Exposing: Pulp 3 apache config issue #402

fao89 · 2020-08-20T18:39:10Z

[noissue]

fao89 · 2020-08-20T18:39:58Z

roles/pulp_webserver/templates/pulp-vhost.conf.j2

+  ProxyPass /pulp/api/v3 http://${pulp-api}/pulp/api/v3
+  ProxyPassReverse /pulp/api/v3 http://${pulp-api}/pulp/api/v3


pulp2 requests were falling here /pulp/api/v2

this change fixes the problem

@bmbouter @dkliban this is the first issue, easy to fix!

fao89 · 2020-08-20T18:40:18Z

roles/pulp_webserver/templates/pulp-vhost.conf.j2

+  #ProxyPass / http://${pulp-api}/
+  #ProxyPassReverse / http://${pulp-api}/


pulp2 requests were falling here /pulp/api/v2

it would fix, but how we would address the static files?

@bmbouter @dkliban this is the second issue, it depends on relying on whitenoise, not so easy to fix

The recent testing showed that if a more specific rule were present that it would take precedence over this rule. So I don't think this line being here is the actual root cause of the issue.

Current config:
Request for pulp2: /pulp/api/v2 would fall on (1)

ProxyPass /pulp/api http://${pulp-api}/pulp/api ProxyPassReverse /pulp/api http://${pulp-api}/pulp/api

ProxyPass /auth/login/ http://${pulp-api}/auth/login/ ProxyPassReverse /auth/login/ http://${pulp-api}/auth/login/

ProxyPass /pulp/content http://${pulp-content}/pulp/content ProxyPassReverse /pulp/content http://${pulp-content}/pulp/content

ProxyPass / http://${pulp-api}/ ProxyPassReverse / http://${pulp-api}/

Addressing (1), Request for pulp2: /pulp/api/v2 would fall on (4)

ProxyPass /pulp/api/v3 http://${pulp-api}/pulp/api/v3 ProxyPassReverse /pulp/api/v3 http://${pulp-api}/pulp/api/v3

ProxyPass /auth/login/ http://${pulp-api}/auth/login/ ProxyPassReverse /auth/login/ http://${pulp-api}/auth/login/

ProxyPass /pulp/content http://${pulp-content}/pulp/content ProxyPassReverse /pulp/content http://${pulp-content}/pulp/content

ProxyPass / http://${pulp-api}/ ProxyPassReverse / http://${pulp-api}/

I'm just pointing which rule would match with /pulp/api/v2, in our current config it is (1), fixing (1) it would match rule (4)

I'm still not understanding. If we have a /pulp/api/v3 rule in pulp3 and a /pulp/api/v2/ rule in pulp2, these routes don't seem conflicting. If we have a /pulp/api/v3 in pulp3 and a /pulp/api/ in pulp2 the "specific routes first" matching causes these also to not be conflicting. Similarly, /pulp/api/v2/ in pulp2 and /pulp/api/ in pulp3. Basically I'm not understanding the root cause of the issue or even what the issue is in practice.

actually, the pulp2 config is totally different than the pulp3 one, I'm not sure if we have a /pulp/api/ or /pulp/api/v2 rule there. I posted pulp2 config below here: #402 (comment)
The only pulp/api mention I see is:

WSGIScriptAlias /pulp/api /usr/share/pulp/wsgi/webservices.wsgi

And honestly, I don't know the behavior of WSGIScriptAlias

actually, the pulp2 config is totally different than the pulp3 one, I'm not sure if we have a /pulp/api/ or /pulp/api/v2 rule there. I posted pulp2 config below here: #402 (comment)
The only pulp/api mention I see is:

WSGIScriptAlias /pulp/api /usr/share/pulp/wsgi/webservices.wsgi

And honestly, I don't know the behavior of WSGIScriptAlias

That's ok!

