docs: DOC-1385 #4047
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,19 +11,77 @@ sidebar_custom_props: | |
|
|
||
| Palette uses [gRPC](https://grpc.io) to communicate between the management platform and the workload cluster. gRPC is a | ||
| high-performance, open-source universal Remote Procedure Call (RPC) framework. It is used to build distributed | ||
| applications and services. gRPC is based on HTTP/2 protocol and uses protocol buffers | ||
| ([protobuf](https://protobuf.dev/)) as the underlying data serialization framework. | ||
|
|
||
| :::tip | ||
|
|
||
| Refer to the [Network Ports](networking-ports.md) documentation for a detailed network architecture diagram with gRPC | ||
| and to learn more about the ports used for communication. | ||
|
|
||
| ::: | ||
|
|
||
| ## gRPC and WebSocket | ||
|
|
||
| The Palette agent will automatically attempt to connect to the management plane using gRPC through HTTPS using the | ||
| HTTP/2 protocol. In some environments, the network configuration may not allow gRPC traffic to pass through. A common | ||
| scenario is when the network is behind a proxy server that does not support HTTP/2. In this scenario, the Palette agent | ||
| will first attempt to connect to the management plane using HTTP/2. After several failed attempts, the agent will fall | ||
| back to using WebSocket over HTTPS with HTTP/1.1. | ||
|
|
||
| The fallback to WebSocket with transcoding occurs automatically and does not require any additional configuration. | ||
|
|
||
| ### gRPC Transcode | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
|
|
||
| Behind the scenes, when the Palette agent fails to connect with the management plane after a maximum of ten connection | ||
| attempts, the agent initiates the failover to a WebSocket connection and transcodes the gRPC messages with the HTTP/1.1 | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| protocol. | ||
|
|
||
| The Palette agent directs gRPC messages to a freshly started in-memory proxy service, which takes the original gRPC | ||
| request, transcodes it to HTTP/1.1 protocol, and sends it over the WebSocket connection to the management plane. The | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| management plane's WebSocket handler will then accept the WebSocket message and transcode it back to the HTTP/2 protocol | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| before forwarding it to the gRPC handler. The server will then respond with a gRPC message, which will be transcoded to | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| HTTP/1.1 and sent back to the agent over the WebSocket. The agent's in-memory proxy will read the message and transcode | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| it back to HTTP/2 and pass it to the agent. | ||
|
|
||
|  | ||
|
|
||
| Below is a high-level overview of the order of operations when the Palette agent falls back to using WebSocket: | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
|
|
||
| 1. The agent initiates a new gRPC request to the management plane servers that is picked up by the in-memory proxy | ||
| service. | ||
| 2. The agent's in-memory proxy creates a WebSocket connection with the management plane servers. | ||
| 3. The management plane server accepts the WebSocket connection | ||
| 4. The agent in-memory proxy transcodes the gRPC request on-demand and sends it via the WebSocket connection. | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| 5. The server's WebSocker handler reads the request off the WebSocket connection and forwards it to the server's gRPC | ||
| handler. | ||
| 6. The gRPC handler processes the request and responds via the same connection. The WebSocket handler sends the response | ||
| from the gRPC handler back to the agent. | ||
| 7. The agent's in-memory proxy reads the response off the WebSocket connection and transcodes it back to HTTP/2 and | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| passes it to the agent. | ||
|
|
||
| A more straightforward way to think about the WebSocket transcoding architecture is that network traffic between the | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| Palette agent and the management plane uses the WebSocket connection and the HTTP/1.1 protocol. The agent and server are | ||
| still communicating using gRPC, but the messages are transcoded to the HTTP/1.1 protocol between the two entities. Using | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| WebSocket and HTTP/1.1 removes issues due to application firewalls or network proxies not supporting the HTTP/2 | ||
| protocol. Once the gRPC message is internal to the agent or the server, the HTTP/2 protocol is used for communication. | ||
|
|
||
| ## gRPC and Proxies | ||
|
|
||
| :::info | ||
|
|
||
| The following sections provide information about using gRPC with network proxies. These issues are addressed by using | ||
| WebSocket and the HTTP/1.1 protocol as a fallback mechanism. However, if you want to better understand the reasons for | ||
| falling back to a WebSocket connection, the following sections provide more information about challenges with gRPC and | ||
| network proxies. If you want to learn more about gRPC and transcoding, check out the Red Hat article | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| [gRPC Anywhere](https://www.redhat.com/en/blog/grpc-anywhere). | ||
|
|
||
| ::: | ||
|
|
||
| When gRPC is used with network proxies, the proxy servers may or may not support gRPC or require additional | ||
| configuration to allow gRPC traffic to pass through. The following table summarizes the different scenarios and whether | ||
| or not the proxy server supports gRPC. Keep in mind that should the gRPC connection fail, the agent will automatically | ||
| fall back to using WebSocket. | ||
|
|
||
| | **Scenario** | **Description** | **Proxy Supported** | | ||
| | :---------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------- | :------------------ | | ||
|
|
@@ -33,7 +91,7 @@ or not the proxy server supports gRPC. | |
|
|
||
| The following sections provide more information about gRPC and proxies. | ||
|
|
||
| ### Proxy Without SSL Bump | ||
|
|
||
| Because gRPC is based on HTTP/2, any proxy server that supports the | ||
| [HTTP CONNECT](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) method can be used to forward gRPC | ||
