Alessandro's questions

I am trying to set up a kubernetes pod in order for it to connect to a device, specifically a F5 BIG-IP appliance.

The deployment appears to be OK, in fact i had to modify a code snippet I found online.

When the pods is trying to start up, i got an error. So I started my investigation:

Running kubectl logs <pod_name> -n <namespace> returns an error:

REST call error: Get <URL>: x509: cannot validate certificate for <IP> because it doesn't contain any IP SANs

By looking at a wireshark dump on the interface, I se that there's a TLS 1.2 alert (fatal) with a description of "bad certificate" sent from the client to the server.

So I looked online, and I found some articles saying it's a problem with kubernetes trying to connect to the server but not recognizing it - at least I think that's what they meant. One of the suggested workarounds was to apply a DNS name, so I modified the /etc/hosts file in order to use the DNS name within the deployment YAML file.

The result is that the error message changes to:

REST call error: Get <URL>: dial tcp: lookup <hostname>: device or resource busy

Any ideas on what the problem might be and how to solve it?

This is a test environment so I wouldn't mind -let me say- "unorthodox" methods, such as ignoring the certificate check, but I'd appreciate it if there were solutions or workarounds which I could eventually bring into production.

Thanks for any input you might have.

I'm trying to implement a TCL script to be used in an F5 iRule, in order to catch any SSL renegotiation event. I'm stuck at the first step, which is basically the "trigger" which could say "when the SSL renegotiation happens, do something" (e.g. log the event to the syslog).

My question is: Since the SSL connection is already established, what is the trigger that prompts the link to be re-established? How can I use this in an iRule?

Any help is greatly appreciated.

I have set up an nginx proxy with Openresty. The proxy takes up an HTTP SOAP POST request, modifies it by using a LUA script written within the root location ("/") of the HTTP server on port 8080, and sends it to a backend server for processing, which works correctly.

When the proxy relays the connection to the backend server, it creates a new connection, as per TCP specs, generating a new source port different from port 8080, where the backend server should respond.

Is there a way to intercept the response on nginx, so that it'll be able to intercept such response and modify it accordingly, with a LUA script?

Thanks for any insights you may be able to provide.