Ambassador Gives 403 Trying to Connect to Websocket

Question

Ambassador is throwing a 403 while trying to access a websocket endpoint within the cluster. Here are the steps to recreate the issue:

[Kube Environment: Docker for Desktop on Mac]

Install Ambassador and the Echo Service

Deploy Ambassador with Helm

helm repo add datawire https://getambassador.io
helm install ambassador datawire/ambassador

Deploy the websocket echo deployment/service/mapping

---
apiVersion: v1
kind: Service
metadata:
  name: websocket-echo
  namespace: default
spec:
  ports:
    - name: http
      port: 80
      targetPort: 8080
  selector:
    app: websocket-echo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: websocket-echo
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: websocket-echo
  template:
    metadata:
      labels:
        app: websocket-echo
    spec:
      containers:
        - name: backend
          image: jmalloc/echo-server
          ports:
            - name: http
              containerPort: 8080
---
apiVersion: getambassador.io/v2
kind: Mapping
metadata:
  name: websocket-echo
  namespace: default
spec:
  prefix: /websocket/
  service: websocket-echo
  allow_upgrade:
  - websocket

✅ Verify the echo server can be reached from a pod within the cluster

Create a node shell on the cluster

kubectl run my-shell --rm -i --tty --image node:12 -- bash

In the shell, download wscat

npm i -g wscat

In the shell, connect to the service via the cluster service endpoint

wscat -c websocket-echo.default.svc.cluster.local

Verify the connection is established and messages can be echoed back

❌ Verify the echo server cannot be reach from outside the cluster

Install wscat on you local machine

npm i -g wscat

Using wscat, connect to the service using the mapping

wscat -c localhost/websocket-echo/

Verify that the error returned is error: Unexpected server response: 403

Am I missing something simple?

Port 80 is for you to use in the cluster , either use kubectl portforward or try Nodeport service type and then access with localhost:Nodeport — Tarun Khosla, Aug 07 '20 at 04:08
He's using `Docker for Desktop on Mac`. Therefore, it's ok to do `localhost[:80]` — RammusXu, Aug 07 '20 at 08:24

RammusXu · Accepted Answer · 2020-08-07T08:29:19.433

Ambassador will redirect incoming request froms http to https.

You can verify by

$ curl localhost/websocket/ -v
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 80 (#0)
> GET /websocket/ HTTP/1.1
> Host: localhost
> User-Agent: curl/7.54.0
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< location: https://localhost/websocket/
< date: Fri, 07 Aug 2020 08:25:38 GMT
< server: envoy
< content-length: 0
< 
* Connection #0 to host localhost left intact

So, you will need to add this config to disable redirection on localhost

apiVersion: getambassador.io/v2
kind: Host
metadata:
  name: localhost
  namespace: default
spec:
  hostname: localhost
  acmeProvider:
    authority: none
  requestPolicy:
    insecure:
      action: Route

Ambassador Gives 403 Trying to Connect to Websocket

1 Answers1

Reference