Corp." hostname: gooddata.mydomain.com adminGroup: adminGroup adminUser: admin adminUserToken: "$5$O*****" tls: secretName: alpha-tls

Robert Moucha

08/27/2021, 11:04 AM

Hello Hamid, could you please share more info regarding this issue? • version of your Kubernetes • version of ingress-nginx helm chart (esp. do you deployed from helm chart version 4.0.0 or higher?) • how many ingress controllers do you use? One or more? • does your deployment contain resources of ingressclass type? (check

kubectl get <http://ingressclasses.networking.k8s.io|ingressclasses.networking.k8s.io> -A

) I will try to simulate your problem and propose a solution

Robert Moucha

08/27/2021, 11:24 AM

As a quick fix, you may try to add the following annotation to your customized-values-gooddata-cn.yaml:

Copy code

ingress:
  annotations:
    <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx

(assuming your ingressclass is called

nginx

)

Hamid Narimani

08/27/2021, 4:14 PM

Thanks, Robert, the annotations solved the issue "ingress does not contain a valid IngressClass"

Copy code

kubectl get <http://ingressclasses.networking.k8s.io|ingressclasses.networking.k8s.io> -A
NAME  CONTROLLER       PARAMETERS  AGE
nginx  <http://k8s.io/ingress-nginx|k8s.io/ingress-nginx>  <none>    16h

I did some changes : Removed

Copy code

tls:
      authSecretName: gooddata-cn-auth-tls

Hamid Narimani

08/27/2021, 4:15 PM

Still having an issue with

Copy code

dex:
  ingress:
    authHost: '<http://auth.mydomain.com|auth.mydomain.com>'
    tls:
      authSecretName: gooddata-cn-auth-tls

What should be my authHost:

Copy code

And do I need  tls:

since I am using TLS terminated on a Load Balancer

Hamid Narimani

08/27/2021, 4:29 PM

What should be auth.mydomain.com' point to

Robert Moucha

08/27/2021, 4:29 PM

definitely not - if you're terminating TLS on your LB, you may remove

tls

section both in

dex.ingress

as well as in your organization custom resource (alpha-org).

Robert Moucha

08/27/2021, 4:30 PM

<http://auth.mydomain.com|auth.mydomain.com>

is a hostname where the authentication endpoint lives - it's common for all organizations.

Robert Moucha

08/27/2021, 4:31 PM

it should point to your LB as well

Hamid Narimani

08/27/2021, 4:32 PM

So two A record entry one for : gooddata.mydomin.com point to LB And auth.mydomain.com point to LB

Hamid Narimani

08/27/2021, 4:46 PM

https://auth.##.dev/dex/auth?response_type=code&client_id=###-a1b6-9f39653ce0b7&scope=openid%20profile&state=fF_###%3D&redirect_uri=http://gooddata.##.dev/login/oauth2/code/gooddata.##.dev&nonce=yKGPskLNavobnrh-fHWqQomuA5hOs1XZSLZQiSgdG8c

Hamid Narimani

08/27/2021, 4:46 PM

404 Not Found nginx

Hamid Narimani

08/27/2021, 5:22 PM

GET /oauth2/authorization/gooddata.##.dev

Robert Moucha

08/28/2021, 8:43 AM

1. you should add the

<http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx

annotation also to

dex.ingress.annotations

2. make sure the

.<http://mydomin.com|mydomin.com>

is the same as

.##.dev

in your example 3. I can see

redirect_uri=http://...

- it should use the https scheme. It seems that you're accessing http endpoint and http->https redirect is not in place. Try adding

<http://nginx.ingress.kubernetes.io/force-ssl-redirect|nginx.ingress.kubernetes.io/force-ssl-redirect>: "true"

to ingress.annotations in customized-values-gooddata-cn.yaml

Hamid Narimani

08/28/2021, 8:42 PM

deployRedisHA: true deployPostgresHA: true ingress: annotations: kubernetes.io/ingress.class: nginx kubernetes.io/force-ssl-redirect: true dex: ingress: authHost: 'auth.##.dev' annotations: kubernetes.io/ingress.class: nginx kubernetes.io/force-ssl-redirect: true

