Deploy Streampipes to rancher (k8s) without Internet access

[c4hm]

Hi,

I'm trying to deploy streampipes to a rancher kubernetes cluster without internet access. I've adapted the helm chart delivered with SP to meet the conditions in the rancher. Even this was a bit rocky.
e.g. there is a variable Values.streampipes.core.service.name which is used by the (extensions) init-container but not by the extensions iiot image itself. This always connects to the service name backend.
But there are more and real problems. The backend explains:

ERROR 1 --- [nio-8030-exec-3] o.a.s.security.jwt.JwtTokenValidator : Weak Key
ERROR 1 --- [nio-8030-exec-3] .a.s.s.b.s.UnauthorizedRequestEntryPoint : Unauthorized request to /api/v2/extensions-services

and

INFO 1 --- [pool-3-thread-1] o.a.s.s.SpServiceDiscoveryCore : Could not find any extensions services, retrying (1/3)
INFO 1 --- [pool-3-thread-1] o.a.s.s.SpServiceDiscoveryCore : Could not find any extensions services, retrying (2/3)
INFO 1 --- [pool-3-thread-1] o.a.s.s.SpServiceDiscoveryCore : Could not find any extensions services, retrying (3/3)
INFO 1 --- [pool-3-thread-1] o.a.s.s.SpServiceDiscoveryCore : No service found

I've set sp-initial-client-secret with more than 35 characters.

The extensions-iiot container explains:

WARN --- [ main] o.a.s.s.extensions.CoreRequestSubmitter : Could not register service at core at url http://backend:8030/ Trying again in 3 seconds

I tried to connect to backend:8030 out of the extensions container:

$wget backend:8030 -O -
--2024-09-09 10:18:48-- http://backend:8030/
Resolving backend (backend)... 10.43.240.188
Connecting to backend (backend)|10.43.240.188|:8030... connected.
HTTP request sent, awaiting response... 404

And I'm a bit confused about the 404.

Where could I continue debugging? What can I do against the weak key Error? Could this be the root cause of the problem(s)?

Many thanks for your support.

[c4hm]

I can answer myself: The weak key error is a consequential error, maybe from the beginig of the installation and testing. It is gone after removing and completely redeploying SP. But there are some errors in the basic configuration. Both, the ui ingress and the nginx reverse proxy config for /streampipes-backend points to backend/, but the backend tomcat listens at /streampipes-backend. After redirecting /streampipes-backend to backend/streampipes-backend it works. Does anyone get SP up and running in K8S with the helm chart delivered with SP?

[dominikriemer]

Hi @c4hm thanks for asking and reporting your issues!
We use the Traefik ingressroute configuration in our deployments, so I don't have much experience with the Ingress. When looking at the ui-ingress.yml config, it should properly route requests to /streampipes-backend to streampipes.core.appName.
If I understand correctly, the problem you experience is due to a wrong service name (backend) and not the path (streampipes-backend), is this right?

[c4hm]

Hi @dominikriemer,
thanks for your answer!
these are two different points:

1. the extensions-all-iiot image does not care about streampipes.core.appName. It connects to backend:8030. And I did not find an environment variable to tell the image to use another name to connect to. But I switched the name of the backend pod to backend and now the extensions can register. It would be nice to be able to change the backend name. It makes things easier in bigger K8S Environments. (but it's only nice to have)
2. Rancher does not like the -path: /streampipes-backend(/|$)(.*) statement from the ui-ingress.yaml (don't know why). So we decided to use the reverse proxy from the ui nginx, which is already prepared in the ui-configmap.yaml. The problem is: The backend tomcat does not answer requests to /. We got a 502 from nginx and a 404 from the backend directly. The backend only answers requests to /streampipes-backend. So we had to change the configmap (nginx default.conf). We simplified it a bit to:
   proxy_pass http://backend:8030/streampipes-backend;
   now it is up and running. That means I have even more questions :-). But they don't belong to this thread.
   Thank!