Enable CORS for k8s Metacat Deployments

[artntek]

We need to allow MetacatUI instances to have hostnames that do not match the corresponding metacat installation's hostname.

See backend meeting discussion 1/21/25.

Example Use Case

(Abridged from 2/5/25 Slack thread - Matt & Robyn)

(MBJ) We had a user report trouble getting to PNDB data files for this PNDB dataset, and sure enough, when I try to access the landing page I see a bunch of CORS errors for PNDB, KNB, ARCTIC and other nodes in the console. Screenshot below.

Interestingly, I can access the resource map from PNDB without error

(RTB) The issue is with the CORS config on the PNDB server. CORS restrictions don't apply to direct requests for a resource, e.g. navigating to the resource map directly in your browser. You can see this for yourself with curl:

curl -i -X GET "https://pndb.fr/metacat/d1/mn/v2/object/resource_map_urn:uuid:2d9baf2c-62c8-41b2-9178-dd68af3b3379" \
     -H "Origin: https://dataone.org/"

result:

HTTP/2 403 
content-type: text/plain
content-length: 0
date: Wed, 05 Feb 2025 15:42:27 GMT

Compare to a direct request without origin:

curl -i -X GET "https://pndb.fr/metacat/d1/mn/v2/object/resource_map_urn:uuid:2d9baf2c-62c8-41b2-9178-dd68af3b3379"

result: success

Also requests from the same origin work. This returns the resource map:

curl -i -X GET "https://pndb.fr/metacat/d1/mn/v2/object/resource_map_urn:uuid:2d9baf2c-62c8-41b2-9178-dd68af3b3379" \
     -H "Origin: https://pndb.fr/"

PNDB needs to add a CORS config like: Access-Control-Allow-Origin: https://dataone.org/

[artntek]

See values already tried, in helm/examples/values-dev-cluster-arctic-example.yaml in branch feature-2050-cors-k8s-ingress. Retry after nginx is upgraded to latest

NOTES

Here's what we have in the Apache setup for ADC, for reference:

  Header always append X-Frame-Options SAMEORIGIN
  SetEnvIf Origin "^(.*)$" ORIGIN_DOMAIN=$1
  #RequestHeader set Expect "100-continue"
  Header set Access-Control-Allow-Origin "%{ORIGIN_DOMAIN}e" env=ORIGIN_DOMAIN
  Header set Access-Control-Allow-Headers "Authorization, Content-Type, Origin, Cache-Control"
  Header set Access-Control-Allow-Methods "GET, POST, PUT, OPTIONS"
  Header set Access-Control-Allow-Credentials "true"

However, nginx doesn't like to support wildcard values for Access-Control-Allow-Origin at the same time Access-Control-Allow-Credentials is being used (which is why it works only when you aren't logged in).

• https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/
• https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#enable-cors

Found several different workarounds; see example links:

• https://stackoverflow.com/questions/51744536/cors-rules-nginx-ingress-rules
• https://serverfault.com/questions/1036065/access-control-allow-origin-value-overrided-for-options-requests
• https://stackoverflow.com/questions/57260996/tracking-down-how-to-fix-cors-issue
• https://stackoverflow.com/questions/51988839/how-can-i-put-basic-auth-on-specific-http-methods-in-ngnix-ingress
• https://enable-cors.org/server_nginx.html
• https://serverfault.com/questions/1036065/access-control-allow-origin-value-overrided-for-options-requests/1036160#1036160
• https://stackoverflow.com/questions/63275239/kubernetes-nginx-ingress-server-snippet-annotation-not-taking-effect

...but couldn't get any of them to work. I think this might be because our version of nginx is old, and has bugs which have since been fixed.

ingress-nginx versions:

• NCEAS dev cluster:
  • Oct 12, 2021
  • helm chart v4.0.6
  • nginx app v1.0.4
• newest available chart:
  • Oct 8, 2024
  • helm chart v4.11.3
  • nginx app v1.11.3

For example, see these links:

• Adding configuration-snippet causes the configuration of cors-allow-headers to become invalid. kubernetes/ingress-nginx#10862
• nginx.ingress.kubernetes.io/cors-allow-origin doesn't seem to work? kubernetes/ingress-nginx#8469
• fix(cors): add 'vary: origin' header if not set by backend kubernetes/ingress-nginx#10490
• CORS Annotation Not Behaving as Expected kubernetes/ingress-nginx#10267
• Feature Request: multi-origin support for cors-allow-origin kubernetes/ingress-nginx#5496

Other useful links:

• Cross-Origin Resource Sharing and Why We Need Preflight Requests
• Troubleshooting Ingress-Controller Logs and Events
• code
• MDN: Access-Control-Allow-Origin