HAL on OpenShift #708

hpehl · 2024-12-18T09:53:38Z

Blog post about how to access the management console for WildFly instances running on OpenShift.

Preview: https://hpehl.github.io/wildfly.org/news/2024/12/18/Management-Console-on-OpenShift/

jmesnil

@hpehl That looks great but I have a few questions :)

_posts/2024-12-18-Management-Console-on-OpenShift.adoc

jmesnil · 2024-12-18T10:12:49Z

_posts/2024-12-18-Management-Console-on-OpenShift.adoc

+. Open https://hal.github.io/console
+. Add a management interface to the public route:
+
+Give an arbitrary name, select *https* as scheme, enter the hostname of the public route _without_ https and port *80*:


When I do this and click on Ping, nothing happens. Is it normal?

Normally that should show the browser login modal and prompt for the username and password. Somehow this does not work for OpenShift. But you are able to login anyway, aren't you?

jmesnil · 2024-12-18T10:14:20Z

_posts/2024-12-18-Management-Console-on-OpenShift.adoc

+
+image::hal/add-management-interface.png[Add management interface]
+. Click *Add* and then *Connect*
+. Login using `admin:admin`


When I did this to connect to the deployment created with ocnew-app quay.io/halconsole/wildfly, I got the error:

Status 401 - Unauthorized. The management console could not be loaded. If you changed your access control provider to RBAC, make sure that your configuration has current user mapped to one of the RBAC roles, preferably with at least one in the Administrator or SuperUser role. If you have started with one of the standard xml configurations shipped with WildFly, the "$local" user should be mapped to the "SuperUser" role and the "local" authentication scheme should be enabled. This should allow a user running the CLI on the same system as the WildFly process to have full administrative permissions. Remote CLI users and web-based admin console users will have no permissions. You should map at least one user besides "$local". Try to use CLI or shut the installation down and edit the xml configuration.

That seems weird as I was able to connect as admin:admin on the local HAL console.

Does a browser refresh or private mode help?

I just tried to reproduce that. This is what I did:

Create the app

oc new-app quay.io/halconsole/wildfly oc create route edge --service wildfly --port 9990

Open https://hal.github.io/console

Add the management interface. Please make sure to use port 80.

Connect and login using admin:admin

weird, it still fails for me.

I thought that was due to the /core-service=management/management-interface=http-interface:list-add(name=allowed-origins,value=https://<hostname>) on my deployment but even with a fresh deployment it fails (using Chrome incognito mode)

jmesnil · 2024-12-18T12:14:09Z

@hpehl This goes beyond what you are doing in this example but there are a few things to keep in mind:

Changing the management configuration of a pod is an anti pattern as it will not outlive a pod restart. At that point, you'll have again to perform the /core-service=management/management-interface operation. We need to find a way to persist that config in the container to survive restart. The route can be created before the deployment so we can now its value ahead of time. We can then pass it to the deployment as an env var and use it for the /core-service=management/management-interface operation. However this operation should ideally be done at build time so it's intrinsically part of the deployment configuration.
With a route, you are accessing pods behind a service. If your deployments have multiple pods, it's very complex (and hacky) to access a specific pod.
What is missing from quay.io/wildfly/wildfly to use it instead of quay.io/halconsole/wildfly? I've already opened Update README jboss-dockerfiles/wildfly#237 and we can add instructions to configure CORS as required.

hpehl · 2024-12-18T12:55:19Z

Thanks for the feedback @jmesnil. I think it makes sense to add some of your comments as "Things to keep in mind" in the post.

jmesnil

/lgtm thanks

On the limitations, I wrote down some notes at jboss-dockerfiles/wildfly#237 (comment) to make the configuration persistent (and still configurable at runtime for the route host)

bstansberry

I'm concerned about admin:admin. It needs to be clear that that's for use in dev, etc type environments where no harm can be done.

bstansberry · 2024-12-18T16:21:29Z

_posts/2024-12-18-Management-Console-on-OpenShift.adoc

+  The console uses the https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API[fetch API] to talk to the management interface of a running WildFly instance. In an OpenShift environment, the origins of the public route and the management interface itself are different. That's why we need to tell WildFly that it is ok to make requests to the management interface from another origin (see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS[CORS policies] for more details).
+
+You can build such an image on your own based on the official WildFly images available at https://quay.io/repository/wildfly/wildfly[quay.io/wildfly/wildfly] (see "Extending the image"). Another way is to use the pre-built images from https://quay.io/repository/halconsole/wildfly[quay.io/halconsole/wildfly]. These images are mainly meant for HAL development and testing but already meet these requirements, which makes them suitable for our use case. In particular the images add a management user `admin:admin` and have a list of preconfigured allowed origins.
+


Perhaps a WARNING admonition block saying this preconfigured admin:admin setup is for development purposes or something? I'd be concerned if people start running this in production and relying only on allowed-origins to control access.

bstansberry · 2024-12-18T16:22:37Z

_posts/2024-12-18-Management-Console-on-OpenShift.adoc

+
+* Changing the management configuration of a pod is an antipattern as it will not outlive a pod restart. At that point, you'll have to reconfigure the allowed origin.
+* With a route, you are accessing pods behind a service. If your deployments have multiple pods, it's complex and hacky to access a specific pod or configure all pods.
+


Please add something about not using admin:admin in an insecure environment.

