Aad-pod-identity: HTTP 200 returned for 404 Body text

Created on 14 Jan 2021 · 1Comment · Source: Azure/aad-pod-identity

Have you

[x] Read Troubleshooting Guide
[x] Read Known Issues
[x] Searched on GitHub issues

Describe the bug
After installing aad-pod-identity to an Azure Kubernetes Service cluster, calls to the metadata endpoint that previously returned 404, now return 200 while the body is still a 404 error.

Steps To Reproduce
Create an Azure Kubernetes Service cluster.
Log into a pod with the curl command available.
Run curl -i http://169.254.169.254/openstack/latest/meta_data.json
Get:

# curl -i http://169.254.169.254/doesnotexist
HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/10.0
Date: Thu, 14 Jan 2021 17:01:03 GMT
Content-Length: 1245

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>404 - File or directory not found.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;} 
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;} 
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} 
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
 <div class="content-container"><fieldset>
  <h2>404 - File or directory not found.</h2>
  <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
 </fieldset></div>
</div>
</body>
</html>

Install AAD Pod Identity as per https://azure.github.io/aad-pod-identity/docs/getting-started/installation/#quick-install

Re-run the above command:

# curl -i http://169.254.169.254/doesnotexist
HTTP/1.1 200 OK
Content-Type: application/json
Date: Thu, 14 Jan 2021 17:01:31 GMT
Content-Length: 1245

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>404 - File or directory not found.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
 <div class="content-container"><fieldset>
  <h2>404 - File or directory not found.</h2>
  <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
 </fieldset></div>
</div>
</body>
</html>

Note that whilst the body has remained the same, the headers have changed. Instead of 404 not found, and content type text, it's now 200, and JSON.

Expected behavior
The second command returns a 404 code.

AAD Pod Identity version
1.7.1

Kubernetes version
1.18.10

Additional context
I discovered this issue whilst using a Postgresql Operator which utilises Spilo. It failed to start, which I tracked back to this line - https://github.com/zalando/spilo/blob/5138179fd94bd5268d455a39c66ff5e6c1ef8a06/postgres-appliance/scripts/configure_spilo.py#L390. Because the 200 is returned instead of 404, the check is OK, and because the header says it's json, rather than text, it's trying to decode json, which throws an exception. I am reporting this separately to that repo, but the core issue I believe is in aad-pod-identity.

Edit - This is the issue reported in the Spilo repo - https://github.com/zalando/spilo/issues/542

bug

Source

keyz182

Most helpful comment

Thanks for opening the issue. I can also reproduce this. The fix should be simple and I will put this issue in our next milestone (releasing within the next two weeks)

chewong on 14 Jan 2021

👍2

>All comments

Thanks for opening the issue. I can also reproduce this. The fix should be simple and I will put this issue in our next milestone (releasing within the next two weeks)

chewong on 14 Jan 2021

👍2

Was this page helpful?

0 / 5 - 0 ratings