-
Notifications
You must be signed in to change notification settings - Fork 307
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use Traefik for Edge Agent service #24
Comments
Hi. No need to expose 8000. When you set up the Edge agent, you need to change the Portainer server URL to match the Edge entry point. |
Hummmm. So I set https://domain.tld in the config by the edge agent complained that it couldn't reach ws://endpoint on :8000 although it could reach the https:// on :443 |
When you add an edge agent, you need to change the Portainer server's URL to point edge.yourdomain.com. With the current configuration, with any request that came for that URL, Traefik will take and redirect to the port 800 in the container. Take note that you need to specify one URL for portainer UI that works in port 9000 and another URL for edge. Anyway, your proposal is valid, so, please, write in a new file to have both alternatives available. Thank you again for your contribution is very appreciated. |
Thanks and will do
…On Thu, 19 Nov 2020, 11:49 Ignacio Van Droogenbroeck, < ***@***.***> wrote:
When you add an edge agent, you need to change the Portainer server's URL
to point edge.yourdomain.com. With the current configuration, with any
request that came for that URL, Traefik will take and redirect to the port
800 in the container.
Take note that you need to specify one URL for portainer UI that works in
port 9000 and another URL for edge.
Anyway, your proposal is valid, so, please, write in a new file to have
both alternatives available.
Thank you again for your contribution is very appreciated.
Ignacio
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#24 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAHF5AFYSY6YK3SVAB3ZZT3SQUA5TANCNFSM4T2SRRAQ>
.
|
I probably have the same issue or missing something. I have deployed portainer with compose and I have a resolvable second URL (edge.mydomain.com) but edge agents are unable to connect with the following ERROR:
Edge URL is set when creating the edge endpoint as https://edge.mydomain.com and it is listening but the edge agent refuses to associate. My understanding was that proxying 8000 port with traefik on the separate URL is enough. |
Paste me the logs from Portainer && agent side @baskinsy
…On Tue, 22 Dec 2020 at 15:11, baskinsy ***@***.***> wrote:
I probably have the same issue or missing something. I have deployed
portainer with compose and I have a resolvable second URL (
edge.mydomain.com) but edge agents are unable to connect with the
following ERROR:
2020/12/22 15:04:25 [ERROR] [internal,edge,poll] [message: an error occured during short poll] [error: short poll request failed]
2020/12/22 15:04:30 [ERROR] [internal,edge,poll] [message: an error occured during short poll] [error: short poll request failed]
2020/12/22 15:04:35 [ERROR] [internal,edge,poll] [message: an error occured during short poll] [error: short poll request failed]
2020/12/22 15:04:40 [ERROR] [internal,edge,poll] [message: an error occured during short poll] [error: short poll request failed]
Edge URL is set when creating the edge endpoint as
https://edge.mydomain.com and it is listening but the edge agent refuses
to associate. My understanding was that proxying 8000 port with traefik on
the separate URL is enough.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#24 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAHF5AAZW54P25TOJCL7TVDSWCZJFANCNFSM4T2SRRAQ>
.
