-
Notifications
You must be signed in to change notification settings - Fork 0
Fix 404 errors on ingress routes #105
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -522,7 +522,39 @@ curl -I -H "Authorization: Bearer $TOKEN" https://calypr-demo.ddns.net/workflows | |||||||||||
|
|
||||||||||||
| ### Common Issues | ||||||||||||
|
|
||||||||||||
| 1. **502 Bad Gateway**: AuthZ adapter not reachable | ||||||||||||
| 1. **404 Not Found**: Routes return 404 error | ||||||||||||
| - Check if backend services exist in their respective namespaces: | ||||||||||||
| ```bash | ||||||||||||
| # For workflows | ||||||||||||
| kubectl get svc argo-stack-argo-workflows-server -n argo-workflows | ||||||||||||
| # For applications (ArgoCD) | ||||||||||||
| kubectl get svc argo-stack-argocd-server -n argocd | ||||||||||||
| # For registrations | ||||||||||||
| kubectl get svc github-repo-registrations-eventsource-svc -n argo-events | ||||||||||||
| ``` | ||||||||||||
| - Verify ExternalName proxy services are created for cross-namespace routing: | ||||||||||||
| ```bash | ||||||||||||
| kubectl get svc -n argo-stack -l app.kubernetes.io/component=externalname-proxy | ||||||||||||
|
Comment on lines
+536
to
+537
|
||||||||||||
| ```bash | |
| kubectl get svc -n argo-stack -l app.kubernetes.io/component=externalname-proxy | |
| > **Note:** ExternalName proxy services are created in the namespace for each route (e.g., `argocd`, `argo-workflows`, `argo-events`), not just in `argo-stack`. | |
| ```bash | |
| kubectl get svc -A -l app.kubernetes.io/component=externalname-proxy |
Copilot
AI
Nov 27, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The namespace in this command is incorrect. Based on the values.yaml changes, the applications ingress is created in the argocd namespace (line 122 of values.yaml), not argo-stack. Update the command to: kubectl get ingress ingress-authz-applications -n argocd -o yaml | grep backend-protocol.
| kubectl get ingress ingress-authz-applications -n argo-stack -o yaml | grep backend-protocol | |
| kubectl get ingress ingress-authz-applications -n argocd -o yaml | grep backend-protocol |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -17,7 +17,8 @@ externalname-services.yaml template. | |||||
| {{- $root := . }} | ||||||
| {{- $config := .Values.ingressAuthzOverlay }} | ||||||
| {{- range $routeName, $route := $config.routes }} | ||||||
| {{- if $route.enabled }} | ||||||
| {{- $routeEnabled := $route.enabled | default true }} | ||||||
| {{- if $routeEnabled }} | ||||||
| {{- $serviceNamespace := $route.serviceNamespace | default $route.namespace }} | ||||||
| {{- $isCrossNamespace := ne $route.namespace $serviceNamespace }} | ||||||
| {{- $serviceName := ternary (printf "%s-proxy" $route.service) $route.service $isCrossNamespace }} | ||||||
|
|
@@ -45,6 +46,11 @@ metadata: | |||||
| # # Let's Encrypt / cert-manager integration (only on primary route to avoid ownership conflicts) | ||||||
| # cert-manager.io/cluster-issuer: {{ $config.tls.clusterIssuer | quote }} | ||||||
| # {{- end }} | ||||||
| {{- if $route.backendProtocol }} | ||||||
| # Backend protocol for services using HTTPS/GRPC internally | ||||||
| # Valid values: HTTP, HTTPS, GRPC, GRPCS, AJP, FCGI | ||||||
| nginx.ingress.kubernetes.io/backend-protocol: {{ $route.backendProtocol | quote }} | ||||||
| {{- end }} | ||||||
| {{- if $route.useRegex }} | ||||||
| # Path rewriting for subpath support | ||||||
| nginx.ingress.kubernetes.io/use-regex: "true" | ||||||
|
|
@@ -54,8 +60,17 @@ metadata: | |||||
| # Cross-namespace routing via ExternalName service | ||||||
| nginx.ingress.kubernetes.io/upstream-vhost: {{ $route.service }}.{{ $serviceNamespace }}.svc.cluster.local | ||||||
| {{- end }} | ||||||
| {{- if $route.proxyConnectTimeout }} | ||||||
| nginx.ingress.kubernetes.io/proxy-connect-timeout: {{ $route.proxyConnectTimeout | quote }} | ||||||
| {{- end }} | ||||||
| {{- if $route.proxyReadTimeout }} | ||||||
| nginx.ingress.kubernetes.io/proxy-read-timeout: {{ $route.proxyReadTimeout | quote }} | ||||||
| {{- end }} | ||||||
| {{- if $route.proxySendTimeout }} | ||||||
| nginx.ingress.kubernetes.io/proxy-send-timeout: {{ $route.proxySendTimeout | quote }} | ||||||
| {{- end }} | ||||||
| spec: | ||||||
| ingressClassName: {{ $config.ingressClassName | default "nginx" | quote }} | ||||||
| ingressClassName: "nginx" | ||||||
|
||||||
| ingressClassName: "nginx" | |
| ingressClassName: {{ $config.ingressClassName | default "nginx" | quote }} |
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,4 @@ | ||||||||||||||||
| controller: | ||||||||||||||||
| config: | ||||||||||||||||
|
||||||||||||||||
| config: | |
| config: | |
| # WARNING: Enabling snippet annotations with `allow-snippet-annotations: true` and | |
| # `annotations-risk-level: Critical` allows arbitrary NGINX configuration code injection | |
| # via Ingress annotations. This creates a significant security risk and should ONLY be | |
| # used in trusted environments where Ingress resources are tightly controlled. | |
| # See: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#snippet-annotations |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Large blocks of commented-out code should be removed rather than committed. If this PUBLIC_IP assignment logic might be needed in the future, document why it was disabled in a comment and consider removing the code block, or explain the rationale for keeping it commented.