fix: WPB-25750 update multi-ingress documentation - #117
mohitrajain wants to merge 5 commits into
Conversation
| settings: | ||
| conversationCodeURI: https://accounts.green.example.org/conversation-join/ | ||
| conversationCodeURI: https://account.green.example.org/conversation-join/ | ||
| multiIngress: | ||
| red.example.com: https://accounts.red.example.com/conversation-join/ | ||
| blue.example.net: https://accounts.blue.example.net/conversation-join/ | ||
| red.example.com: https://account.red.example.com/conversation-join/ | ||
| blue.example.net: https://account.blue.example.net/conversation-join/ | ||
| ``` | ||
| Note: `settings.multiIngress` and `settings.conversationCodeURI` are mutually exclusive. |
There was a problem hiding this comment.
The indentation of multiIngress doesn't seem to be correct. See https://github.com/wireapp/wire-server/blob/de23b558e4130d111c96ce2d5bf9529cafdb5b02/charts/wire-server/values.yaml#L99-L112
The Note is correct, so this is probably working by accident, because multiIngress defaults to null.
| ### Patch the CSP (Content security policy) for each multi-ingress domain | ||
|
|
||
| When the Webapp is used with multi-ingress calling, the ingress CSP configuration must explicitly allow the corresponding Calling endpoint (SFT_DOMAIN). | ||
| This update ensures that the browser accepts resources and connections required for calling functionality. The same need to be repeated for each multi-ingress domain. To find out which `SFT_DOMAIN` can be used, continue reading the [Calling](#calling) section. | ||
|
|
||
| ```bash | ||
| d bash | ||
| kubectl get ingress nginx-ingress-red -o yaml > nginx-ingress-red.yaml | ||
| MULTI_DOMAIN="red.example.com" | ||
| SFT_DOMAIN="sft.example-calling.com" | ||
| sed -i "s|} https://\\*\\.${MULTI_DOMAIN};|} https://*.${MULTI_DOMAIN} https://${SFT_DOMAIN};|" nginx-ingress-red.yaml | ||
| # debug command to verify | ||
| kubectl diff -f nginx-ingress-red.yaml | ||
| kubectl apply -f nginx-ingress-red.yaml |
There was a problem hiding this comment.
This is too much duct-tape hacking:
- The
sedstatement is brittle (imagine the ingress slightly changes ...). - It's confusing to first install and then patch to have it correctly installed.
The way to go is certainly outlines by this PR: github.com/wireapp/wire-server/pull/5236
Though, I'm not sure if it adjusts all CSP parts to get remote SFT working.
There was a problem hiding this comment.
I agree that this is a pure hack but we had to patch it before the PR 5236 was created. The PR is sill waiting for approval since long time. Once I merge the PR and it has been released - I will update the documentation.
There was a problem hiding this comment.
I see. Yeah, that's probably a misunderstanding: The backend team probably considered an approval by @smatting as good enough.
I've now reviewed and approved as well.
2 participants
Change type
Basic information
Testing
Tracking