Skip to content

fix: Add ingress for grafana report #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
duchieu2k wants to merge 1 commit into
base: main
Choose a base branch
from
+136 −0
Open

fix: Add ingress for grafana report #121

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
136 changes: 136 additions & 0 deletions kubernetes/report-ui/templates/refelx-grafana-ingress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,136 @@
{{- $basehref := .Values.backend.config.basehref | default "" -}}
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Filename typo: refelx should be reflex.

The file is named refelx-grafana-ingress.yaml but based on the naming convention of other files in this directory (reflex-backend-svc.yaml, reflex-frontend-svc.yaml), it should be reflex-grafana-ingress.yaml.

🧰 Tools
🪛 YAMLlint (1.38.0)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@kubernetes/report-ui/templates/refelx-grafana-ingress.yaml` at line 1, The
file name contains a typo: rename the template file from
refelx-grafana-ingress.yaml to reflex-grafana-ingress.yaml to match the project
naming convention; update any references to this template elsewhere in the
chart/manifest (e.g., Chart templates, values, or include references) so they
point to reflex-grafana-ingress.yaml and ensure the template internals (the
$basehref variable) remain unchanged.

{{- $grafana_enabled := false -}}
{{- if .Values.global }}
{{- if .Values.global.grafana }}
{{- $grafana_enabled = .Values.global.grafana.enabled }}
{{- end }}
{{- end }}


{{- if $grafana_enabled }}

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/configuration-snippet: |
if ($arg_user) {
set $user $arg_user;
}
if ($arg_hostgroup) {
set $hostgroup $arg_hostgroup;
}
if ($arg_orgId) {
set $orgId $arg_orgId;
}
if ($arg_report) {
set $report $arg_report;
}
if ($user = "") {
return 401;
}
if ($hostgroup = "") {
return 401;
}
if ($orgId = "") {
return 401;
}
if ($report = "") {
return 401;
}
if ($http_referer ~ "^https://(.*)/grafana/d/(.*)orgId=([0-9]+)(.*)") {
set $referer_orgId $3;
set $cookie_valid 1;
}
if ($referer_orgId != $orgId) {
set $cookie_valid 0;
return 401;
}
if ($cookie_valid = 1) {
add_header Set-Cookie "ref_grafana_path=$http_referer; Path=/; HttpOnly; Secure; Samesite=Lax; Max-Age=86400";
add_header Set-Cookie "ref_grafana_user=$user; Path=/; HttpOnly; Secure; Samesite=Lax; Max-Age=86400";
add_header Set-Cookie "ref_grafana_hostgroup=$hostgroup; Path=/; HttpOnly; Secure; Samesite=Lax; Max-Age=86400";
add_header Set-Cookie "ref_grafana_orgId=$orgId; Path=/; HttpOnly; Secure; Samesite=Lax; Max-Age=86400";
add_header Set-Cookie "ref_grafana_report=$report; Path=/; HttpOnly; Secure; Samesite=Lax; Max-Age=86400";
#ref_grafana_session already set from grafana ingress
set $redirect_url "$scheme://$host{{ $basehref }}/report/grafana/$report/";

return 302 $redirect_url;
}
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
name: grafana-redirect-report-ingress
spec:
ingressClassName: {{ .Release.Name }}
rules:
- http:
paths:
- backend:
service:
name: {{ .Chart.Name }}-frontend
port:
number: {{ .Values.frontend.service.port }}
path: "{{ $basehref }}/grafana-redirect-report-nmaa(/|$)(.*)"
pathType: Prefix
Comment on lines +61 to +74
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Missing use-regex annotation and incorrect pathType for regex path.

The path "{{ $basehref }}/grafana-redirect-report-nmaa(/|$)(.*)" contains regex patterns, but:

  1. The nginx.ingress.kubernetes.io/use-regex: "true" annotation is missing (compare to lines 91 and 121)
  2. pathType: Prefix should be pathType: ImplementationSpecific when using regex (compare to line 104)

Without these changes, NGINX won't interpret the regex and the path matching will fail.

