Repository: emissary-ingress/emissary

Issue:
Prevent "/ambassador/v0/diag/" from shadowing other routes
Currently I have Ambassador setup to route HTTP into different services based on the incoming hostname, but it seems like the "/ambassador/v0/diag/" route will always respond no matter the incoming hostname. This page includes all the routes and information like Ambassador version number and internal hostname. Is it possible to disable this page and/or add routing rules to the routing rules (like, for example, restrict this page to only show up for a specific hostname)? Also, I may be configuring something wrong that is causing this page to show up for everything, so any help to point in the right direction would be awesome 👍 


Discussion:

Resolving patch:
diff --git a/ambassador/ambassador/config.py b/ambassador/ambassador/config.py
--- a/ambassador/ambassador/config.py
+++ b/ambassador/ambassador/config.py
@@ -1328,7 +1328,7 @@ def module_config_ambassador(self, name, amod, tmod):
         # as we find them.
         for key in [ 'service_port', 'admin_port', 'diag_port',
                      'liveness_probe', 'readiness_probe', 'auth_enabled',
-                     'use_proxy_proto', 'use_remote_address' ]:
+                     'use_proxy_proto', 'use_remote_address', 'diagnostics' ]:
             if amod and (key in amod):
                 # Yes. It overrides the default.
                 self.set_config_ambassador(amod, key, amod[key])


Test patch:
diff --git a/ambassador/tests/001-broader-v0/config/ambassador.yaml b/ambassador/tests/001-broader-v0/config/ambassador.yaml
--- a/ambassador/tests/001-broader-v0/config/ambassador.yaml
+++ b/ambassador/tests/001-broader-v0/config/ambassador.yaml
@@ -23,6 +23,10 @@ config:
   #   prefix: /ambassador/v0/are_you_ready_yet
   #   service: omg.omg:7777
 
+  # diagnostics overview defaults on, but you can disable the api route.
+  diagnostics:
+    enabled: false
+
   use_proxy_proto: True
   use_remote_address: True
   
diff --git a/ambassador/tests/001-broader-v0/gold.intermediate.json b/ambassador/tests/001-broader-v0/gold.intermediate.json
--- a/ambassador/tests/001-broader-v0/gold.intermediate.json
+++ b/ambassador/tests/001-broader-v0/gold.intermediate.json
@@ -793,30 +793,6 @@
                 "prefix_rewrite": "/",
                 "use_websocket": true
             },
-            {
-                "__saved": [
-                    0,
-                    15,
-                    0,
-                    "/ambassador/v0/",
-                    "GET"
-                ],
-                "_group_id": "b69eeb747b38f5e5fd3955d044ea7797d67d024f",
-                "_method": "GET",
-                "_precedence": 0,
-                "_referenced_by": [
-                    "ambassador.yaml.1"
-                ],
-                "_source": "ambassador.yaml.1",
-                "clusters": [
-                    {
-                        "name": "cluster_127_0_0_1_8877",
-                        "weight": 100.0
-                    }
-                ],
-                "prefix": "/ambassador/v0/",
-                "prefix_rewrite": "/ambassador/v0/"
-            },
             {
                 "__saved": [
                     1,
@@ -1110,7 +1086,7 @@
             "kind": "Module",
             "name": "ambassador",
             "version": "ambassador/v0",
-            "yaml": "apiVersion: ambassador/v0\nconfig:\n  tls:\n    client:\n      cacert_chain_file: /etc/ambassador-config/ca_cert_chain/tls.crt\n      cert_required: true\n      enabled: True,\n    server:\n      cert_chain_file: /etc/ambassador-config/certs/tls.crt\n      enabled: true\n      private_key_file: /etc/ambassador-config/certs/tls.key\n  use_proxy_proto: true\n  use_remote_address: true\nkind: Module\nname: ambassador\n"
+            "yaml": "apiVersion: ambassador/v0\nconfig:\n  diagnostics:\n    enabled: false\n  tls:\n    client:\n      cacert_chain_file: /etc/ambassador-config/ca_cert_chain/tls.crt\n      cert_required: true\n      enabled: True,\n    server:\n      cert_chain_file: /etc/ambassador-config/certs/tls.crt\n      enabled: true\n      private_key_file: /etc/ambassador-config/certs/tls.key\n  use_proxy_proto: true\n  use_remote_address: true\nkind: Module\nname: ambassador\n"
         },
         "auth-2.yaml.1": {
             "_source": "auth-2.yaml",
@@ -1347,4 +1323,4 @@
             "yaml": "apiVersion: ambassador/v0\nhost: h.datawire.io\nkind: Mapping\nname: precedence_100_mapping\nprecedence: 100\nprefix: /\nservice: precedence_one\n"
         }
     }
-}
\ No newline at end of file
+}
diff --git a/ambassador/tests/001-broader-v0/gold.json b/ambassador/tests/001-broader-v0/gold.json
--- a/ambassador/tests/001-broader-v0/gold.json
+++ b/ambassador/tests/001-broader-v0/gold.json
@@ -77,20 +77,6 @@
                         }
 
                       
-                    }
-                    ,
-                    
-                    {
-                      "timeout_ms": 3000,"prefix": "/ambassador/v0/","prefix_rewrite": "/ambassador/v0/",
-                        "weighted_clusters": {
-                            "clusters": [
-                                
-                                  { "name": "cluster_127_0_0_1_8877", "weight": 100.0 }
-                                
-                            ]
-                        }
-
-                      
                     }
                     ,
                     
@@ -607,4 +593,4 @@
   
   "statsd_udp_ip_address": "127.0.0.1:8125",
   "stats_flush_interval_ms": 1000
-}
\ No newline at end of file
+}
diff --git a/end-to-end/000-no-base/test.sh b/end-to-end/000-no-base/test.sh
--- a/end-to-end/000-no-base/test.sh
+++ b/end-to-end/000-no-base/test.sh
@@ -25,15 +25,47 @@ wait_for_pods
 
 CLUSTER=$(cluster_ip)
 APORT=$(service_port ambassador)
+APOD=$(ambassador_pod)
 
 BASEURL="http://${CLUSTER}:${APORT}"
 
 echo "Base URL $BASEURL"
-echo "Diag URL $BASEURL/ambassador/v0/diag/"
 
 wait_for_ready "$BASEURL"
 
-if ! check_diag "$BASEURL" 1 "No annotated services"; then
+check_diag () {
+    index=$1
+    desc=$2
+
+    rc=1
+
+    kubectl exec "$APOD" -c ambassador -- sh -c 'curl -k -s localhost:8877/ambassador/v0/diag/?json=true' | jget.py /routes > check-$index.json
+
+    if ! cmp -s check-$index.json diag-$index.json; then
+        echo "check_diag $index: mismatch for $desc"
+
+        if diag-diff.sh $index; then
+            diag-fix.sh $index
+            rc=0
+        fi
+    else
+        echo "check_diag $index: OK"
+        rc=0
+    fi
+
+    return $rc
+}
+
+if ! check_diag 1 "No annotated services"; then
+    exit 1
+fi
+
+diag_status=$(curl -s -o /dev/null -w "%{http_code}" "${BASEURL}/ambassador/v0/diag/?json=true")
+
+if [ "$diag_status" == 404 ]; then
+    echo "External diag access prevented"
+else
+    echo "External diag allowed? $diag_status" >&2
     exit 1
 fi