Dashboard 500 Internal Server Error after redirect from Gitlab Oauth2.0 w/ AWS ALB

[mylespollie]

I'm trying to secure the Linkerd dashboard using Gitlab Oauth2.0 ID Provider. We're using an AWS ALB as our ingress controller and after getting redirected from Gitlab to the dashboard, it displays a 500 Internal Server Error. Without the authentication piece the dashboard functions properly and is accessible on the public internet.

I'm struggling to debug this and was wondering if anyone had been able to get this setup or something similar working with authentication.

linkerd check

control-plane-version

	can retrieve the control plane version

control plane is up-to-date is running version 2.11.4 but the latest stable version is 2.12.0 see: https://linkerd.io/2.11/checks/#l5d-version-controlfor hints

kubernetes-api

	can query the Kubernetes API

kubernetes-version

	is running the minimum Kubernetes API version

linkerd-config

	control plane Namespace exists

	control plane ClusterRoles exist

	control plane ClusterRoleBindings exist

	control plane ServiceAccounts exist

	control plane CustomResourceDefinitions exist

	control plane MutatingWebhookConfigurations exist

	control plane ValidatingWebhookConfigurations exist

	proxy-init container runs as root user if docker container runtime is used

linkerd-existence

	'linkerd-config' config map exists

	heartbeat ServiceAccount exist

	control plane replica sets are ready

	no unschedulable pods

	control plane pods are ready

	cluster networks can be verified

	the following nodes do not expose a podCIDR: {IP}.us-west-2.compute.internal {IP}.us-west-2.compute.internal {IP}-2.compute.internal {IP}.us-west-2.compute.internal {IP}.us-west-2.compute.internal {IP}.us-west-2.compute.internal {IP}.us-west-2.compute.internal {IP}.us-west-2.compute.internal

see: https://linkerd.io/2.11/checks/#l5d-cluster-networks-verifiedfor hints

linkerd-version

	can determine the latest version

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: linkerd
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
    alb.ingress.kubernetes.io/healthcheck-path: '/'
    alb.ingress.kubernetes.io/healthcheck-port: traffic-port
    alb.ingress.kubernetes.io/success-codes: 200-499
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/certificate-arn: %CERTIFICATE%
    # Redirect to HTTPS at the ALB
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: '443'    
    # Authenticate with Gitlab
    alb.ingress.kubernetes.io/target-type: instance
    alb.ingress.kubernetes.io/auth-type: oidc
    alb.ingress.kubernetes.io/auth-scope: openid
    alb.ingress.kubernetes.io/auth-on-unauthenticated-request: authenticate
    alb.ingress.kubernetes.io/auth-idp-oidc: '{
      "issuer":"https://gitlab.${HOST}.com",
      "authorizationEndpoint":"https://gitlab.${HOST}.com/oauth/authorize",
      "tokenEndpoint":"https://gitlab.${HOST}.com/oauth/token",
      "userInfoEndpoint":"https://gitlab.${HOST}.com/oauth/userinfo",
      "secretName":"linkerd-oidc"
    }'
  name: linkerd
spec:
  rules:
  - host: %ENV_NAME%.linkerd.${HOST}.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ssl-redirect
            port: 
              name: use-annotation
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 8084

I looked into the "the following nodes do not expose a podCIDR" warning but it looks like it's only used in the health check so I wouldn't expect an application error from that.