The info you've shared is helpful. Can you describe what the experience the user has that is an issue? What error or incorrect behaviour do they experience? Also how can that be reproduced?

it is here: #402 (comment)
pulp2 requests go to pulp3

fao89 · 2020-08-20T18:43:18Z

(pulp) [vagrant@pulp2-nightly-pulp3-source-centos7 ~]$ pulp-admin login -u admin -p admin
An unexpected error has occurred.More information may be found using the -v
flag.

(pulp) [vagrant@pulp2-nightly-pulp3-source-centos7 ~]$ journalctl -r
Aug 20 18:42:10 pulp2-nightly-pulp3-source-centos7.localhost.example.com gunicorn[14812]: 127.0.0.1 - admin [20/Aug/2020:18:42:10 +0000] "POST /pulp/api/v2/actions/login/ HTTP/1.1" 404 77 "-
Aug 20 18:42:10 pulp2-nightly-pulp3-source-centos7.localhost.example.com gunicorn[14812]: pulp: django.request:WARNING: Not Found: /pulp/api/v2/actions/login/

pulpbot · 2020-08-20T18:43:59Z

WARNING!!! This PR is not attached to an issue. In most cases this is not advisable. Please see our PR docs for more information about how to attach this PR to an issue.

fao89 · 2020-08-20T18:47:33Z

(pulp) [vagrant@pulp2-nightly-pulp3-source-centos7 ~]$ ls /etc/httpd/conf.d/
autoindex.conf  pulp_content.conf  pulp_deb.conf     pulp_ostree.conf  pulp_python.conf  pulp_streamer.conf  README      ssl.conf      welcome.conf
pulp.conf       pulp_crane.conf    pulp_docker.conf  pulp_puppet.conf  pulp_rpm.conf     pulp-vhost.conf     squid.conf  userdir.conf

(pulp) [vagrant@pulp2-nightly-pulp3-source-centos7 ~]$ cat /etc/httpd/conf.d/pulp.conf 
# Apache configuration file for pulp web services and repositories (compatible with >= apache2.4)
#
# Copyright © 2010 Red Hat, Inc.
#
# This software is licensed to you under the GNU General Public License,
# version 2 (GPLv2). There is NO WARRANTY for this software, express or
# implied, including the implied warranties of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
# along with this software; if not, see
# http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
#
# Red Hat trademarks are not licensed under GPLv2. No permission is
# granted to use or replicate Red Hat trademarks that are incorporated
# in this software or its documentation.

AddType application/x-pkcs7-crl .crl
AddType application/x-x509-ca-cert .crt

# Example ssl cert and key files to get you started.
# This MUST match /etc/pulp/server.conf [security] 'cacert'.
SSLCACertificateFile /etc/pki/pulp/ca.crt

# allow older yum clients to connect, see bz 647828
SSLInsecureRenegotiation on

WSGIProcessGroup pulp
WSGIApplicationGroup pulp
WSGIDaemonProcess pulp user=apache group=apache processes=3 display-name=%{GROUP}

# DEBUG - uncomment the next 2 lines to enable debugging
#WSGIRestrictStdin Off
#WSGIRestrictStdout Off

WSGISocketPrefix run/wsgi
WSGIScriptAlias /pulp/api /usr/share/pulp/wsgi/webservices.wsgi
WSGIImportScript /usr/share/pulp/wsgi/webservices.wsgi process-group=pulp application-group=pulp

<Directory /usr/share/pulp/wsgi>
    Require all granted
</Directory>

<Files webservices.wsgi>
    WSGIPassAuthorization On
    WSGIProcessGroup pulp
    WSGIApplicationGroup pulp
    SSLRenegBufferSize  1048576
    SSLRequireSSL
    SSLVerifyDepth 3
    SSLOptions +StdEnvVars +ExportCertData
    SSLVerifyClient optional
</Files>

