GitLab Geo Group, 15 Sep 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Geo Secondary Proxying and Single URL demo

Description

Catalin from the Geo team demos recent work to support proxying requests from a Geo secondary web UI and API to a Geo primary site. This work will allow administrators to put Geo primary and secondary sites behind a single URL, making secondaries more transparent and usable for developers.

For more details: https://gitlab.com/groups/gitlab-org/-/epics/5914

A

Awesome um and now I have a short demo for the secondary proxy work yeah, so I've used the gt1 key environment, um which you set up and I'll show my screen.

A

So, essentially, on the secondary as per the world issue, I've enabled the workhorse environment variable json, proxy, and I've also enabled the feature beforehand.

A

The feature flag: I've used um just two random domains: primary dot, cut test and secondary. I just point them to that piece explicitly in slash dc. Slash was just to make it clear so now they are each pointing to each site's ip address, and if we go there, I'm going to sync just to make sure there is no existing copies or anything.

A

I think I was here before not sure how it was logged in on incognito.

B

There's also a large black box on the right side.

A

uh Yeah, let me minimize that I think that's zoom, sorry about that yeah, okay, so um this is essentially the the login screen. However, it's the regular login screen, so it's essentially proxying authentication to the primary.

A

I'm authenticating here.

A

I'm now logged in using the secondary domain and I actually see the content proxy through the primary. So if, for example, I go to project.

A

I can create an issue doing any write operations through this secondary.

A

If I need to go to a specific geopage for the secondary, let's say the qi admin page.

A

We're going to see it from this journal's perspective perspective, so this won't be proxied to the primary and then we can also access the primary as usual.

A

C

A

Two separate domains and now we're going to try to make this work with one single domain for both the primary and the secondary. um This will I'm just going to point them both to the same ip here, which is likely of the secondary just make it clear.

B

And then I'm going to okay, so for the for the non-technical folks, like me, what you're doing is you're taking these external ips, which are your gcp instances and you're internally mapping them to these names on your hosts, so that you can use them in the browser like right.

A

A

Actually, just before I do that, let me also change the node url in the ui, um just to mention that the secondary.

A

Is going to be.

A

Located at the primary url, so I'm going to use the same same external url for both and that will be primary test.

A

And now changing them to be both on the same url.

A

And the reconfigure happened and, oh sorry, I stopped my mistake: uh where is you okay back now?

A

Okay, so now I'm opening incognito again um going to primary look dot cut test, which is now my single url for both instances, um probably still wait a few seconds for for it to come back up.

A

Okay, so it's not back up.

A

A

Now I'm looking down primarily which in my case, we know that we've pointed it explicitly to the secondary address, so this is basically using the primary url, but going to the secondary directly. This is essentially how let's say a load. Balancer would.

A

Redirect specific traffic only to the secondary.

A

So again, this would act like a primary. We can go to a project, we can create an issue.

A

But then also because we know we are on a secondary because we pointed it explicitly to here when we go to add bean and we go to geo. For example, we're going to see the authorization happening and then we'll see the geospecific secondary page. For this one.

B

D

Just worked, it's so boring because it looks so normal um question. Why do we see the authorization happening there? If you, if you visit the yeah.

A

Because um because um this page is not proxy for workhorse, so when we access this page, but authorization never happened before, we don't have a cookie for the secondary site. Okay,.

D

A

Authentication again, yeah, okay,.

D

So be on, on the first time that you.

A

Yeah yeah afterwards very fresh. It won't happen again.

C

I think we should change the messaging on top because, like instead of saying this is a read only to your site, yeah say this page is not accessible here or something like that.

B

B

It's it's weird because I feel very anticlimactic, but essentially the state now with this like once these two mrs get get merged that are outstanding right, is that we do support secondaries with a separate url which is kind of the status quo as it is for all of our customers, because they that's what they needed to use, but if they actually switch to a single url for everything it just works as well.

B

So with this change, we've essentially eliminated the read-only web interface.

B

And it's now gone and now to a regular user who is not an admin and who will not be able to see the node screens. They won't know the difference, but they will actually get.

B

You know served by the secondary at that moment in time.

B

So it's fully transparent, essentially correct yep cool.

A

Awesome, don't stop sharing.

D

Cool thanks so much for the demo. I will stop recording now.