El redireccionamiento HTTPS de Cloud Load Balancing no funciona para un host específico
En mi equilibrador de carga tengo 6 hosts, en todos los hosts menos uno, la redirección HTTPS funciona perfectamente. Probé todas las configuraciones posibles y leí todos los documentos que proporciona Google (conceptos, guías prácticas, referencias), comohttps://cloud.google.com/load-balancing/docs/https/setting-up-http-https-redirect#setting_up_the_http_load_balancer en vano...
Lo que me vuelve loco es que en el mismo url-map
hay un host, cuyo redireccionamiento HTTPS funciona al 100%, que es una copia "idéntica" del que no funciona. Este es mi url-map
con los dos hosts aislados:
defaultUrlRedirect:
httpsRedirect: true
redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
stripQuery: false
hostRules:
- hosts:
# I'm not using an actual record for this particular host, the following two are real
- app.rocketseat.dev
pathMatcher: path-matcher-staging
- hosts:
- app.rocketseat.com.br
pathMatcher: path-matcher-production
- hosts:
- umbriel.rocketseat.dev
pathMatcher: path-matcher-umbriel
pathMatchers:
- defaultService: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/student-client-staging
name: path-matcher-staging
pathRules:
- paths:
- /api/*
routeAction:
urlRewrite:
pathPrefixRewrite: /
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendServices/app-staging
- paths:
- /*
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/student-client-staging
- paths:
- /admin
routeAction:
urlRewrite:
pathPrefixRewrite: /index.html
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/admin-client-staging
- paths:
- /admin/*
routeAction:
urlRewrite:
pathPrefixRewrite: /
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/admin-client-staging
- paths:
- /h
routeAction:
urlRewrite:
pathPrefixRewrite: /index.html
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/hubble-client-staging
- paths:
- /h/*
routeAction:
urlRewrite:
pathPrefixRewrite: /
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/hubble-client-staging
- paths:
- /favicon.ico
routeAction:
urlRewrite:
pathPrefixRewrite: /favicon.png
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/student-client-staging
- defaultService: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/student-client
name: path-matcher-production
pathRules:
- paths:
- /api/*
routeAction:
urlRewrite:
pathPrefixRewrite: /
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendServices/app
- paths:
- /*
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/student-client
- paths:
- /admin
routeAction:
urlRewrite:
pathPrefixRewrite: /index.html
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/admin-client
- paths:
- /admin/*
routeAction:
urlRewrite:
pathPrefixRewrite: /
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/admin-client
- paths:
- /h
routeAction:
urlRewrite:
pathPrefixRewrite: /index.html
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/hubble-client
- paths:
- /h/*
routeAction:
urlRewrite:
pathPrefixRewrite: /
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/hubble-client
- paths:
- /favicon.ico
routeAction:
urlRewrite:
pathPrefixRewrite: /favicon.png
service: https://www.googleapis.com/compute/v1/projects/my-project-id/global/backendBuckets/student-client
http://app.rocketseat.dev/api/hello
devoluciones:
{
"jsonPayload": {
"@type": "type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry",
"statusDetails": "response_sent_by_backend"
},
"resource": {
"type": "http_load_balancer",
"labels": {
"backend_service_name": "app-staging",
"forwarding_rule_name": "app-forwarding-rule-2",
"target_proxy_name": "app-target-https-proxy",
"url_map_name": "app-url-map"
}
},
"severity": "INFO"
}
http://app.rocketseat.com.br/api/hello
devoluciones
{
"jsonPayload": {
"@type": "type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry",
"statusDetails": "response_sent_by_backend"
},
"resource": {
"type": "http_load_balancer",
"labels": {
"backend_service_name": "app",
"forwarding_rule_name": "app-forwarding-rule",
"target_proxy_name": "app-target-http-proxy",
"url_map_name": "app-url-map"
}
},
"severity": "INFO"
}
Pensé que tal vez podría haber alguna diferencia en la configuración del servicio / depósito de backend, pero también son idénticos.
Salida adicional:
# gcloud compute url-maps describe app-http-url-map
defaultUrlRedirect:
httpsRedirect: true
redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
kind: compute#urlMap
name: app-http-url-map
selfLink: https://www.googleapis.com/compute/v1/projects/my-project-id/global/urlMaps/app-http-url-map
---
# gcloud compute target-http-proxies describe app-target-http-proxy
kind: compute#targetHttpProxy
name: app-target-http-proxy
selfLink: https://www.googleapis.com/compute/v1/projects/my-project-id/global/targetHttpProxies/app-target-http-proxy
urlMap: https://www.googleapis.com/compute/v1/projects/my-project-id/global/urlMaps/app-url-map
---
# gcloud compute target-https-proxies describe app-target-https-proxy
kind: compute#targetHttpsProxy
name: app-target-https-proxy
quicOverride: NONE
selfLink: https://www.googleapis.com/compute/v1/projects/my-project-id/global/targetHttpsProxies/app-target-https-proxy
sslCertificates:
- https://www.googleapis.com/compute/v1/projects/my-project-id/global/sslCertificates/xesque
- https://www.googleapis.com/compute/v1/projects/my-project-id/global/sslCertificates/europa
- https://www.googleapis.com/compute/v1/projects/my-project-id/global/sslCertificates/umbriel
- https://www.googleapis.com/compute/v1/projects/my-project-id/global/sslCertificates/flexbalancer
- https://www.googleapis.com/compute/v1/projects/my-project-id/global/sslCertificates/dev
- https://www.googleapis.com/compute/v1/projects/my-project-id/global/sslCertificates/app
urlMap: https://www.googleapis.com/compute/v1/projects/my-project-id/global/urlMaps/app-url-map
Respuestas
Según la información que proporcionó amablemente y en escenarios similares, es posible que haya configurado un mapa de URL para la redirección de HTTP a HTTPS. Considerando que, debe crear un mapa de URL HTTP cuyo único propósito es redirigir el tráfico al mapa de URL HTTPS donde configura las hostRules y pathMatchers.
En este ejemplo , "web-map-http" se crea únicamente para redirigir el tráfico HTTP al mapa URL HTTPS "web-map-https" y "web-map-https" es donde se configuran las hostRules y pathMatchers.
Cloud Console debe mostrar dos balanceadores de carga
La creación de un mapa de URL para la redirección de HTTP a HTTPS y las reglas de host podría funcionar, pero no es la forma recomendada.
Terminé dándome cuenta de que el problema no era con el host en sí, sino que la redirección HTTPS en mi mapa de URL solo funcionaba para dominios de Google Domains . Intenté migrar el resto de los dominios al mismo proveedor / servicio de DNS ( Google Cloud DNS ) pero la redirección aún no funcionó. ¿Algún tipo de redireccionamiento HTTP de nivel inferior o tal vez una integración entre GCP y Google Domains? No lo sé, nunca había visto algo así.
Una vez más, intenté seguir el ejemplo de redirección de HTTP a HTTPS . Nuevamente, no funcionó, si sigue el ejemplo, siempre encontrará un error 404 al acceder a la URL HTTP.
Pero si agrega una regla de host con un comparador de ruta como este al mapa de URL:
defaultUrlRedirect:
httpsRedirect: true
redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
stripQuery: false
hostRules:
- hosts:
- '*'
pathMatcher: path-matcher-wildcard
kind: compute#urlMap
name: app-http-url-map
pathMatchers:
- defaultUrlRedirect:
httpsRedirect: true
redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
stripQuery: false
name: path-matcher-wildcard
selfLink: https://www.googleapis.com/compute/v1/projects/my-project-id/global/urlMaps/app-http-url-map
Todo su tráfico será redirigido a HTTPS. :)