Enable Diagnostic UI in the internal k8s network only

Please describe your use case / problem. Since 1.6, when the diagnostics is disabled, the admin UI is not exposed to envoy, but it is also not exposed to the pod IP. It is only exposed the 127.0.0.1. This makes exposing the UI difficult. Our use case is that we have another ambassador group running, for all the admin UIs and we were exposing the public ambassador admin with this admin ambassador group. Now it returns Not found.

Describe the solution you’d like Right now, there is a flag diagnotics.enabled which is “true” or “false”. There are two options: Either we make this flag accept multiple values (ex: “disabled”, “enabled”, “pod_enabled_only”) instead of a bool, or we add a second flag, (ex pod_enabled: true) to enable the admin UI outside of the pod (but not publicly). (Names are probably bad, it’s just provided as example).

Additional context Initial discussion: https://datawire-oss.slack.com/archives/CAULN7S76/p1605206931353900

[kflynn]

I’d go with allow_non_local, but yes, after our discussion on Slack, I think that’s as good as you’re gonna get. Go for it. 🙂

[jfrabaute]

Actually… this is not related to the bind address. It’s just hardcoded in the code:

    enabled = app.ir.ambassador_module.diagnostics.get("enabled", False)
    if not enabled and not _is_local_request():
        return Response("Not found\n", 404)

so when I set diagnostics.enabled to false, it blocks the request from the request handler. diagnostics.enabled to true is adding the mappings which expose the diag UI to the outside world.

I might need to add something like expose_non_local: true ? So something like that?

      config:
        diagnostics:
          enabled: false
          expose_non_local: true

Maybe there is another way…