Enabling console and flow detector without ingress using config map

[ewassef]

Hello everyone,
I scoured the documentation and used the CLI and the configmap to try to create a the skupper console without an ingress with flow detector enabled. However, I cannot for the life of me figure it out.

We are putting this console BEHIND a proxy (using Teleport in this case) so we dont want to secure it nor put it in a load balancer.
How can i do that?

Any help would be appreciated

[ajssmith]

Hi,
The console relies on the ingress to hit the api when launched from the collector. We should be able to document steps to serve up the console separately. Will provide an update when we have something to try.

[pwright]

@ewassef Maybe you just need to skupper init --console-ingress none as per https://skupper.io/docs/cli-reference/skupper_init.html ?

[kronotheone]

Maybe related, I'm struggling to activate the console in combination with ingress: loadbalancer
Working on Openshift 4.10, I have tried both skupper CLI and the operator.

My ConfigMap when using the operator:

kind: ConfigMap
apiVersion: v1
metadata:
name: skupper-site
data:
console: 'true'
console-authentication: openshift
console-password: ''
console-user: ''
console-ingress: none
flow-collector: "true"
ingress: loadbalancer
controller-load-balancer-ip: ***
router-load-balancer-ip: ***
router-console: "false"
router-logging: ""
router-mode: interior
service-controller: "true"
service-sync: "true"

The generated token has the IP as expected, I can connect from another site using the token.
But when I create the skupper site using ingress: loadbalancer, there is no route available to the console.
I have tried different options for console-ingress, (route/none), but I can 't figure out on how to reach the console.
Any suggestions?

When using ConfigMap with only the 5 first parameters related to console, a route is created and console is reachable with OpenShift auth.

[grs]

The console url that skupper believes to be correct is shown when you run skupper status. If you have console-ingress=none however then the console is not exposed outside the cluster and you would need to use port forwarding or some other means of accessing it. If you want the console to use an openshift route, then console-ingress=route is the right option. However at present that change does not get made automatically, you would need to delete the skupper site and recreate. If you leave the console-ingress option unspecified you will get the option used for the main ingress option.

[kronotheone]

Hi

Yes, for each test, I delete the skupper site and then apply the ConfigMap.

Results from 2 tests based on the ConfigMap above:

1. console-ingress: ''

no route has been created

skupper status
Skupper is enabled for namespace "namespace" in interior mode. It is not connected to any other sites. It has no exposed services.

skupper token create ./test1.token
From token:
skupper.io/url: https://IP_FROM_CONFIGMAP:8081/01b32867-ee5b-11ed-89a0-000c29d008f6

2. console-ingress: route

no route has been created

skupper status
Skupper is enabled for namespace "namespace" in interior mode. It is not connected to any other sites. It has no exposed services.

skupper token create ./test2.token
Token written to ./test2.token (Note: token will only be valid for local cluster)
From token:
skupper.io/url: https://skupper.namespace:8081/ad4b1ffa-ee5b-11ed-84e2-000c29d008f6

So when using 'ingress: loadbalancer' in combination with 'console-ingress: route'

I'm getting no route
Skupper URL is not generated with the correct IP in the token

Should I change other parameters?

[grs]

With console-ingress:'', no route is expected to be created. However I would expect with the other settings that the skupper service would be a loadbalancer service. Is that what you see in that case? If not, are the creation times on the skupper services as expected?

With console-ingress:route, a route is expected. It looks like it is using a url valid only within the cluster (which should only be the case if console-ingress:none). What version of skupper are you using? Does skupper debug events show any errors that look relevant?

[kronotheone]

Hi

Yes I showed the test with console-ingress:'' to show the difference in skupper.io/url:

I've verified after each skupper delete that all releated services were deleted.
After creation with console-ingress:route the skupper service has no loadbalancer ingress IP as expected, only ClusterIP.

The Openshift skupper operator is 1.2.2 provided by Red Hat

SiteQueryError ```
Failed to get site url: routes.route.openshift.io
"skupper-inter-router" not found

[grs]

Can you get the logs for the skupper-site-controller pod? (In namespace skupper-site-controller normally)

[kronotheone]

2023/05/09 11:39:57 Skupper site controller watching current namespace namespace
2023/05/09 11:39:57 Version: 1.2.0-redhat-1.1.0-2
2023/05/09 11:39:57 Starting the Skupper site controller informers
2023/05/09 11:39:57 Waiting for informer caches to sync
2023/05/09 11:39:57 Checking if sites need updates (1.2.0-redhat-1.1.0-2)
2023/05/09 11:39:57 Updated version for namespace "namespace"
2023/05/09 11:39:57 Starting workers
2023/05/09 11:39:57 Started workers
2023/05/09 11:39:58 Skupper site exists namespace/skupper-site
2023/05/09 11:39:58 Checking token requests...
2023/05/09 11:39:58 Done.
2023/05/09 13:52:56 Initialising skupper site ...
Waiting 117 seconds for LoadBalancer IP or hostname...
2023/05/09 13:53:00 Skupper site initialised
2023/05/09 13:53:00 Checking token requests...
2023/05/09 13:53:00 Done.

[grs]

@kronotheone sorry, this is indeed a bug. I have raised a distinct issue for it for clarity: #1104

[kronotheone]

Hi, thanks for the follow-up on this!