add nginx configurations for the odf-console #305

SanjalKatiyar · 2023-03-21T06:00:12Z

Changes required as per BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2139785

Resolves 4 issues:

BZ#2139785 itself: where on disabling ipv6 address on the cluster nodes, odf-console pod was resulting in error state (https://bugzilla.redhat.com/show_bug.cgi?id=2139785#c10)
There was CVE issue raised by IBM team where port 8080 was stated to be an insure port (https://bugzilla.redhat.com/show_bug.cgi?id=2166417). Port 8080 is present by default in the nginx configuration that we use for our pod (under /etc/nginx/nginx.conf: https://pastebin.com/ksX21dsr) and we did not had any control over that config earlier. Now all the nginx configurations (nginx's default and custom config for odf-console) are added via a ConfigMap created by odf-operator, so everything is under our control.
Also, now removed the port 8080 which was never needed and never used.
Earlier nginx configurations were added during build time, now they are added and can be easily updated during runtime.

There is one more CVE issue as per which we need to add readOnlyRootFilesystem: true spec for the odf-console pod, but on adding it is causing the UI's pod to go into an error state because nginx needs to create some files in pod's filesystem for its functioning but don't have access to do so (if we set this attribute), hence pod is never getting into "Running" status.
This PR adds the foundation for enabling us to be able to add the changes to fix this CVE (will send a follow-up PR for that).

Possible improvement ?

Currently for BZ#2139785 (if this PR gets merged), once odf-console pod errors due to ipv6 address issue, user will have to perform following operations (we will keep documentation team in loop):

Go to ConfigMap: odf-console-nginx-conf (introduced as part of this PR).
Comment out line listen [::]:9001 ssl; --> # listen [::]:9001 ssl;.
Restart the odf-console pod (just delete it) and Refresh.
Once done they will be able to see the UI once again as the pod will now be in running state.

We can automate this process so that user don;t have to take manual steps to resolve the issue.

Pro: no manual intervention needed.
Cons:

Not a priority (P0) use-case or something which is generally faced by users (rare).
odf-operator will need to introduce new a controller to keep a watch on resources which has nothing to do with ODF or storage, but are purely infra related.
This BZ is different from IPv4/IPv6 dual-stack networking where we can just watch over network.config.openshift.io cluster CR (https://docs.openshift.com/container-platform/4.12/networking/ovn_kubernetes_network_provider/converting-to-dual-stack.html)...
here we are disabling ipv6 addressing on the node's kernel level (https://access.redhat.com/solutions/5513111)... not sure if it is good idea to keep a watch for such changes.

odf-console uses nginx for serving the UI assests. Add its configuration from the operator instead of build time. Signed-off-by: SanjalKatiyar <sanjaldhir@gmail.com>

generated output of "make bundle" command. Signed-off-by: SanjalKatiyar <sanjaldhir@gmail.com>

SanjalKatiyar · 2023-03-21T06:43:10Z

console/nginx_conf.go

+worker_processes auto;
+error_log /var/log/nginx/error.log;
+pid /run/nginx.pid;
+
+# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
+include /usr/share/nginx/modules/*.conf;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile            on;
+    tcp_nopush          on;
+    tcp_nodelay         on;
+    keepalive_timeout   65;
+    types_hash_max_size 4096;
+
+    include             /etc/nginx/mime.types;
+    default_type        application/octet-stream;
+
+    # Load modular configuration files from the /etc/nginx/conf.d directory.
+    # See http://nginx.org/en/docs/ngx_core_module.html#include
+    # for more information.
+    include /opt/app-root/etc/nginx.d/*.conf;


these are the default nginx configurations, these were used earlier as well (before the changes introduced by this PR): https://pastebin.com/ksX21dsr

check above link for entire configuration file that was used...

SanjalKatiyar · 2023-03-21T06:43:52Z

console/nginx_conf.go

+    server {
+        listen       9001 ssl;
+        listen       [::]:9001 ssl;
+        ssl_certificate /var/serving-cert/tls.crt;
+        ssl_certificate_key /var/serving-cert/tls.key;
+        location / {
+            root   /opt/app-root/src;
+        }
+        location /compatibility/ {
+            root   /opt/app-root/src;
+        }
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/html;
+        }
+        ssi on;
+        add_header Last-Modified $date_gmt;
+        add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+        if_modified_since off;
+        expires off;
+        etag off;
+    }


odf-console related custom configurations...

@SanjalKatiyar I see that this is the same config (server section) that we have in the plugin repo, so we should ensure both remain in sync, right?

we will eventually remove it from odf-console and add them from here...

no need to read default.conf during build after this PR (we need small change in build Dockerfile as well)...

SanjalKatiyar · 2023-03-21T08:39:11Z

/test odf-operator-e2e-aws

iamniting · 2023-03-21T09:22:44Z

/test odf-operator-e2e-aws

I know the problem, I will get it fixed once #304 is merged

iamniting · 2023-03-21T15:38:40Z

/test odf-operator-e2e-aws

iamniting · 2023-03-22T05:54:45Z

/test odf-operator-e2e-aws

SanjalKatiyar · 2023-03-23T05:41:12Z

Need to update build Dockerfile once this is merged...

