question Re: Setting up Nifi Registry with Nginx in Support Questions

Setting up Nifi Registry with Nginx

Bryson — Mon, 22 Jan 2024 17:39:47 GMT

We are working on deploying the NiFi Registry platform on kubernetes, however, we are hitting some issues. I've added a diagram of our deployment to help give some context as well.

Test Case 1: When proxying NiFi registry with settings as unsecure, the proxying works fine. We are able to connect to https://nifi-registry.company.domain.com and view the registry as needed. Note the HTTPS in the URL still - we are using SSL offloading in our nginx's.

Test Case 2: When proxying NiFi registry with settings as secure, we get ERR_TOO_MANY_REDIRECTS. I have attached our nifi-registry.properties file as well. One thing that we found interesting, was that when we tried the below curl request from within the pod we get back a normal response

curl -k --cacert /opt/nifi-registry/nifi-registry-current/tls/cert-manager/ca.crt --key /opt/nifi-registry/nifi-registry-current/tls/cert-manager/tls.key --cert /opt/nifi-registry/nifi-registry-current/tls/cert-manager/tls.crt https://localhost:18443/nifi-registry -vvvvvv -sS -D -

The certs are valid as they are generated by cert manager. We are looking for any assistance that you can give, but some of our main questions are as follows:

In our kubernetes ingress details, should we set the path to just `/` or `/nifi-registry`?
Is it possible that the NiFi registry is redirecting the client from the HTTPS endpoint a normal HTTP endpoint? We see in the browser network tab that it seems to flip back and forth.
Is it 100% required to have the authorizers.xml completed in order to get this working?
Any other ideas of what could be causing this?

Re: Setting up Nifi Registry with Nginx

DianaTorres — Mon, 22 Jan 2024 18:55:42 GMT

@Bryson Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our NiFi Registry experts @ashinde @dyadav1 who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

Re: Setting up Nifi Registry with Nginx

Bryson — Fri, 26 Jan 2024 13:09:30 GMT

Hi @DianaTorres / @ashinde / @dyadav1 - do you have any tips for this? we're still kind of stuck on this issue

Re: Setting up Nifi Registry with Nginx

DianaTorres — Fri, 26 Jan 2024 17:21:39 GMT

@bbahamondes @haridjh @ArtiW Do you have any insights here? Thanks!

Re: Setting up Nifi Registry with Nginx

Mosby — Wed, 31 Jan 2024 10:53:52 GMT

I can answer your first question, the path at the ingress needs to be "/".

If you share more information about your setup (like the yaml files used for deploying), I might be able to help you more.

Re: Setting up Nifi Registry with Nginx

DianaTorres — Mon, 05 Feb 2024 22:35:23 GMT

@Bryson Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. If you are still experiencing the issue, can you provide the information @Mosby has requested? Thanks.

Re: Setting up Nifi Registry with Nginx

Bryson — Tue, 06 Feb 2024 14:47:50 GMT

Apologies for the delay, I am currently using the helm chart: https://github.com/dysnix/charts/tree/main/dysnix/nifi-registry so I posted the values files that are generated from it.

If you need the actual kubernetes yaml, I can post that too, but I figured giving you the helm chart and values would do the same thing with less files

Re: Setting up Nifi Registry with Nginx

Mosby — Thu, 08 Feb 2024 07:45:57 GMT

To use the certificates stored in the NiFi-Registry you would need to set the ingress to SSL-Passthrough, which means removing the annotiation "nginx.ingress.kubernetes.io/backend-protocol: HTTPS" and replacing it with "

nginx.ingress.kubernetes.io/ssl-passthrough: "true""

Also this feature needs to be enabled at the ingress-controller TLS/HTTPS - Ingress-Nginx Controller (kubernetes.github.io) for it to work.

- at least, thats what yorked for our setup, YMMV

Re: Setting up Nifi Registry with Nginx

Bryson — Fri, 09 Feb 2024 02:19:11 GMT

Okay, so I just tried this and it didnt work sadly... I still get ERR_TOO_MANY_REDIRECTS

Re: Setting up Nifi Registry with Nginx

Mosby — Tue, 26 Mar 2024 07:39:03 GMT

Are you still in the need of help? Somehow i did not get a notification

This is our config, maybe it helps:

apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nifi-ingress namespace: nifi labels: app: nifi annotations: nginx.ingress.kubernetes.io/ssl-passthrough: "true" spec: ingressClassName: nginx rules: - host: <url> http: paths: - path: / pathType: Prefix backend: service: name: nifi-service port: number: 8443 tls: - hosts: - <url>