Greetings, May I assume that your need for 127.0.0.1 is so you can develop with?
Some History: Security Policies from the past tend to frown on "localhost", because some people wrote code that assumed if processes on running on the box, they are secure. This is not a good assumption. Also, 127.0.0.1, as an IP, is not unique... Every box has one. __ For that reason, SOME Security tooling (at least ones that AAF supports at AT&T) denies the use of 127.0.0.1 or "localhost". What to do instead: What works better is to come up with a valid name. For my local AAF Instances, I use "aaf.osaaf.org" (my ONAP Namespace). I then enter that name into /etc/hosts with supporting IP from "minikube" (which is how I run K8s). Ex 192.168.64.1 aaf.osaaf.org At this point, everything is validly running that I need in my K8s private net, and, of course, not accessible externally. For AAF, we get "hostname" onto a property file in docker through the use of "Init" docker. Let me know if you need to explore that part. -- Jonathan Gathman Principled-System Architect ATO Tech Dev/SEAT/Platform Architecture and Technology Management AT&T Services, Inc. m 314-550-3312 | [email protected] On 11/7/19, 5:46 AM, "Krzysztof Opasiak" <[email protected]> wrote: HI Sylvian, I did just some short lookup so this may not work but I think is worth to try: try setting the hostname property for locator as based on what I see in init logs: 2019-10-31 05:05:03,328+0000 2019-10-31T05:05:03.328+0000 INIT [init] hostname is not explicitly set 2019-10-31 05:05:03,328+0000 2019-10-31T05:05:03.328+0000 INIT [init] Hostname set to dev-aaf-aaf-locate-7c89f876c4-q7cdf which I think is generated by: // Setup Host, in case Network reports an unusable Hostname (i.e. VTiers, VPNs, etc) String hostname = logProp(access, HOSTNAME,null); if (hostname==null) { try { hostname = InetAddress.getLocalHost().getHostName(); } catch (UnknownHostException e1) { throw new CadiException("Unable to determine Hostname",e1); } } access.log(Level.INIT, "Hostname set to",hostname); in cadi/core/src/main/java/org/onap/aaf/cadi/config/Config.java so I believe that if you explicitly set this you should be able to force aaf to listen on all network interfaces or at least on localhost On 07.11.2019 11:44, [email protected] wrote: > Hi Krzysztof, > I agree but I also don't know how to do it in aaf ^_^. > > --- > Sylvain Desbureaux > > Le 07/11/2019 11:43, « Krzysztof Opasiak » <[email protected]> a écrit : > > Hi Sylvian, > > On 07.11.2019 11:39, Sylvain Desbureaux via Lists.Onap.Org wrote: > > Sorry, bad mail address > > > > --- > > > > Sylvain Desbureaux > > > > *De : *DESBUREAUX Sylvain TGI/OLN <[email protected]> > > *Date : *jeudi 7 novembre 2019 à 11:38 > > *À : *"[email protected]" <[email protected]> > > *Cc : *"[email protected]" <[email protected]>, > > "[email protected]" <[email protected]> > > *Objet : *[ONA][AAF] AAF with Istio/linkerd > > > > Hello Jonathan, > > > > I’m trying to make work ONAP on a kubernetes with service mesh (linkerd, > > istio and consul connect as service mesh). > > > > As these service meshes add “sidecars” to PODs, every requests sent to > > the pod is intercepted by the sidecar and sent back from the sidecar. It > > means that you need to listen on 127.0.0.1 and not on the public ip. > > > > Today, aaf-locate (and maybe others 😉) are listening on public ip. I’ve > > taken a look at the configuration and at the code and I don’t see if > > it’s possible to listen to 127.0.0.1 and if yes how to “tell” aaf-locate > > to do so… > > > > I’ve seen that in > > auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java, > > we use the hostname but I’m not sure how to “force” to 127.0.0.1. > > You don't need to force the localhost, you can just make sure that it > listens on all available interfaces (0.0.0.0) which shouldn't break > anything and then make it work also with istio;) > > > -- > Krzysztof Opasiak > Samsung R&D Institute Poland > Samsung Electronics > > > > _________________________________________________________________________________________________________________________ > > Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc > pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler > a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, > Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. > > This message and its attachments may contain confidential or privileged information that may be protected by law; > they should not be distributed, used or copied without authorisation. > If you have received this email in error, please notify the sender and delete this message and its attachments. > As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. > Thank you. > -- Krzysztof Opasiak Samsung R&D Institute Poland Samsung Electronics -- "Instrumental" PTL, AAF - ONAP Jonathan Gathman [email protected] -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#19378): https://lists.onap.org/g/onap-discuss/message/19378 Mute This Topic: https://lists.onap.org/mt/45686190/21656 Group Owner: [email protected] Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
