BackendTLSPolicy applied a Kibana instance Service resulting in upstream connect error or disconnect/reset before headers. reset reason: connection termination #4769
Comments
|
Apparently, I shouldn't use the sectionName within my TLSBackendPolicy definition. With this formulation I am able to connect to Kibana. Additionally, I can refer directly to the Secret containing the certificates, without the need to extract the CA's as a ConfigMap. |
|
Closing the issue after solving on my own, I hope that it could be helpful for someone else |
|
imo sectionName should work, opening this issue since its a bug |
|
@ferdinandosimonetti Which EG version did you use for testing? It seems that this was caused by the same reason of #4445, and it should already have been fixed by #4630 . |
|
Ah, sorry, I forgot to mention it. It is v1.2.1. |
ferdinandosimonetti
changed the title
|
EG asumes the
Since port name is an optional field in the service spec, Gateway API should use port number as the SectionName for Service, or at least supports both Port name and Port number. |
|
I *tried* it with the port name (failing), in fact, after having failed with the port number.
But, as far as I remember, I tried to specify the port number but I wrote it as a string.
I'll try to run the test, of course.
Sent from Outlook for Android<https://aka.ms/AAb9ysg>
…________________________________
From: Huabing Zhao ***@***.***>
Sent: Monday, November 25, 2024 10:16:30 AM
To: envoyproxy/gateway ***@***.***>
Cc: Ferdinando Simonetti ***@***.***>; Mention ***@***.***>
Subject: Re: [envoyproxy/gateway] BackendTLSPolicy applied a Kibana instance Service resulting in upstream connect error or disconnect/reset before headers. reset reason: connection termination (Issue #4769)
EG asumes the sectionName for BackendTLSPolicy is a port number instead of a port name, according to the Gateway API, it should be the Service Name.
apiVersion: gateway.networking.k8s.io/v1alpha3
kind: BackendTLSPolicy
metadata:
name: kb-enable-tls
namespace: elastic-dev
spec:
targetRefs:
- group: ''
kind: Service
name: fh-cluster-kb-http
sectionName: https
—
Reply to this email directly, view it on GitHub<#4769 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AFHUAS67HMO22GJEULOTTYL2CLTG5AVCNFSM6AAAAABSJW2XPKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIOJXGM3DKMRTGQ>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
|
thanks for triaging this @zhaohuabing, imo we should continue with |
Sounds good, I will raise a PR to address it. |
Description:
upstream connect error or disconnect/reset before headers. reset reason: connection terminationalong with status 503while accessing the same Kibana through an Ingress resource whose configuration made use of these annotations
works as usual
Repro steps:
Environment:
Logs:
The text was updated successfully, but these errors were encountered: