helm: hubble-ui.ingress.path is not working with Hubble UI

[Hokwang]

Hi,

I am using cilium helm chart for install cilium.

I found several issues.

1. in the hubble-relay chart.
   I need to set --disable-client-tls and --disable-server-tls in args like below. but now there's no way to do this.

      containers:
      - args:
        - serve
        - --peer-service=unix:///var/run/cilium/hubble.sock
        - --listen-address=:4245
        - --disable-client-tls
        - --disable-server-tls

2. which container repo is the main?
   I can find cilium/hubble-relay in hub.docker.com but can't find it in quay.io
   and can find cillium/hubble-ui in quay.io but can'find it in hub.docker.com
   so now my values.yaml is

hubble-relay:
  image:
    repository: cilium/hubble-relay
    tag: v1.8.3

hubble-ui:
  image:
    repository: quay.io/cilium/hubble-ui
    tag: v0.6.1

3. I want to use ingress and sub path with hubble-ui.
   for example,

hubble-ui:
  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
    path: /hubble
    hosts:
      - my.company.net

The reason why I am using sub path is because of getting sub domain is little bit difficult in on-premise enterprise env.
but I have no luck to do this. I tried to use rewrite annotations but failed.

[gandro]

Hi, thanks for the feedback!

1. (m)TLS support for Hubble Relay will only be available on the upcoming Cilium 1.9. It seems you are using Cilium 1.8, where (m)TLS on Hubble Relay is not supported. Per our policy to only back-port bug fixes, we decided against back-porting (m)TLS to Hubble Relay 1.8, as it it a feature and not a bug fix. The documentation for the Helm values to disable (m)TLS on Cilium 1.9 is still pending, as Cilium 1.9 has not been released yet.

2. Yes, hubble-ui is currently not available on docker.io. This is because it is released independently and is not built from this repository as part of the Cilium release process. This is something we will address, and we will provide the the hubble-ui images on DockerHub as well! All other images are already available on both quay.io and docker.io and you may whatever registry you prefer.

Regarding 3: Unfortunately, without much context it is not clear what does not work with your ingress setup. Using a sub path is not something we have tested or supported so far, so you will need to provide us with more details on what's not working.

[Hokwang]

Hi,
by the way, I saw little big changes in hubble-ui shub chart.
I am using v0.6.1 so if v0.7.1 has no problem about item3, you can close this issue.

here's more info for item3.
when I use myvalues.yaml

hubble-ui:
  image:
    repository: quay.io/cilium/hubble-ui
    tag: v0.6.1
  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
    path: /hubble
    hosts:
      - company.net

and trying below code, but didn't work. and can't find the solution.

    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/rewrite-target: /$2
      nginx.ingress.kubernetes.io/configuration-snippet: |
        rewrite ^(/hubble)$ /hubble/ permanent;
    paths:
      - /hubble(/|$)(.*)

(I am using nginx-ingress.)

[Hokwang]

@gandro @qmonnet I add more info. please check this.

[gandro]

@Hokwang Thanks. From what it seems, Hubble UI simply does not support subpath right now. The frontend code running in the browser seems to assume it is running in /.

I think we should remove the path option from the Helm Chart in that case, I think when it was added it was using a default template.

PRs to make the UI support subpaths are of course welcome. @geakstr @yandzee Any thoughts on this?

[Hokwang]

@gandro Oh, if then, please consider that provide this, and think this issue is Feature Proposal.. removing path is not good solution. I don't want it.

[geakstr]

Moved to cilium/hubble-ui#154