|
The only log on edge side is the above, on portainer side logs are not displaying anything at all. I made a clean test again to verify that and the only log I can find is the above ERROR on egde agent side.... |
I think the tokens are broken somehow. I get "Incorrect padding" when i try to decode the token copied from portainer here https://www.base64code.com/decode |
@baskinsy I had those errors when using the provided docker-compose. I opened :8000 direct to portainer and the agent connected. Try the compose file that proxies agent through Traefik |
Yes I read your proposal to proxy also 8000 but then is the communication secured? I would try it but that means the provided docker-compose does not work for edge agents as it seems. |
@baskinsy the ws:// on :8000 is (as I understand) encrypted |
Found the issue and was confirmed by a staff member on slack. The KEY generation is broken in my case due to I'm using a four level domain for URL (edge.staging.mydomain.com). |
Glad yr sorted. Opened an issue upsteam? I often use four.level.doma.is |
Yes seems the KEY cannot be decoded when a four level URL is used. When IP is used the decode works. I'll redeploy tomorrow with a third level URL on edge traefic vhost and report back if it works. |
@baskinsy Did you get it to work with a third level URL? xxxx.mydomain.com |
@hSinding Yes I had success on decoding a KEY with a third level domain but I have still issues to connect the edge agent, it is correctly added and registered but cannot be browsed. Although the KEY issue can be circumvent with a third level domain, at least for me. |
Same issue here, edge just won't connect:
But it seems to be a traefik misconfiguration because when I call the api endpoint manually I get 404 |
With a small hack I was able to make it work through Traefik : Portainer is setup in Traefik with :
You first need to decode the EDGE_KEY (using https://www.base64decode.org for example) in order to obtain the fingerprint and the endpoint ID. You should obtain something like: 3 being the endpoint ID, I modified it like that : and used https://www.base64encode.org (with URL-safe encoding enabled) to regenerate the key. |
@charnesp this was such a handy tip. Many thanks. Portainer-peeps - it'd be fantastic to be able to generate an EDGE_KEY from the UI that supports this configuration. At very least an additional (optional) field for the edge URL would help. |
@charnesp Thanks for the help. I'd like to add I had to add an extra step. With the new key, it complained about a deprecated MD5 fingerprint so I had to update it with a SHA256 fingerprint. No idea why. This really needs to be an option in the UI, or at least update the docs so it's not point edge as a separate url that doesn't work without the 8000 port open. |
Hello, I am currently trying to achieve the same: Manage an Edge Agent in a VM via Portainer behind Traefik running in WSL. As i described here, I try to browse an Edge Agent after successful association. The request to open the tunnel connection however goes to 127.0.0.1 and the connection fails.. Any advice? |
I'm had made it before like was described at this post #24 (comment) But agent communication is possible to solve with dns:port and entrypoint also, just needed added your port of edge into traefik ports:
And entrypoints:
And add second route for this service at portainer's side:
So, that expected, we are have portainer at Now, to access your edge, you just need to add the port to the dns name. |
In my case had to disable the tls and certresolver to make it work. |
Thanks @SAOPP your steps here helped me, but same as @tarmacx I had to disable tls as I was facing the below error:
I think I didn't understand this part. Where do you add the port? By the way, it seems that we are getting really close to the correct config template. We should edit the template on the official portainer docs |
Hi! I mean |
I tried setting things up like this but I'm getting |
Hi, Maybe an incorrectly generated key. You can use the following script for generating a corrected key :
|
Nope, that didn't do the trick |
Did you disabled TLS for your environment, or setup SSL certificate for Portainer? As Portainer is behind Traefik, which handles the HTTPS connections, you should use plain HTTP protocol. |
I've found the issue.. I had mistyped the service name in the traefik label, so the request wouldn't ever reach portainer. |
@Jigsaw5279 Please share the details for those who are likely to experience this in the future. |
@Jigsaw5279 / @SAOPP / @tarmacx anybody that was able to solve the bad handshake issue?
