1457608 - Make signature validation work on redeployable clusters

Status: RESOLVED FIXED

(Taskcluster :: Services, enhancement)

Description

[Brian Stack [:bstack]]

Currently the way we have set up the ingress in front of our services in kubernetes will make signature validation... weird (I think).

Things off the top of my head:

1) Most of our services hard-code publicUrl in production.
2) If we do rewrites without changing host header for each service paths will be the same. e.g. v1/ping on auth and v1/ping on index are the "same" so we would need to ensure uniqeness.
3) More that I'm not thinking of


I'm reading up on ingress docs now to see what options we have.


https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication


https://kubernetes.io/docs/concepts/services-networking/ingress/

Comment 1

[Brian Stack [:bstack]]

Ok, I've looked into this a bit more. I think I've crystallized the issue. Ignore what I wrote above for the most part.

Will be submitting a PR in a bit that seems to make this work! (now whether or not we _want_ to make this work we can decide on monday)

Comment 2

[Brian Stack [:bstack]]

https://github.com/taskcluster/taskcluster-auth/pull/154