Access Kubernetes Dashboard Via HTTP Instead of HTTPS

kubernetesmicrok8s

Question

How can I enable HTTP requests? I have a primary web server that is a proxy and sends HTTP requests to the MicroK8S server but cannot due to the HTTP error.

Install command used:

sudo snap install microk8s --classic --channel=1.23/stable

Infrastructure

Self-Hosted on a virtual machine locally

Problem

I have a MicroK8S server setup using this command: microk8s enable dashboard dns registry istio

I have also edited the dashboard service as such (replaced clusterip with nodeport)

kubernetes-dashboard service

Result

I can navigate to the kubernetes-dashboard by going to https://IP:30051/ of the server (yes, requests using SSL work). However if I try to use HTTP instead of HTTPS I get the following error message.

Client sent an HTTP request to an HTTPS server.

Best Answer

Answered in Slack, the default addon doesn't pass --insecure-bind-address so the insecure port is accessible only on localhost: https://github.com/kubernetes/kubernetes/blob/b5103f61175a10d6b066eeb3ef603263f9b61bd4/cluster/addons/dashboard/dashboard.yaml#L195-L196

You can find all options documented here: https://github.com/kubernetes/dashboard/blob/1148f7ba9f9eadd719e53fa3bc8bde5b7cfdb395/docs/common/dashboard-arguments.md#arguments

If you add --insecure-bind-address=0.0.0.0 to the CLI options and switch your service to port 9090 then you can use HTTP instead.

But also just don't do this, it's a bad and unsafe idea.

Related Solutions

MicroK8S Helm – Error: Could Not Find a Ready Tiller Pod

All was need is:

helm repo update

The full set of commands here :

# Ensure there disk space to install all
sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo dpkg-reconfigure tzdata
sudo snap remove lxc
sudo snap remove lxd
sudo apt-get remove --purge lxc 
sudo apt-get remove --purge lxd 
sudo apt-get autoremove
# can throw error, ensure each purgue/uninstall above
sudo apt-add-repository ppa:ubuntu-lxc/stable
sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get install tmux lxc lxd zfsutils-linux 
df -h => 84% Free, 32G
{ SNAPSHOT - beforeLxdInit }
lxd init
    ipv6:none
ifconfig | grep flags
sudo sysctl -w net.ipv6.conf.ens33.disable_ipv6=1  
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1  
sudo sysctl -w net.ipv6.conf.lxcbr0.disable_ipv6=1  
sudo sysctl -w net.ipv6.conf.lxdbr0.disable_ipv6=1  
time sudo snap install conjure-up --classic
{ SNAPSHOT - beforeConjureUp }
conjure-up => CHOICE = { microk8s }
alias kubectl='microk8s.kubectl'
#------------------------------------
# not necessary enable all but its a test
microk8s.enable storage
microk8s.enable registry    
microk8s.enable dns dashboard ingress istio metrics-server prometheus fluentd jaeger
#------------------------------------
time sudo snap install helm --classic
helm init
kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
helm search
# Before update the repo it throw an error:
helm version
    Error: could not find a ready tiller pod 
# Then update the repo:
helm repo update
# After update the repo it was OK:
helm version
    Client: &version.Version { 
            SemVer:"v2.13.0", 
            GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6",
            GitTreeState:"clean"
        }
    Server: &version.Version { 
            SemVer:"v2.13.0", 
            GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", 
            GitTreeState:"clean" 
        }
#------------------------------------
helm install stable/mysql
df -h | grep sda {
    Filesystem:/dev/sda2,
    Size:40G,  
    Used:12G,  
    Avail:26G, 
    Use%:31% 
    Mounted-on:/
    }
{ SNAPSHOT - afterFixErrorBeforeEclipseChe }
#------------------------------------
========================================================================================================================
# Looks like it added a messy OverlayFS
df -h
    Filesystem      Size  Used Avail Use% Mounted on
    udev            1.9G     0  1.9G   0% /dev
    tmpfs           393M  2.5M  390M   1% /run
    /dev/sda2        40G   12G   26G  31% /
    tmpfs           2.0G     0  2.0G   0% /dev/shm
    tmpfs           5.0M     0  5.0M   0% /run/lock
    tmpfs           2.0G     0  2.0G   0% /sys/fs/cgroup
    /dev/loop0       91M   91M     0 100% /snap/core/6350
    tmpfs           393M     0  393M   0% /run/user/1000
    tmpfs           100K     0  100K   0% /var/lib/lxd/shmounts
    tmpfs           100K     0  100K   0% /var/lib/lxd/devlxd
    /dev/loop1      110M  110M     0 100% /snap/conjure-up/1045
    /dev/loop2      205M  205M     0 100% /snap/microk8s/492
    shm              64M     0   64M   0% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M     0   64M   0% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M     0   64M   0% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M     0   64M   0% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M     0   64M   0% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M     0   64M   0% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M  4.7M   60M   8% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
    shm              64M  4.7M   60M   8% /var/snap/microk8s/common/run/containerd/io.containerd.grpc.v1.cri/sandboxes$
    overlay          40G   12G   26G  31% /var/snap/microk8s/common/run/containerd/io.containerd.runtime.v1.linux/k8s.$
========================================================================================================================

kubectl run eclipseche --image=eclipse/che-server:nightly
    deployment.apps/eclipseche2 created
    ------------------------------------
    # Cant found a way to follow the advise below, cant find the equivalent syntax
    kubectl run --generator=deployment/apps.v1 
    is DEPRECATED and will be removed in a future version. 
    Use 
    kubectl run --generator=run-pod/v1 
    or 
    kubectl create instead

kubectl get pods
    NAME                                      READY   STATUS    RESTARTS   AGE
    brown-hyena-mysql-75f584d69d-rbfv4        1/1     Running   0          72m
    default-http-backend-5769f6bc66-z7jb4     1/1     Running   0          91m
    eclipseche-589954dc99-d4bxm               1/1     Running   0          6m13s
    nginx-ingress-microk8s-controller-p88nm   1/1     Running   0          91m

kubectl get svc
    NAME                   TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
    brown-hyena-mysql      ClusterIP   10.152.184.38   <none>        3306/TCP   74m
    default-http-backend   ClusterIP   10.152.184.99   <none>        80/TCP     93m
    kubernetes             ClusterIP   10.152.184.1    <none>        443/TCP    99m

microk8s.kubectl describe pod eclipseche-589954dc99-d4bxm | grep "IP:"
    IP:  10.1.1.54

sudo apt-get install net-tools nmap

nmap 10.1.1.54 | grep open
    8080/tcp open  http-proxy

Istio : HTTPS Traffic converted to HTTP with port set as 443

Have you tried updating the VirtualService to set X-Forwarded-Proto?, like below:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: sp-vs
spec:
  hosts:
  - "sarath.somedomain.com"
  gateways:
  - sarath-gateway
  http:
    - headers:
        request:
          set:
            X-Forwarded-Proto: https
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        port:
          number: 80
        host: javaapp-svc

I believe this should give you the behavior you expect

Best Answer

Related Solutions

MicroK8S Helm – Error: Could Not Find a Ready Tiller Pod

Istio : HTTPS Traffic converted to HTTP with port set as 443

Related Topic