<VirtualHost *:80>
    IncludeOptional /etc/pulp/vhosts80/*.conf
</VirtualHost>


Alias /pulp/static /var/lib/pulp/static

<Location /pulp/static>
    SSLRequireSSL
    Options +Indexes
    Require all granted
</Location>


# Change the maximum number of times a TCP connection can be reused for HTTP
# requests from 100 (the default) to 10,000 when HTTP Keep-Alive is enabled.
# Note that when Keep-Alive requests are made, only the first request (the 
# one that opened the connection) counts when calculating the 
# MaxRequestsPerChild value. See Apache's documentation for more information.
#
# This configuration does mean it is cheaper for clients to make many
# requests, so it does increase the server's susceptibility to denial of
# service attacks. If this is a concern, consider lowering the value.
#
# If, on the other hand, DoS attacks are not a concern, consider setting this
# to 0 (unlimited re-use) and potentially tweaking `KeepAliveTimeout`.
MaxKeepAliveRequests 10000


# Authentication
#
# If you want to authenticate against an external source, the best approach is
# to use an apache authentication plugin. Most deployments will only use a
# third-party authentication source for the login call, and then use pulp's
# certificate-based auth for successive calls. It is, however, possible to use
# an apache authentication plugin for the entire REST API.
#
# You are responsible for ensuring that a user gets created in pulp prior to
# any login attempt. Pulp does not support auto-creation of users that exist in
# your external source.
#
# Below is a "basic" example that works for demos, but a stronger mechanism is
# recommended. The .htaccess file must be created using the "htpasswd" command.

#<Location /pulp/api/v2/actions/login>
#    AuthType Basic
#    AuthName "Pulp Login"
#    AuthUserFile /var/lib/pulp/.htaccess
#    Require valid-user
#</Location>

fao89 · 2020-09-15T13:17:39Z

Issue filed: https://pulp.plan.io/issues/7481

Pulp 3 apache config

34c398b

[noissue]

fao89 commented Aug 20, 2020

View reviewed changes

fao89 requested a review from mikedep333 August 20, 2020 18:40

fao89 requested a review from a team August 20, 2020 18:53

fao89 added bug help wanted WorkInProgress labels Aug 20, 2020

fao89 changed the title ~~Pulp 3 apache config~~ Exposing: Pulp 3 apache config issue Sep 4, 2020

fao89 closed this Sep 15, 2020

Exposing: Pulp 3 apache config issue #402

Exposing: Pulp 3 apache config issue #402

fao89 commented Aug 20, 2020

fao89 Aug 20, 2020 •

edited

fao89 Sep 9, 2020

fao89 Sep 22, 2020

fao89 Aug 20, 2020 •

edited

fao89 Sep 9, 2020

fao89 Sep 22, 2020

bmbouter Sep 24, 2020

fao89 Sep 24, 2020

fao89 Sep 25, 2020

bmbouter Sep 25, 2020

fao89 Sep 25, 2020 •

edited

bmbouter Sep 25, 2020

fao89 Sep 25, 2020

fao89 commented Aug 20, 2020

pulpbot commented Aug 20, 2020

fao89 commented Aug 20, 2020

fao89 commented Sep 15, 2020

		ProxyPass /pulp/api/v3 http://${pulp-api}/pulp/api/v3
		ProxyPassReverse /pulp/api/v3 http://${pulp-api}/pulp/api/v3

		#ProxyPass / http://${pulp-api}/
		#ProxyPassReverse / http://${pulp-api}/

Exposing: Pulp 3 apache config issue #402

Exposing: Pulp 3 apache config issue #402

Conversation

fao89 commented Aug 20, 2020

fao89 Aug 20, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fao89 Aug 20, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fao89 Sep 25, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fao89 commented Aug 20, 2020

pulpbot commented Aug 20, 2020

fao89 commented Aug 20, 2020

fao89 commented Sep 15, 2020

fao89 Aug 20, 2020 •

edited

fao89 Aug 20, 2020 •

edited

fao89 Sep 25, 2020 •

edited