I'm facing a strange issue in my K8S cluster
Basically I have 2 application:
- identity manager (WSO2 IS based but the issue is not related to WSO2)
- external SAML2 IDP that will manage X509 authentication
I configured WSO2 in order to use this external SAML2 IDP
When I try to login by X509, WSO2 shows me the login page, i click on smartcard and a redirect is done to the external SAML IDP.
In this case the nginx ingress gives to me 502 bad gateway. If I copy the URL, close the browser and try again to access directly to the X509 IDP, all works pretty good.
Note that I'm using another external SAML IDP and in this case the redirect is working pretty good
The difference between the 2 external IDP is that I configured the ingress controller of X509 SAML IDP in pass-through because I need that X509 certificare is consumed by my Java application
May, anybody, tell me why I'm having this strange behaviour?
Thank you
Angelo
UPDATE
Here you can find my nginx.conf
https://raw.githubusercontent.com/angeloimm/nginx_configuration/main/nginx.conf
This is my ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: eid-tls-ingress
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/rewrite-target: /eid-tsl/
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
tls:
- hosts:
- login-cns-test.it
rules:
- host: login-cns-test.it
http:
paths:
- path: /
backend:
serviceName: eid-tls-service
servicePort: 443
UPDATE 2
As you can see all http/s requests from internet are intercepted by my customer balancer (Balancer cloud vmware nsx) this balancer routes the requests to the worker nodes.
On worker nodes I have my eid-tls-service; it's a default type service (clusterIP type) so I need the ingress controller in order to handle request.
The only important thing (at least I think) is that I need a passthrough configuration. So I confogured my K8S and my nginx controller by using passthrough. No configuration has been done on Balancer cloud vmware nsx
In fact I need that the X509 certficate is not consumed by Ingress Controller but it must arrive directly to my application (to my service).
I have just 1 replica of my service.
This is my service yaml config:
kind: Service
apiVersion: v1
metadata:
name: eid-tls-service
spec:
selector:
app: eid-tls
ports:
- protocol: TCP
name: https-port
port: 443
targetPort: 443
From kubectl this is my eid-tls-service describe:
Name: eid-tls-service
Namespace: eid-tls-idp-ns
Labels: <none>
Annotations: Selector: app=eid-tls
Type: ClusterIP
IP: xx.ss.z.ttt
Port: https-port 443/TCP
TargetPort: 443/TCP
Endpoints: xx.yy.z.www:443
Session Affinity: None
Events: <none>
This is my ingress controller log error:
2021/01/28 11:24:06 [error] 3210#3210: *78115978 SSL_do_handshake() failed (SSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:SSL alert number 42) while SSL handshaking to upstream, client: 127.0.0.1, server:
What I really can't understand is why if I copy the URL, close the browser (by cleaning all cookies and files) and I paste the copied URL all works good (certificate is consumed by my java application)