SanjalKatiyar · 2023-03-28T06:02:57Z

@bipuladh PTAL.

alfonsomthd · 2023-03-28T09:13:57Z

/approve

alfonsomthd · 2023-03-28T09:21:27Z

/lgtm

bipuladh

/lgtm

bipuladh · 2023-03-28T10:05:06Z

/assign @iamniting

SanjalKatiyar · 2023-03-28T10:06:10Z

/cherrypick release-4.13

openshift-cherrypick-robot · 2023-03-28T10:06:12Z

@SanjalKatiyar: once the present PR merges, I will cherry-pick it on top of release-4.13 in a new PR and assign it to you.

In response to this:

/cherrypick release-4.13

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-03-28T10:08:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alfonsomthd, bipuladh, iamniting, SanjalKatiyar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [iamniting]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-cherrypick-robot · 2023-03-28T10:14:49Z

@SanjalKatiyar: new pull request created: #306

In response to this:

/cherrypick release-4.13

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

SanjalKatiyar added 2 commits March 21, 2023 10:57

console: add ConfigMap for nginx configurations

67ad44d

odf-console uses nginx for serving the UI assests. Add its configuration from the operator instead of build time. Signed-off-by: SanjalKatiyar <sanjaldhir@gmail.com>

bundle: update generated changes

4d37a38

generated output of "make bundle" command. Signed-off-by: SanjalKatiyar <sanjaldhir@gmail.com>

SanjalKatiyar commented Mar 21, 2023

View reviewed changes

openshift-ci bot assigned alfonsomthd Mar 28, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 28, 2023

bipuladh approved these changes Mar 28, 2023

View reviewed changes

openshift-ci bot assigned bipuladh Mar 28, 2023

openshift-ci bot assigned iamniting Mar 28, 2023

iamniting approved these changes Mar 28, 2023

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 28, 2023

openshift-merge-robot merged commit 6fca0b9 into red-hat-storage:main Mar 28, 2023
33 checks passed

openshift-cherrypick-robot mentioned this pull request Mar 28, 2023

Bug 2139785:[release-4.13] add nginx configurations for the odf-console #306

Merged

SanjalKatiyar mentioned this pull request Mar 29, 2023

[tech-debt] Remove usage of "default.conf" file red-hat-storage/odf-console#745

Open

SanjalKatiyar deleted the nginx_conf branch April 4, 2023 11:17

SanjalKatiyar mentioned this pull request Apr 25, 2023

add nginx configurations for the mco-console red-hat-storage/odf-multicluster-orchestrator#170

Open

add nginx configurations for the odf-console #305

add nginx configurations for the odf-console #305

SanjalKatiyar commented Mar 21, 2023 •

edited

SanjalKatiyar Mar 21, 2023

SanjalKatiyar Mar 21, 2023

SanjalKatiyar Mar 21, 2023

alfonsomthd Mar 28, 2023 •

edited

SanjalKatiyar Mar 28, 2023

SanjalKatiyar Mar 28, 2023

SanjalKatiyar commented Mar 21, 2023

iamniting commented Mar 21, 2023

iamniting commented Mar 21, 2023

iamniting commented Mar 22, 2023

SanjalKatiyar commented Mar 23, 2023

SanjalKatiyar commented Mar 28, 2023

alfonsomthd commented Mar 28, 2023

alfonsomthd commented Mar 28, 2023

bipuladh left a comment

bipuladh commented Mar 28, 2023

SanjalKatiyar commented Mar 28, 2023

openshift-cherrypick-robot commented Mar 28, 2023

openshift-ci bot commented Mar 28, 2023

openshift-cherrypick-robot commented Mar 28, 2023

add nginx configurations for the odf-console #305

add nginx configurations for the odf-console #305

Conversation

SanjalKatiyar commented Mar 21, 2023 • edited

Resolves 4 issues:

Possible improvement ?

SanjalKatiyar Mar 21, 2023

Choose a reason for hiding this comment

SanjalKatiyar Mar 21, 2023

Choose a reason for hiding this comment

SanjalKatiyar Mar 21, 2023

Choose a reason for hiding this comment

alfonsomthd Mar 28, 2023 • edited

Choose a reason for hiding this comment

SanjalKatiyar Mar 28, 2023

Choose a reason for hiding this comment

SanjalKatiyar Mar 28, 2023

Choose a reason for hiding this comment

SanjalKatiyar commented Mar 21, 2023

iamniting commented Mar 21, 2023

iamniting commented Mar 21, 2023

iamniting commented Mar 22, 2023

SanjalKatiyar commented Mar 23, 2023

SanjalKatiyar commented Mar 28, 2023

alfonsomthd commented Mar 28, 2023

alfonsomthd commented Mar 28, 2023

bipuladh left a comment

Choose a reason for hiding this comment

bipuladh commented Mar 28, 2023

SanjalKatiyar commented Mar 28, 2023

openshift-cherrypick-robot commented Mar 28, 2023

openshift-ci bot commented Mar 28, 2023

openshift-cherrypick-robot commented Mar 28, 2023

SanjalKatiyar commented Mar 21, 2023 •

edited

alfonsomthd Mar 28, 2023 •

edited