Possible Issues and Solutions in Apinizer

If the value 'GetCapabilities' in the 'request' key as a query parameter comes in the URL, it should be replaced with the corresponding address in Apinizer using a Business Rule or Script policy to be added to the second region.

In the Kubernetes NodePort structure, if the X-Forwarded-For value is not coming from the client, it defaults to forwarding the pod's IP address to the backend application. As a solution, setting the externalTrafficPolicy value to Local can resolve the issue. However, this leads to accessibility problems because NodePort doesn't route the incoming request to other servers in the cluster. You need to know the specific Node to access it.

Since Apinizer Workers will be placed behind a structure like Nginx or F5, the configuration file of the relevant load balancer needs to include adding the xff information to the header, as shown below.

# For Nginx, the configuration can be done as follows:

location /apigateway/ {

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_pass http://api.inst.com/apigateway/;
} # end location

This issue is not directly related to Apinizer but is related to the default settings of Nginx, which might be used in front of Apinizer.

Nginx is commonly used as a web server and reverse proxy server. However, in the default configuration of Nginx, HTTP headers with underscores (_) in their names are not processed and passed. This is due to underscores not being standard in the HTTP RFC.

To resolve this issue, you should set the underscores_in_headers directive to on in the Nginx configuration file. This allows Nginx to correctly handle headers containing underscores.

vi /etc/nginx/nginx.conf

http {

underscores_in_headers on;

}

for ingress;

apiVersion: v1

kind: ConfigMap

metadata:

  name: nginx-configuration

  namespace: ingress-nginx

  labels:

    app: ingress-nginx

data:

  enable-underscores-in-headers: "true"

The public certificate of the relevant address must be added to Apinizer from the Certificate Management page.

If there is no browser that can access the address, use the openssl command with a server that has openssl installed and can access the address:

openssl s_client -showcerts -connect server.com:443 </dev/null 2>/dev/null|openssl x509 -outform PEM > serverscertfile.pem

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
data:
  use-forwarded-headers: "true"

The "nginx.ingress.kubernetes.io/use-forwarded-headers" key should be added to the annotation section of the Ingress source definition with the value "true". The sample yaml file should look like this:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apinizer-manager-ingress
  namespace: apinizer
  annotations:
    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"

On the load balancer side, one of the following headers must come:

XFF
Proxy-Client-IP
WL-Proxy-Client-IP
HTTP_X_FORWARDED_FOR
HTTP_X_FORWARDED
HTTP_X_CLUSTER_CLIENT_IP
HTTP_CLIENT_IP
HTTP_FORWARDED_FOR
HTTP_FORWARDED
HTTP_VIA
REMOTE_ADDR