Error securing dashboard w/ Gitlab OAuth2.0 & AWS load balancer controller

[mylespollie]

Wondering if anyone has tried using Gitlab OAuth2.0 for authentication to the dashboard or has used Linkerd with the AWS ALB Ingress controller?

I’m hitting a 500 Internal Server Error after being redirected to the dashboard from Gitlab. If I remove authentication, the dashboard is accessible at the specified host. Hoping someone has seen this before or could offer some help.

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: linkerd
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
    alb.ingress.kubernetes.io/healthcheck-path: '/'
    alb.ingress.kubernetes.io/healthcheck-port: traffic-port
    alb.ingress.kubernetes.io/success-codes: 200-499
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/certificate-arn: %CERTIFICATE%
    # Redirect to HTTPS at the ALB
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: '443'    
    # Authenticate with Gitlab
    alb.ingress.kubernetes.io/target-type: instance
    alb.ingress.kubernetes.io/auth-type: oidc
    alb.ingress.kubernetes.io/auth-scope: openid
    alb.ingress.kubernetes.io/auth-on-unauthenticated-request: authenticate
    alb.ingress.kubernetes.io/auth-idp-oidc: '{
      "issuer":"https://gitlab.${HOST}.com",
      "authorizationEndpoint":"https://gitlab.${HOST}.com/oauth/authorize",
      "tokenEndpoint":"https://gitlab.${HOST}.com/oauth/token",
      "userInfoEndpoint":"https://gitlab.${HOST}.com/oauth/userinfo",
      "secretName":"linkerd-oidc"
    }'
  name: linkerd
spec:
  rules:
  - host: %ENV_NAME%.linkerd.${HOST}.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ssl-redirect
            port: 
              name: use-annotation
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 8084

linkerd check

control-plane-version

	can retrieve the control plane version

control plane is up-to-date is running version 2.11.4 but the latest stable version is 2.12.0 see: https://linkerd.io/2.11/checks/#l5d-version-controlfor hints

kubernetes-api

	can query the Kubernetes API

kubernetes-version

	is running the minimum Kubernetes API version

linkerd-config

	control plane Namespace exists

	control plane ClusterRoles exist

	control plane ClusterRoleBindings exist

	control plane ServiceAccounts exist

	control plane CustomResourceDefinitions exist

	control plane MutatingWebhookConfigurations exist

	control plane ValidatingWebhookConfigurations exist

	proxy-init container runs as root user if docker container runtime is used

linkerd-existence

	'linkerd-config' config map exists

	heartbeat ServiceAccount exist

	control plane replica sets are ready

	no unschedulable pods

	control plane pods are ready

	cluster networks can be verified

	the following nodes do not expose a podCIDR: ip-10-133-100-53.us-west-2.compute.internal ip-10-133-100-66.us-west-2.compute.internal ip-10-133-104-26.us-west-2.compute.internal ip-10-133-73-179.us-west-2.compute.internal ip-10-133-74-56.us-west-2.compute.internal ip-10-133-79-157.us-west-2.compute.internal ip-10-133-80-238.us-west-2.compute.internal ip-10-133-90-69.us-west-2.compute.internal

see: https://linkerd.io/2.11/checks/#l5d-cluster-networks-verifiedfor hints

linkerd-version

	can determine the latest version

I'm also seeing a CORB warning in the console of the dashboard

Cross-Origin Read Blocking (CORB) blocked cross-origin response https://gitlab.${HOST}.com/oauth/authorize?client_id=***&redirect_uri=***%2Foauth2%2Fidpresponse&response_type=code&scope=openid&state=****** with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.