Here’s a quick post on how to configure Azure Application Gateway for any instance of Kibana that is being protected will work.
Background:
I’m working with a private OpenShift cluster deployed to Azure (not ARO, it was deployed via IPI), that I want to publish to the public, but protected via the App GW WAF.
Once the cluster had been deployed and is published via the App Gateway, when trying to access Kibana, an internal 500 error was displayed. If accessing directly from within the virtual network, it worked fine, so I know it’s definitely the App Gateway causing the issue.
Looking at the Kibana logs, I saw the following:
Although I obfuscated my Public IP address, you’ll notice that the port is appended, could this be the problem? (of course the answer is yes, IP address:port isn’t a valid IP address!)
The error message kind of gives the clue:
"message": "Cannot resolve address x.x.x.x:50735: [security_exception] Cannot resolve address x.x.x.x:50735"I needed to figure out how to rewrite the request header so it would work
(I won’t talk about how I setup backend address pools, http settings, frontend ports, listeners and probes, as that will be part of future in-depth post on how to do it, but I will describe a particular rewrite rule required so that Kibana works.)
X-Forwarded-For Rewrite Rule
The offending header is X-Forwarded-For . This is added by the Application Gateway which includes the IP + port. Microsoft describe this here.
From the portal, open up your Application Gateway and open up Rewrites
Add a Rewrite set
Give your rule a name that is something meaningful, or just go with the defaults.
Click on the Click to configure this action link (1) and enter the settings below. Once configured, don’t forget to Update the rewrite set.
Once the rewrite rule was in place, Kibana opened as expected.