Hamid Narimani

08/28/2021, 8:42 PM

Still going to http

Hamid Narimani

08/28/2021, 8:44 PM

https://auth.##.dev/dex/auth?response_type=code&client_id=##&scope=openid%20profile&state=##&redirect_uri=http://gooddata.##.dev/login/oauth2/code/gooddata.##.dev&nonce=0VD74I0fOwx8WHAJ

Hamid Narimani

08/28/2021, 8:44 PM

helm3 upgrade --version 1.1.1 gooddata-cn gooddata/gooddata-cn -f customized-values-gooddata-cn.yaml -n gooddata-cn && kubectl rollout restart deploy -n ingress-nginx

Hamid Narimani

08/28/2021, 8:44 PM

Not help

Hamid Narimani

08/28/2021, 8:45 PM

Is this correct on LB: controller: service: targetPorts: http: http https: http

Hamid Narimani

08/29/2021, 1:20 AM

ERR_TOO_MANY_REDIRECTS When set

<http://nginx.ingress.kubernetes.io/force-ssl-redirect|nginx.ingress.kubernetes.io/force-ssl-redirect>: "true"

Hamid Narimani

08/29/2021, 1:21 AM

Copy code

# file name: customized-values-gooddata-cn.yaml
deployRedisHA: true
deployPostgresHA: true
ingress:
  annotations:
    <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx
    <http://nginx.ingress.kubernetes.io/force-ssl-redirect|nginx.ingress.kubernetes.io/force-ssl-redirect>: "true"
dex:
  ingress:
    authHost: 'auth.##.dev'
    annotations:
    <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx
license:
  key: "key/egggg

Robert Moucha

08/30/2021, 8:49 AM

Hi Hamid, it seems that your ingress controller doesn't respect X-Forwarded-* headers coming from your load balancer. Please add the following to helm chart values of ingress-nginx:

Copy code

controller:
  config:
    # use X-Forwarded-* received from ELB
    use-forwarded-headers: 'true'
    # This should improve performance
    client-body-buffer-size: '1m'
    # This should resolve possible issue with big headers
    proxy-buffer-size: '16k'

Then, redeploy ingress-nginx, perform rollout restart. You should then remove the Organization resource (kubectl -n yournamespace delete org -f your-org-definition.yaml) to clean old data from Gooddata.CN internal databases. One note - I can see you're still running old release 1.1.1 - I suggest upgrading to 1.3.0. If you don't have any data yet, perform a fresh install. Ortherwise follow upgrade procedures described in documentation. It seems that the nginx config snippet above is missing in our documentation. I will update it.

Hamid Narimani

08/30/2021, 3:52 PM

Hi Robert , Thanks for reply . https://auth.atheer.dev/dex/auth?response_type=code&client_id=9344d68-b1e[…].atheer.dev&nonce=e5Zj_QH-4v9Ci2

Hamid Narimani

08/30/2021, 3:53 PM

Screen Shot 2021-08-30 at 8.53.31 AM.png

Hamid Narimani

08/30/2021, 3:55 PM

Copy code

helm3 upgrade --version 1.3.0 gooddata-cn gooddata/gooddata-cn -f customized-values-gooddata-cn.yaml -n gooddata-cn

Robert Moucha

08/30/2021, 4:40 PM

great, the issue with http schema in redirect_url is resolved. now please check the Ingress for the Dex (gooddata-cn-dex) if it is OK (it has proper hostname, tls, assigned address pointing to proper load balancer, it has

<http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx

annotation)

Hamid Narimani

08/30/2021, 4:41 PM

Copy code

# file name: customized-values-gooddata-cn.yaml
deployRedisHA: true
deployPostgresHA: true
ingress:
  annotations:
    <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx
    <http://nginx.ingress.kubernetes.io/force-ssl-redirect|nginx.ingress.kubernetes.io/force-ssl-redirect>: "true"
dex:
  ingress:
    authHost: 'auth.atheer.dev'
    annotations:
    <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx
license:
  key: "key/eyJ

Hamid Narimani

08/30/2021, 6:51 PM

https://auth.atheer.dev/dex/auth?response_type=code&client_id=934a54d68-b1e[…].atheer.dev&nonce=SV_Iu_lCso

Hamid Narimani

08/30/2021, 6:52 PM

404 Not Found nginx

Hamid Narimani

08/30/2021, 10:08 PM

still same issue

Robert Moucha

08/31/2021, 8:36 AM

you have wrong indentation in yaml:

Copy code

dex:
  ingress:
    authHost: 'auth.atheer.dev'
    annotations:
    <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx

should be:

Copy code

dex:
  ingress:
    authHost: 'auth.atheer.dev'
    annotations:
      <http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>: nginx

Hamid Narimani

08/31/2021, 9:04 PM

Thanks @Robert Moucha It works. Now ask for email and password

Hamid Narimani

08/31/2021, 9:07 PM

What should be the Email/Password , I don't set any on installation

Robert Moucha

09/01/2021, 7:26 AM

I'm glad to hear you managed to finish installation. As you already have created the first Organization, it's time to configure authentication. Follow the steps in our documentation

Hamid Narimani

09/02/2021, 11:02 PM

Unable to resolve Configuration with the provided Issuer of \"https://oauth2.googleapis.com/token\"

Hamid Narimani

09/02/2021, 11:02 PM

Hi @Robert Moucha Can you please look at this issue

Hamid Narimani

09/02/2021, 11:57 PM

Copy code

{
  "title": "Not Found",
  "status": 404,
  "detail": "404 NOT_FOUND \"User is not registered\"",
  "traceId": "d2c69f02831f516f"
}

Robert Moucha

09/03/2021, 7:42 AM

Hi, the provided Issuer "https://oauth2.googleapis.com/token" is not valid. It should be set to "https://accounts.google.com"

Hamid Narimani

09/03/2021, 7:57 AM

I correct that

Hamid Narimani

09/03/2021, 7:58 AM

Now I see it going to Sign in with Google page

Hamid Narimani

09/03/2021, 7:59 AM

When I choose my id it says

Hamid Narimani

09/03/2021, 7:59 AM

Copy code

{
  "title": "Not Found",
  "status": 404,
  "detail": "404 NOT_FOUND \"User is not registered\"",
  "traceId": "361874644453adf6"
}

Hamid Narimani

09/03/2021, 8:01 AM

I do create users with curl command and Map a User in the Identity Provider to the Organization

Hamid Narimani

09/03/2021, 8:02 AM

Copy code

curl --request POST \
 --header "Authorization: Bearer $GDC_API_TOKEN" \
 --header 'Content-Type: application/vnd.gooddata.api+json' \
 --data '{
   "data": {
    "id": "Atheer",
    "type": "user",
    "attributes": {
     "authenticationId": "<mailto:hnarimani@atheerair.com|hnarimani@atheerair.com>"
    },
    "relationships": {
     "userGroups": {
      "data": [ {
       "id": "adminGroup",
       "type": "userGroup"
      } ]
     }
    }
   }
}' <https://gooddata.atheer.dev/api/entities/users>
{"detail":"Entity of ID 'StockId(apiId=Atheer, scope=OrganizationScope(organization=alpha))' is already stored in database.","status":400,"title":"Bad Request","traceId":"449837b6e90b5e3c"}%

Hamid Narimani

09/03/2021, 8:04 AM

Copy code

<https://gooddata.atheer.dev/appLogin?redirectTo=%2F>

Hamid Narimani

09/03/2021, 8:04 AM

Copy code

{
  "title": "Not Found",
  "status": 404,
  "detail": "404 NOT_FOUND \"User is not registered\"",
  "traceId": "9d02460143404c3a"
}

Robert Moucha

09/03/2021, 8:55 AM

authenticationId needs to be set to the value of "sub" claim of your authentication provider. In case of google, you may use People API to get google's unique user Id

Robert Moucha

09/03/2021, 8:55 AM

see https://developers.google.com/people/api/rest/v1/people/listDirectoryPeople

Robert Moucha

09/03/2021, 8:58 AM

If you want to get your own id, use

people.get

method and set resourceName to

people/me

🙌 1

Hamid Narimani

09/03/2021, 9:25 AM

Thank You, Finally works

Robert Moucha

09/03/2021, 9:42 AM

Great, glad to help.

Open in Slack

Previous Next