nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Bitbucket base URL problem

Tom Francis

Hi,

I have not seen any questions posted yet, so I hope I am doing this in the right place! I would open an issue, but I want to be sure it's an actual issue first so I chose to ask about it in here first.

I have configured Jira and Confluence using the Helm Charts and the base url always gets set correctly and works.

This week, I have moved on to Bitbucket and am having problems with the base url. I am using the latest version of the Helm Chart - 0.11.0

I have configured the ingress stanza in my values file as such (Comments removed for easier reading):

ingress:
  create: true
  nginx: true
  maxBodySize: 1g
  host: bitbucketpoc.company.com
  path: "/"
  annotations: {}
  https: true
  tlsSecretName:

I have confirmed that as a result of this, the following environment variables are present inside the pod:

SETUP_BASEURL=https://bitbucketpoc.company.com
SERVER_PROXY_NAME=bitbucketpoc.company.com
SERVER_PROXY_PORT=443
SERVER_SECURE=true
SERVER_SCHEME=https

According to the Docker image documentation, these are the env variables that need to be set when running behind a reverse proxy, as we are in the K8s environment (nginx-ingress being the reverse proxy).

When browsing the site after it comes up, we get the warning that the Base URL is not set correctly:

When looking in the settings, the Base URL does match the URL I am accessing Bitbucket from. This suggests that it's the proxy settings that are not set up correctly. Alas, all I can do to check this is to look at the environment, which seems OK. Adding a bitbucket.properties file and having the settings in there (as we do in our legacy environment) has no effect.

In addition, there are two other side-effects that I have noticed that I believe to be related.

When viewing commits, we get the following error.

This is accompanied by the following entry in the atlassian-bitbucket.log file.

2021-06-18 01:34:44,769 WARN [http-nio-7990-exec-3] admin @1J95BJEx94x1114x4 4fv97i 10.100.1.87 "POST /rest/tags/latest/projects/TEST/repos/test/tags HTTP/1.1" c.a.p.r.c.s.j.XsrfResourceFilter Additional XSRF checks failed for request: http://bitbucketpoc.company.com/rest/tags/latest/projects/TEST/repos/test/tags , origin: https://bitbucketpoc.company.com , referrer: https://bitbucketpoc.company.com/projects/TEST/repos/test/commits , credentials in request: true , allowed via CORS: false

When viewing SCM commands, it's showing http:// and not https:// URLS.

This should be showing https:// URLS that match the Base URL.

Thanks,

Tom...

Comments

Dylan Rathbone

Hi Tom,

Thanks for reaching out. As a starter for ten can you confirm what platform your cluster is running on i.e AWS/Azure/bare metal? We're primarily developing and testing the charts on AWS. We try to keep things agnostic but we may have tripped up somewhere on this front particularly with Ingress. Can you also confirm whether you utilised the instructions for Ingress setup here:
https://github.com/atlassian-labs/data-center-helm-charts/blob/master/docs/examples/ingress/INGRESS_NGINX.md

Cheers,
Dylan.

Tom Francis

Sorry, yes. Vital info there! I was meant to get into that when I explained more on our ingress, but I guess I got eager to click send instead

We are using EKS on AWS. It's pretty vanilla, currently on Version 1.19. Our ingress is set up such that our TLS is offloaded on the NLB.

Dylan Rathbone

All good Tom thumbs-up My initial thought on this is that the Ingress controller is not including the "X-Forwarded-Proto" header, meaning that BB doesnt know on what protocol to respond and so is defaulting to HTTP. We have some details on this topic here: https://github.com/atlassian-labs/data-center-helm-charts/blob/master/docs/CONFIGURATION.md#ingress

As a means of clarifying what headers are sent to the backend pods you can use wireshark...

Setup

Install Krew (package manager for kubectl plugins) by following the instructions here
Install the k8s plugin ksniff

kubectl krew install sniff
Install wireshark

brew install --cask wireshark
Copy the static-tcpdump binary to the target pod

kubectl cp /Users/<username>/.krew/store/sniff/v1.6.0/static-tcpdump <pod-name>:/tmp/static-tcpdump

Start capturing TCP traffic by running:

kubectl sniff <bitbucket pod> -f "port 7990"

This command will automatically open Wireshark which will begin traffic analysis of the pod.

Tom when logging into your BB service keep an eye out for the associated request and response (via wireshark), when you have them can you confirm what the headers are included in the request. If you dont see the protocol (HTTPS) it could be an issue with how we've documented the ingress setup.

Tom Francis

That's some good info there, thanks for the speedy response! It gives me something to work on so thanks. It could well be the X-Forwarded-Proto header, so I will look into that.

I will work on this tomorrow and let you know my findings.

Thanks,

Tom...

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bitbucket

bitbucket-server

kubernetes