Cruise control API - Cannot enable CORS

[aventi-lasith]

I'm trying to enable CORS for the cruise control API.

I have created a separate LoadBalancer resource to access the API

apiVersion: v1
kind: Service
metadata:
  labels:
    strimzi.io/cluster: kafka-cluster
    strimzi.io/kind: Kafka
    strimzi.io/name: kafka-cluster-cruise-control
  name: cruise-control-api
  namespace: kafka
spec:
  ports:
    - port: 9090
      targetPort: 9090
  type: LoadBalancer
  selector:
    strimzi.io/cluster: kafka-cluster
    strimzi.io/kind: Kafka
    strimzi.io/name: kafka-cluster-cruise-control

Then, I updated my Kafka resource to enable CORS.

-----
  cruiseControl:
    metricsConfig:
      --------
    config:
      webserver.security.enable: false
      webserver.ssl.enable: false
      webserver.http.cors.enabled: true
      webserver.http.cors.origin: "*"
      webserver.http.cors.exposeheaders: "User-Task-ID,Content-Type"
      webserver.http.cors.allowmethods: "OPTIONS,GET,POST"

Not sure what I'm missing here but, cruise control API cannot be accessed.

This is the log file of the cruise control pod.
cclogs.log

I appreciate any help.
Thanks!

PS: I'm using the operator version 0.32.0

[scholzj]

I think these fields might not be user-configurable.

[aventi-lasith]

@scholzj Actually you can. It's explained here: https://strimzi.io/docs/operators/latest/configuring.html#type-CruiseControlSpec-reference

[aventi-lasith]

@scholzj Any update on this? Shouldn't we change this back to a bug?

[scholzj]

I guess you should for s atrt share the full Kafka custom resource including the status section and the operator and Cruise Control logs.

@kyguy any idea? ^^^

[kyguy]

Based on @aventi-lasith's comment below, I assume this issue surrounds setting up the Cruise Control UI [1] with Strimzi-managed Cruise Control. If that is the case, the most likely reason why the UI is not connecting to the CC API is because the cross-origin request to the CC API is failing. Most (all) modern browsers will not set required CORs headers, access-control-allow-credentials, in its HTTP requests if the webserver.http.cors.origin config of the cross-origin server, Cruise Control in this case, is set to a wildcard value, "*". To get around this issue/browser security, set Cruise Control's webserver.http.cors.origin config to the origin address of the browser.

[1] https://github.com/linkedin/cruise-control-ui

[aventi-lasith]

@kyguy, Your assumption is correct. I was trying to setup cruise control with Strimzi-managed Cruise Control.

But like you said, I was already settings the wildcard value, "*" as I have mentioned above.

-----
  cruiseControl:
    metricsConfig:
      --------
    config:
      webserver.security.enable: false
      webserver.ssl.enable: false
      webserver.http.cors.enabled: true
      webserver.http.cors.origin: "*"
      webserver.http.cors.exposeheaders: "User-Task-ID,Content-Type"
      webserver.http.cors.allowmethods: "OPTIONS,GET,POST"

[kyguy]

So just to reiterate, setting webserver.http.cors.origin to * is likely the cause of the CORS failures for this issue/use case. When connecting the Cruise Control UI to a Strimzi-managed Cruise Control instance webserver.http.cors.origin must be set to the origin address of the browser accessing the Cruise Control UI and NOT a wildcard address like "*"

[aventi-lasith]

I gave up trying to enable CORS and took a different approach as described here.
https://strimzi.io/blog/2023/01/11/hacking-for-cruise-control-ui/