Merge branch 'develop' into lookup-service-access

GrahamDumpleton · Oct 17, 2024 · 5e63be6 · 5e63be6
2 parents 0a413a2 + c8f343f
commit 5e63be6
Show file tree

Hide file tree

Showing 13 changed files with 97 additions and 75 deletions.
diff --git a/...aller/bundle/config/ytt/_ytt_lib/infrastructure/eks/10-default-settings-for-provider.yaml b/...aller/bundle/config/ytt/_ytt_lib/infrastructure/eks/10-default-settings-for-provider.yaml
@@ -49,7 +49,8 @@ clusterPackages:
       aws:
         args:
           domain_filter: #@ data.values.clusterInfrastructure.aws.route53.hostedZone if hasattr(data.values.clusterInfrastructure.aws.route53, "hostedZone") else data.values.clusterIngress.domain
-          txt_owner_id: "educates"
+          txt_owner_id: #@ data.values.clusterIngress.domain
+          policy: sync
   certs:
     enabled: #@ isClusterPackageEnableByDefault("certs")
     settings:

diff --git a/...aller/bundle/config/ytt/_ytt_lib/infrastructure/gke/10-default-settings-for-provider.yaml b/...aller/bundle/config/ytt/_ytt_lib/infrastructure/gke/10-default-settings-for-provider.yaml
@@ -49,7 +49,8 @@ clusterPackages:
         args:
           project: #@ data.values.clusterInfrastructure.gcp.project
           domain_filter: #@ data.values.clusterInfrastructure.gcp.cloudDNS.zone if hasattr(data.values.clusterInfrastructure.gcp.cloudDNS, "zone") else data.values.clusterIngress.domain
-          txt_owner_id: "educates"
+          txt_owner_id: #@ data.values.clusterIngress.domain
+          policy: sync
   certs:
     enabled: #@ isClusterPackageEnableByDefault("certs")
     settings:

diff --git a/docker-extension/ui/package-lock.json b/docker-extension/ui/package-lock.json
diff --git a/project-docs/release-notes/version-3.0.1.md b/project-docs/release-notes/version-3.0.1.md
@@ -53,3 +53,10 @@ Bugs Fixed
 * Using the `custom` provider when the `educates` component was enabled, would
   fail when using CLI to create or update a cluster as image references were not
   being replaced with references to where released image artifacts were stored.
+
+* When an ingress secret was not being supplied, but `clusterIngress.protocol`
+  was being forcibly set to `https` due to HTTPS connections being terminated by
+  a front end router, annotations were wrongly being added to ingresses to force
+  redirection from `http` to `https`. This would result in a redirect loop.
+  Annotations should not have been added and redirection from `http` to `https`
+  should instead have been done by the front end router.
diff --git a/session-manager/handlers/trainingportal.py b/session-manager/handlers/trainingportal.py
@@ -913,7 +913,7 @@ def training_portal_create(name, uid, body, spec, status, patch, runtime, retry,
             "kubernetes.io/ingress.class"
         ] = INGRESS_CLASS
 
-    if INGRESS_PROTOCOL == "https":
+    if INGRESS_SECRET:
         ingress_body["metadata"]["annotations"].update(
             {
                 "ingress.kubernetes.io/force-ssl-redirect": "true",

diff --git a/session-manager/handlers/workshopenvironment.py b/session-manager/handlers/workshopenvironment.py
@@ -1632,7 +1632,7 @@ def workshop_environment_create(
                 },
             }
 
-            if INGRESS_PROTOCOL == "https":
+            if INGRESS_SECRET:
                 artifacts_ingress_body["metadata"]["annotations"].update(
                     {
                         "ingress.kubernetes.io/force-ssl-redirect": "true",
@@ -1973,7 +1973,7 @@ def workshop_environment_create(
                 },
             }
 
-            if INGRESS_PROTOCOL == "https":
+            if INGRESS_SECRET:
                 assets_server_ingress_body["metadata"]["annotations"].update(
                     {
                         "ingress.kubernetes.io/force-ssl-redirect": "true",

diff --git a/session-manager/handlers/workshopsession.py b/session-manager/handlers/workshopsession.py
@@ -2846,7 +2846,7 @@ def _apply_environment_patch(patch):
             },
         }
 
-        if INGRESS_PROTOCOL == "https":
+        if INGRESS_SECRET:
             registry_ingress_body["metadata"]["annotations"].update(
                 {
                     "ingress.kubernetes.io/force-ssl-redirect": "true",
@@ -3120,7 +3120,7 @@ def _apply_environment_patch(patch):
         },
     }
 
-    if INGRESS_PROTOCOL == "https":
+    if INGRESS_SECRET:
         ingress_body["metadata"]["annotations"].update(
             {
                 "ingress.kubernetes.io/force-ssl-redirect": "true",

diff --git a/training-portal/requirements.txt b/training-portal/requirements.txt
@@ -1,5 +1,5 @@
 mod_wsgi==5.0.0
-Django==4.2.15
+Django==4.2.16
 django-registration==3.4
 django-crispy-forms==2.1
 crispy-bootstrap5==2023.10

diff --git a/workshop-images/base-environment/opt/gateway/package-lock.json b/workshop-images/base-environment/opt/gateway/package-lock.json
diff --git a/workshop-images/base-environment/opt/gateway/package.json b/workshop-images/base-environment/opt/gateway/package.json
@@ -24,9 +24,9 @@
     "cors": "^2.8.5",
     "css-element-queries": "^1.2.3",
     "elliptic": ">=6.5.4",
-    "express": "^4.21.0",
+    "express": "^4.21.1",
     "express-basic-auth": "^1.2.1",
-    "express-session": "^1.17.3",
+    "express-session": "^1.18.1",
     "fontfaceobserver": "^2.3.0",
     "glob": "^10.3.10",
     "http-proxy-middleware": "^2.0.6",

diff --git a/workshop-images/base-environment/opt/helper/package-lock.json b/workshop-images/base-environment/opt/helper/package-lock.json
diff --git a/workshop-images/base-environment/opt/helper/package.json b/workshop-images/base-environment/opt/helper/package.json
@@ -27,7 +27,7 @@
 		"watch": "tsc -watch -p ./"
 	},
 	"dependencies": {
-		"express": "^4.21.0",
+		"express": "^4.21.1",
 		"regexp-match-indices": "^1.0.2",
 		"yaml": "^1.10.2",
 		"ansi-regex": ">=6.0.1",