fix: Disable 8081 for 2xx and bind to localhost #794
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…letech/nifi-operator into fix/disable-8081-for-2xx
Maleware
requested review from
sbernauer and
maltesander
and removed request for
sbernauer
Techassi
changed the title
maltesander
moved this from Development: Waiting for Review
to Development: In Review
in Stackable Engineering
maltesander
requested changes
May 26, 2025
There was a problem hiding this comment.
I dont see the point in adding nifi.web.https.network.interface.lo per default. This can be documented as override for local development?
Edit:
Tests do not work, cannot access UI via Nodeport etc.
HTTPSConnectionPool(host='nifi-node-default-1.nifi-node-default.kuttl-test-measured-sloth.svc.cluster.local', port=8443): Max retries exceeded with url: /nifi-api/access/token (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x71c838a1aab0>: Failed to establish a new connection: [Errno 111] Connection refused'))
logger.go:42: 12:21:22 | smoke_nifi-1.28.1_zookeeper-3.9.3_openshift-false_listener-class-external-unstable/60-prepare-test-nifi | command terminated with exit code 1
logger.go:42: 12:21:22 | smoke_nifi-1.28.1_zookeeper-3.9.3_openshift-false_listener-class-external-unstable/60-prepare-test-nifi | command failure, skipping 1 additional commands
logger.go:42: 12:21:23 | smoke_nifi-1.28.1_zookeeper-3.9.3_openshift-false_listener-class-external-unstable/60-prepare-test-nifi | test step failed 60-prepare-test-nifi
case.go:396: failed in step 60-prepare-test-nifi
case.go:398: command "kubectl exec -n $NAMESPACE test-nifi-0 -- python /tmp/test_nifi.py ..." failed, exit status 1
logger.go:42: 12:21:23 | smoke_nifi-1.28.1_zookeeper-3.9.3_openshift-false_listener-class-external-unstable | skipping kubernetes event logging
=== NAME kuttl
harness.go:403: run tests finished
harness.go:510: cleaning up
harness.go:567: removing temp folder: ""
--- FAIL: kuttl (463.10s)
--- FAIL: kuttl/harness (0.00s)
--- FAIL: kuttl/harness/smoke_nifi-1.28.1_zookeeper-3.9.3_openshift-false_listener-class-external-unstable (463.09s)
Even though the docs state this should be additive, i dont feel this works properly....
| @@ -21,6 +21,18 @@ spec: | |||
|
|
|||
| == `HTTP ERROR 400 Invalid SNI` | |||
|
|
|||
| === Local PORT-FORWARD | |||
|
|
|||
| Since NiFi requires a valid SIN, we need to configure `/etc/hosts` by adding e.g. from NiFi xref:getting_started/index.adoc[getting started] | |||
There was a problem hiding this comment.
I dont see the difference of doing this via the node ip?
Suggested change
| Since NiFi requires a valid SIN, we need to configure `/etc/hosts` by adding e.g. from NiFi xref:getting_started/index.adoc[getting started] | |
| Since NiFi requires a valid SNI (Server Name Indication), we need to configure `/etc/hosts` by adding e.g. from NiFi xref:getting_started/index.adoc[getting started] |
| @@ -1140,28 +1144,42 @@ async fn build_node_rolegroup_statefulset( | |||
| .add_container_port(HTTPS_PORT_NAME, HTTPS_PORT.into()) | |||
| .add_container_port(PROTOCOL_PORT_NAME, PROTOCOL_PORT.into()) | |||
| .add_container_port(BALANCE_PORT_NAME, BALANCE_PORT.into()) | |||
| .add_container_port(METRICS_PORT_NAME, METRICS_PORT.into()) | |||
| // Probes have been changed to exec as we introduced nifi.web.https.network.interface.lo=lo by default. | |||
| // Probe will succeed for any HTTPS errors ( SIN Invalid, 400 ) as this confirms the port to be open. | |||
There was a problem hiding this comment.
Suggested change
| // Probe will succeed for any HTTPS errors ( SIN Invalid, 400 ) as this confirms the port to be open. | |
| // Probe will succeed for any HTTPS errors (SNI Invalid, 400) as this confirms the port to be open. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds:
1.x.xnifi.properties