nginx readiness probe doesn't work under istio

[R0GG]

Hello,

It seems that the readiness probe of nginx does not work under istio because nginx proxy forwards the Host header (proxy_set_header Host $host;) of curl which is 127.0.0.1 (or the pod IP).

As this is an HTTP request, it goes through envoy router which routes the requests based on the HOST http header (in our case is 127.0.0.1). Envoy then fails to match any routes with 127.0.0.1 as HOST header.

A possible fix could be to remove proxy_set_header Host $host; and in the nginx conf something like bellow so that the url match the name of the k8s service.

upstream {{ template "harbor.portal" . }} {
  server {{ template "harbor.portal" . }};
}

location / {
  proxy_pass http://{{ template "harbor.portal" . }}/;
}

related: #406

[R0GG]

update I got it working without the changes of the NGINX conf

Mainly after fixing the NGINX conf with the changes above, you won't be able to issue a docker login because the core-server also redirect the HOST http header.

So i had to create EnvoyFilters (not optimal I think):

---
apiVersion: networking.istio.io/v1alpha3
kind:
metadata:
  name: harbor-portal
  namespace: harbor
spec:
  workloadSelector:
    labels:
      app: harbor
  configPatches:
  - applyTo: VIRTUAL_HOST
    context: ANY
    match:
      routeConfiguration:
        name: "harbor-harbor-portal.harbor.svc.cluster.local:80"
    patch:
      operation: MERGE
      value:
        domains:
          - "*"

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: harbor-core-registry-5000
  namespace: harbor
spec:
  workloadSelector:
    labels:
      app: harbor
  configPatches:
  - applyTo: VIRTUAL_HOST
    context: ANY
    match:
      routeConfiguration:
        name: "harbor-harbor-registry.harbor.svc.cluster.local:5000"
    patch:
      operation: MERGE
      value:
        domains:
          - "*"

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: harbor-core
  namespace: harbor
spec:
  workloadSelector:
    labels:
      app: harbor
  configPatches:
  - applyTo: VIRTUAL_HOST
    context: ANY
    match:
      routeConfiguration:
        name: "harbor-harbor-core.harbor.svc.cluster.local:80"
    patch:
      operation: MERGE
      value:
        domains:
          - "*"

[reasonerjt]

I personally don't have experience using Istio, and I don't think this chart has been verified on Istio.

Let me keep this open for reference and comment by other istio users.

[jabbors]

A better solution would be to just exclude the nginx deployment and use the workaround in https://github.com/goharbor/harbor/issues/11906.

[github-actions[bot]]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 30 days with no activity. If this issue is still relevant, please re-open a new issue.