Looks good.

hpehl · 2024-12-18T17:00:01Z

Thanks for the feedback @bstansberry
I've added warnings and updated the preview.

bstansberry · 2024-12-19T13:35:20Z

_posts/2024-12-18-Management-Console-on-OpenShift.adoc

+
+You can build such an image on your own based on the official WildFly images available at https://quay.io/repository/wildfly/wildfly[quay.io/wildfly/wildfly] (see "Extending the image"). Another way is to use the pre-built images from https://quay.io/repository/halconsole/wildfly[quay.io/halconsole/wildfly]. These images are mainly meant for HAL development and testing but already meet these requirements, which makes them suitable for our use case. In particular the images add a management user `admin:admin` and have a list of preconfigured allowed origins.
+
+WARNING: The additions in the https://quay.io/repository/halconsole/wildfly[quay.io/halconsole/wildfly] images are only meant for development and testing purposes. Please do not rely on the management user `admin:admin` or the preconfigured allowed origins. It is strongly recommended not to use that in production!


s/It is strongly recommend not to use/Do not use/g

Probably in bold.

bstansberry

Thanks Harald.

I suggest a bit stronger wording on the WARNING, although I realize people and cultures can feel differently about that kind of phrasing. Your wording or mine though, I think bolding it would be good.

hpehl · 2024-12-19T14:00:06Z

Ok, got it 😉

I rephrased the warning and "Things to keep in mind" section to make it unmistakable to not use it in production.

bstansberry · 2024-12-19T15:10:48Z

Thanks @hpehl and @jmesnil

HAL on OpenShift

2b660e3

hpehl requested review from jfdenise, jmesnil and bstansberry December 18, 2024 09:58

jmesnil reviewed Dec 18, 2024

View reviewed changes

Adjust jboss-cli URL; reformat online version

c98cacd

Add 'Things to keep in mind' section; fix typos

539b924

jmesnil approved these changes Dec 18, 2024

View reviewed changes

bstansberry requested changes Dec 18, 2024

View reviewed changes

hpehl added 2 commits December 18, 2024 17:52

Add a warning admonition block for admin:admin

c0543e0

Add another warning about quay.io/halconsole/wildfly images

aba4a88

hpehl added 2 commits December 18, 2024 18:02

s/It contains/They contain

33b3641

Fix typo

aa7f725

bstansberry reviewed Dec 19, 2024

View reviewed changes

bstansberry requested changes Dec 19, 2024

View reviewed changes

Make it clear not to use it in production

a874aac

bstansberry approved these changes Dec 19, 2024

View reviewed changes

bstansberry merged commit e89b5f5 into wildfly:main Dec 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HAL on OpenShift #708

HAL on OpenShift #708

hpehl commented Dec 18, 2024 •

edited

Loading

jmesnil left a comment

jmesnil Dec 18, 2024

hpehl Dec 18, 2024

jmesnil Dec 18, 2024

hpehl Dec 18, 2024

hpehl Dec 18, 2024 •

edited

Loading

jmesnil Dec 18, 2024

jmesnil commented Dec 18, 2024

hpehl commented Dec 18, 2024

jmesnil left a comment •

edited

Loading

bstansberry left a comment

bstansberry Dec 18, 2024

bstansberry Dec 18, 2024

bstansberry Dec 19, 2024

hpehl commented Dec 18, 2024

bstansberry Dec 19, 2024

bstansberry left a comment

hpehl commented Dec 19, 2024

bstansberry commented Dec 19, 2024

		The console uses the https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API[fetch API] to talk to the management interface of a running WildFly instance. In an OpenShift environment, the origins of the public route and the management interface itself are different. That's why we need to tell WildFly that it is ok to make requests to the management interface from another origin (see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS[CORS policies] for more details).

		You can build such an image on your own based on the official WildFly images available at https://quay.io/repository/wildfly/wildfly[quay.io/wildfly/wildfly] (see "Extending the image"). Another way is to use the pre-built images from https://quay.io/repository/halconsole/wildfly[quay.io/halconsole/wildfly]. These images are mainly meant for HAL development and testing but already meet these requirements, which makes them suitable for our use case. In particular the images add a management user `admin:admin` and have a list of preconfigured allowed origins.


		* Changing the management configuration of a pod is an antipattern as it will not outlive a pod restart. At that point, you'll have to reconfigure the allowed origin.
		* With a route, you are accessing pods behind a service. If your deployments have multiple pods, it's complex and hacky to access a specific pod or configure all pods.


		You can build such an image on your own based on the official WildFly images available at https://quay.io/repository/wildfly/wildfly[quay.io/wildfly/wildfly] (see "Extending the image"). Another way is to use the pre-built images from https://quay.io/repository/halconsole/wildfly[quay.io/halconsole/wildfly]. These images are mainly meant for HAL development and testing but already meet these requirements, which makes them suitable for our use case. In particular the images add a management user `admin:admin` and have a list of preconfigured allowed origins.

		WARNING: The additions in the https://quay.io/repository/halconsole/wildfly[quay.io/halconsole/wildfly] images are only meant for development and testing purposes. Please do not rely on the management user `admin:admin` or the preconfigured allowed origins. It is strongly recommended not to use that in production!

HAL on OpenShift #708

HAL on OpenShift #708

Conversation

hpehl commented Dec 18, 2024 • edited Loading

jmesnil left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hpehl Dec 18, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jmesnil commented Dec 18, 2024

hpehl commented Dec 18, 2024

jmesnil left a comment • edited Loading

Choose a reason for hiding this comment

bstansberry left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hpehl commented Dec 18, 2024

Choose a reason for hiding this comment

bstansberry left a comment

Choose a reason for hiding this comment

hpehl commented Dec 19, 2024

bstansberry commented Dec 19, 2024

hpehl commented Dec 18, 2024 •

edited

Loading

hpehl Dec 18, 2024 •

edited

Loading

jmesnil left a comment •

edited

Loading