I followed the steps from @SAOPP:
Traefik uses letsencrypt certs. I added the edge agent with these settings: It does work when I remove the tls and certresolver labels without changing any other labels, so I'm quite sure it's not a mistyping of service names in the traefik labels... EDIT: Tried both with force https on/off, no changes. I have to remove the tls and certresolver labels to make this work... |
For long time I had similar problem, but error was a bit different (something with ws connection give up). Then I base64 decoded EDGE_KEY and replaced second parameter (edge server address) with Error has changed to bad handshake and then commenting out labels fixed the issue. Although that means certificates won't be automatically renewed at least it works. So I'm posting full configuration (in TypeScript instead of yaml) as it might help someone. Portainer + Portainer Edge services[portainerConfig.serviceName] = {
container_name: portainerConfig.serviceName,
image: `portainer/portainer-ee:2.16.2-alpine`,
command: `-H unix:///var/run/docker.sock`,
labels: [
`traefik.enable=true`,
// portainer-http
`traefik.http.routers.${portainerConfig.serviceName}-http.entrypoints=web`,
`traefik.http.routers.${portainerConfig.serviceName}-http.rule=Host(\`${portainerConfig.domain}\`)`,
`traefik.http.routers.${portainerConfig.serviceName}-http.middlewares=${traefikConfig.serviceName}-redirect-to-https`,
`traefik.http.routers.${portainerConfig.serviceName}-http.service=${portainerConfig.serviceName}`,
// portainer
`traefik.http.routers.${portainerConfig.serviceName}.entrypoints=websecure`,
`traefik.http.routers.${portainerConfig.serviceName}.rule=Host(\`${portainerConfig.domain}\`)`,
`traefik.http.routers.${portainerConfig.serviceName}.service=${portainerConfig.serviceName}`,
`traefik.http.routers.${portainerConfig.serviceName}.tls.certresolver=acmeresolver`,
`traefik.http.routers.${portainerConfig.serviceName}.tls.domains[0].main=${portainerConfig.domain}`,
`traefik.http.routers.${portainerConfig.serviceName}.tls=true`,
`traefik.http.services.${portainerConfig.serviceName}.loadbalancer.server.port=9000`,
// portainer-edge-http
`traefik.http.routers.${portainerConfig.serviceName}-edge-http.entrypoints=web`,
`traefik.http.routers.${portainerConfig.serviceName}-edge-http.rule=Host(\`${portainerConfig.edge.domain}\`)`,
`traefik.http.routers.${portainerConfig.serviceName}-edge-http.middlewares=${traefikConfig.serviceName}-redirect-to-https`,
`traefik.http.routers.${portainerConfig.serviceName}-edge-http.service=${portainerConfig.serviceName}-edge`,
// portainer-edge
`traefik.http.routers.${portainerConfig.serviceName}-edge.entrypoints=websecure`,
`traefik.http.routers.${portainerConfig.serviceName}-edge.rule=Host(\`${portainerConfig.edge.domain}\`)`,
`traefik.http.routers.${portainerConfig.serviceName}-edge.service=${portainerConfig.serviceName}-edge`,
// Commenting those out fixed bad handshake issue.
// `traefik.http.routers.${portainerConfig.serviceName}-edge.tls.certresolver=acmeresolver`,
// `traefik.http.routers.${portainerConfig.serviceName}-edge.tls.domains[0].main=${portainerConfig.edge.domain}`,
// `traefik.http.routers.${portainerConfig.serviceName}-edge.tls=true`,
`traefik.http.services.${portainerConfig.serviceName}-edge.loadbalancer.server.port=8000`,
],
networks: [`traefik-network`],
restart: `unless-stopped`,
volumes: [`/var/run/docker.sock:/var/run/docker.sock`, `${sharedConfig.docker.volumes.root}/${portainerConfig.serviceName}/data:/data`],
}; Portainer Edge Agent (different machine on the Internet) services[portainerAgentConfig.serviceName] = {
container_name: portainerAgentConfig.serviceName,
image: `portainer/agent:2.16.2-alpine`,
environment: {
EDGE: `1`,
EDGE_ID: `<ID>`,
EDGE_INSECURE_POLL: `0`,
EDGE_KEY: `<BASE64_DECODED_MODIFIED_AND_ENCODED_BACK_MANUALLY>`
},
labels: [`traefik.enable=false`],
networks: [`traefik-network`],
restart: `unless-stopped`,
volumes: [
`/var/run/docker.sock:/var/run/docker.sock`,
`/var/lib/docker/volumes:/var/lib/docker/volumes`,
`/:/host`,
`${sharedConfig.docker.volumes.root}/${portainerAgentConfig.serviceName}/data:/data`,
],
}; |
Thank you much this worked perfectly! |
Portainer communicates with the edge agent over port 8000 (as per Edge Agent Guide)
The example Traefik docker-compose does not expose :8000.
As Traefik can proxy any TCP traffic, let's use it?
The text was updated successfully, but these errors were encountered: