Jolokia always accessed via TLS on OpenShift 3.4 about agent-bond HOT 7 CLOSED

So actually the standard setup for Jolokia on OpenShift looks like this for an external access:

Browser ---> (openshift token auth) --> OpenShift API Server ---> TLS w. client certs ---> POD with Jolokia.

So Jolokia normally only accepts by default only accepts connections from the OpenShift API server, but this should be sufficient to let it connect through the OpenShift console (with included hawt.io).

And the error message above is for the connection OpenShift API server to Jolokia, not your Browser to Jolokia. Your Browser cannot reach Jolokia directly. And since the OpenShift API server will always use TLS to contact Jolokia there is no option which would change this.

When you start your application in the oc logs <pod>, one of the first lines gives you the startup command of the application.

Could you please post this here to see how your concrete configuration is ? Actually you have to configure Jolokia for TLS (not vice versa).

from agent-bond.

The application starts with the following (slightly anonymized) message:

Starting the application using the bundled /deployments/bin/run.sh ...
Launching application in folder: /deployments
Running  java  -Xmx1500m -Djava.security.egd=file:/dev/./urandom -XX:+ExitOnOutOfMemoryError -XX:+UseG1GC -Dspring.profiles.active=appagile  -jar /deployments/lib/xxx-SNAPSHOT.jar --spring.config.location=file:/etc/xxx-properties/
Picked up JAVA_TOOL_OPTIONS: -Duser.home=/home/jboss -Duser.name=jboss

Thanks for the explanations. I was hoping the API server will learn from the several environment settings that it must not access Jolokia via TLS but this is obviously not the case? Will try to configure TLS for Jolokia.

from agent-bond.

If you are using the FIS base images you can enable this very easily by setting the env var AB_JOLOKIA_AUTH_OPENSHIFT=yes. Then everything should be setup properly.

It's also, that you need the proper server cert to configure for Jolokia so that the API server will be able to connect to Jolokia. You see, the communication is heavily secured since having access to Jolokia means having control over your app.

from agent-bond.

And please also check tha AB_JOLOKIA_OFF is not set.

from agent-bond.

OK, should I drop Jolokia from Spring Boot then? I have configured it also as part of my application?

from agent-bond.

Yes, that would make sense. Alternatively, you could configure you Spring-boot enabled Jolokia agent to use the proper certs.

You can see the details how this is done here: https://github.com/fabric8io/agent-bond/blob/master/fish-pepper/jolokia/fp-files/jolokia-opts#L28-L49

But the easiest way is to use the Jolokia agent from the base image.

from agent-bond.

Thanks, that solved my problem!

from agent-bond.