DisallowedHost Django deployment in Kubernetes cluster: Invalid HTTP_HOST header

user_9247792 0
Viewed 1331

I have a Django deployment for a frontend service in my Azure Kubernetes cluster with some basic configuration. But note that the same question applies for my local Minikube cluster. I fetch my Django frontend container image from my remote container registry and expose port 8010. My service configuration is quite simple as well.

frontend.deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend-v1
  labels:
    app: frontend-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend-v1
  template:
    metadata:
      labels:
        app: frontend-v1
    spec:
      containers:
        - name: frontend-v1
          imagePullPolicy: Always
          image: yourremotename.azurecr.io/frontend-remote:v1
          ports:
          - containerPort: 8010
      imagePullSecrets:
        - name: acr-secret

frontend.service.yaml

kind: Service
apiVersion: v1
metadata:
  name: frontend-v1
spec:
  selector:
    app: frontend-v1
  ports:
  - NodePort:
    protocol: TCP
    port: 8010
    targetPort: 8010
  type: NodePort

Now, when I access my deployed frontend service in the browser i.e. http://172.17.194.253:31436 with Django's setting DEBUG = True, I get the error:

Traceback (most recent call last):
  File "/usr/local/lib/python3.6/dist-packages/django/core/handlers/exception.py", line 34, in inner
    response = get_response(request)
  File "/usr/local/lib/python3.6/dist-packages/django/utils/deprecation.py", line 93, in __call__
    response = self.process_request(request)
  File "/usr/local/lib/python3.6/dist-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
  File "/usr/local/lib/python3.6/dist-packages/django/http/request.py", line 122, in get_host
    raise DisallowedHost(msg)

Exception Type: DisallowedHost at /
Exception Value: Invalid HTTP_HOST header: '172.17.194.253:31436'. You may need to add '172.17.194.253' to ALLOWED_HOSTS.

But how can I bind the dynamically created HostIp of the pod to Django's ALLOWED_HOSTS?

azure-aks kubernetes django
2 Answers

Since Kubernetes 1.7 it is possible to request the HostIp of the pod in your kubernetes deployment file.(1)

First adjust the deployment file to set the required environment variable for the HostIp. In the beneath scenario I set the POD_IP and the HOST_IP, as they are different. You can inject a variety of Kubernetes application data variables using environment variables in your Kubernetes deployment files, for more info about this topic look here.

frontend.service.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend-v1
  labels:
    app: frontend-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend-v1
  template:
    metadata:
      labels:
        app: frontend-v1
    spec:
      containers:
        - name: frontend-v1
          imagePullPolicy: Always
          image: yourremotename.azurecr.io/frontend-remote:v1
          ports:
          - containerPort: 8010
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
      imagePullSecrets:
        - name: acr-secret

Now in you Django settings adjust the ALLOWED_HOSTS configuration to point to the HOST_IP environment variable.

settings.py

import os
...
ALLOWED_HOSTS = [os.environ.get('HOST_IP'), '127.0.0.1']
....

Note that this allows the pod's HostIP as well als localhost for local development purposes.

Warning! Some blog posts or tutorials advise you to set ALLOWED_HOSTS = ['*'] to accept all host IP's, but this is a serious security loophole. Don't do this!

Now redeploy your pod and your Django application should run smoothly again.

user_92477920

Or, simply add Host: yourdomain.com in the readinessProbe header. You can also customise the default path.

readinessProbe:
  httpGet:
    path: /
    port: 8010  # Must be same as containerPort
    httpHeaders:
    - name: Host
      value: yourdomain.com
user_37755980
Related