🐛 Proposed fix 
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/use-regex: "true"
   name: grafana-redirect-report-ingress
 spec:
   ingressClassName: {{ .Release.Name }}
   rules:
   - http:
       paths:
       - backend:
           service:
             name: {{ .Chart.Name }}-frontend
             port:
               number: {{ .Values.frontend.service.port }}
         path: "{{ $basehref }}/grafana-redirect-report-nmaa(/|$)(.*)"
-        pathType: Prefix
+        pathType: ImplementationSpecific
🧰 Tools
🪛 YAMLlint (1.38.0)

[error] 64-64: too many spaces inside braces

(braces)

[error] 64-64: too many spaces inside braces

(braces)

[error] 70-70: too many spaces inside braces

(braces)

[error] 70-70: too many spaces inside braces

(braces)

[error] 72-72: too many spaces inside braces

(braces)

[error] 72-72: too many spaces inside braces

(braces)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@kubernetes/report-ui/templates/refelx-grafana-ingress.yaml` around lines 61 -
74, The ingress rule using the regex path "{{ $basehref
}}/grafana-redirect-report-nmaa(/|$)(.*)" is missing the nginx annotation to
enable regex and uses the wrong pathType; update the
grafana-redirect-report-ingress resource by adding the annotation
nginx.ingress.kubernetes.io/use-regex: "true" alongside the existing annotations
and change pathType from Prefix to ImplementationSpecific for the path entry so
NGINX will evaluate the regex correctly.


---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_set_header X-GRAFANA-USER "$cookie_ref_grafana_user";
proxy_set_header X-GRAFANA-HOSTGROUP "$cookie_ref_grafana_hostgroup";
proxy_set_header X-GRAFANA-ORGID "$cookie_ref_grafana_orgId";
if ($cookie_ref_grafana_session = "") {
return 401;
}
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$1$2
nginx.ingress.kubernetes.io/use-regex: "true"
name: report-be-grafana-ingress
spec:
ingressClassName: {{ .Release.Name }}
rules:
- http:
paths:
- backend:
service:
name: {{ .Chart.Name }}-backend
port:
number: {{ .Values.backend.service.port }}
path: "{{ $basehref }}/(_event|ping|_upload)(/.*)?$"
pathType: ImplementationSpecific

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_set_header X-GRAFANA-USER "$cookie_ref_grafana_user";
proxy_set_header X-GRAFANA-HOSTGROUP "$cookie_ref_grafana_hostgroup";
proxy_set_header X-GRAFANA-ORGID "$cookie_ref_grafana_orgId";
if ($cookie_ref_grafana_session = "") {
return 401;
}
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/session-cookie-path: "{{ $basehref }}/report/grafana/"
nginx.ingress.kubernetes.io/use-regex: "true"
name: report-fe-grafana-ingress
spec:
ingressClassName: {{ .Release.Name }}
rules:
- http:
paths:
- backend:
service:
name: {{ .Chart.Name }}-frontend
port:
number: {{ .Values.frontend.service.port }}
path: "{{ $basehref }}/report/grafana/(.*)"
pathType: Prefix
Comment on lines +133 to +134
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Incorrect pathType for regex path.

The path contains a regex capture group (.*) and the ingress has use-regex: "true", but pathType: Prefix should be pathType: ImplementationSpecific for consistency with the backend ingress at line 104.

🔧 Proposed fix 
         path: "{{ $basehref }}/report/grafana/(.*)"
-        pathType: Prefix
+        pathType: ImplementationSpecific
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
path: "{{ $basehref }}/report/grafana/(.*)"
pathType: Prefix
path: "{{ $basehref }}/report/grafana/(.*)"
pathType: ImplementationSpecific
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@kubernetes/report-ui/templates/refelx-grafana-ingress.yaml` around lines 133
- 134, The ingress path entry using the regex path "path: \"{{ $basehref
}}/report/grafana/(.*)\"" currently sets "pathType: Prefix" which is incorrect
for regex paths; update that path's "pathType" to "ImplementationSpecific"
(matching the other backend ingress entry that uses use-regex: \"true\") so the
regex capture group is handled correctly and consistent behavior is maintained
with the existing backend ingress configuration.


{{- end }}
Loading