|
|
@@ -48,7 +106,7 @@ scenario, the proxy server must support gRPC and may require additional configur | |
|
|
||
| ::: | ||
|
|
||
| ### Proxy With SSL Bump | ||
|
|
||
| Several vendors provide proxy servers that support gRPC. Some of the vendors may require additional configurations or | ||
| the use of a specific version of the proxy server. We encourage you to review your proxy server documentation for more | ||
|
|
@@ -65,7 +123,7 @@ to some vendors' documentation that addresses HTTP/2 and gRPC support. | |
|
|
||
| - [Check Point](https://support.checkpoint.com/results/sk/sk116022) | ||
|
|
||
| ### Squid Proxy With SSL Bump | ||
|
|
||
| A common open-source proxy server is [Squid](https://wiki.squid-cache.org). Squid is a caching proxy for the Web | ||
| supporting HTTP, HTTPS, FTP, and more. Squid supports gRPC but requires additional configuration. gRPC with SSL bump | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,6 +11,50 @@ tags: ["release-notes"] | |
|
|
||
| <ReleaseNotesVersions /> | ||
|
|
||
| ## Sept 25, 2024 - Release 4.4.20 | ||
|
|
||
| ### Improvements | ||
|
|
||
| - Palette's message communication channel between clusters and the management plane has been updated to support gRPC | ||
| over WebSocket. Palette agents will automatically fall back to a WebSocket connection if the gRPC connection cannot be | ||
| established with the management plane using the default HTTP/2 protocol. This change improves the reliability of the | ||
| communication channel between the agent and the management plane. Environments with network proxies that reject HTTP/2 | ||
| connections can now connect as the connection is transcoded to the HTTP/1.1 protocol. Refer to the | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
| [gRPC and WebSocket](../architecture/grps-proxy.md#grpc-and-websocket) section of the Architecture documentation to | ||
| learn more. | ||
|
|
||
| - Local UI now supports selecting network interfaces by name. | ||
|
|
||
| - Local UI has improved validation when assigning static IP addresses to network interfaces. | ||
|
|
||
| - The heartbeat mechanism for Palette deployed clusters has been improved for better performance and reliability. | ||
|
|
||
| ### Bug Fixes | ||
|
|
||
| - Fixed an issue where imported cluster profiles defaulted to incorrect registry type. | ||
|
|
||
| - Fixed an issue where Palette TUI was not displaying network interfaces that had no IP addresses assigned. | ||
|
|
||
| - Resolved an issue where the Local UI took a long time to load after application deployment. | ||
|
|
||
| - Fixed an issue where the Edge CLI could not download Helm charts from private registries. | ||
|
|
||
| - Fix an issue with the Edge CLI that was silently failing when unable to create the build artifact. The Edge CLI now | ||
| provides a clear error message when the build artifact creation fails. | ||
|
|
||
| - Fixed a Palette UI message incorrectly stating to check the new issue date for SSL certificate renewal. The message | ||
| now correctly states to check the new expiration date. | ||
|
|
||
| - Resolved an issue where the Palette UI was erroring out when reviewing pack layers during a PCG upgrade. | ||
karl-cardenas-coding marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| - Resolved an issue where the Local UI username and password field validation was not working as expected. | ||
|
|
||
| - Fixed an issue with updating the node port for the Edge Harbor pack. The node port is now correctly updated when | ||
| changing the value in the Harbor pack. | ||
|
|
||
| - Resolved an issue where kubeadm based Kubernetes distributions were unable to initialize on clusters with multiple | ||
| Network Interface Cards (NIC). | ||
|
|
||
| ## Sept 18, 2024 - Release 4.4.19 | ||
|
|
||
| #### Bug Fixes | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -31,7 +31,7 @@ Waiting on a fix from third party mongodb vendor. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -41,3 +41,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added Palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -33,7 +33,7 @@ Waiting on a fix from third party mongodb vendor | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -43,3 +43,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -32,7 +32,7 @@ application. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -42,3 +42,4 @@ Ongoing | |
|
|
||
| - 1.0 07/31/2024 Initial Publication | ||
| - 2.0 08/17/2024 Remediated in Palette VerteX 4.4.14 | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -30,7 +30,7 @@ Spectro Cloud Official Summary coming soon. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -40,3 +40,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added Palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -34,7 +34,7 @@ Waiting on a fix from third party mongodb vendor | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -44,3 +44,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -31,7 +31,7 @@ Waiting on a fix from third party mongodb vendor. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -41,3 +41,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -31,7 +31,7 @@ Waiting on a fix from third party mongodb vendor | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -41,3 +41,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -31,7 +31,7 @@ Waiting on a fix from third party mongodb vendor. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -41,3 +41,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added Palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -31,7 +31,7 @@ Waiting on a fix from third party mongodb vendor. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -41,3 +41,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added Palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,7 +14,7 @@ tags: ["security", "cve"] | |
|
|
||
| ## Last Update | ||
|
|
||
| 9/23/24 | ||
|
|
||
| ## NIST CVE Summary | ||
|
|
||
|
|
@@ -31,7 +31,7 @@ Waiting on a fix from third party mongodb vendor. | |
|
|
||
| ## Status | ||
|
|
||
| Resolved | ||
|
|
||
| ## Affected Products & Versions | ||
|
|
||
|
|
@@ -41,3 +41,4 @@ Ongoing | |
|
|
||
| - 1.0 08/16/2024 Initial Publication | ||
| - 2.0 08/17/2024 Added Palette VerteX 4.4.14 to Affected Products | ||
| - 3.0 09/23/2024 Changed CVE status to Resolved | ||
|
There was a problem hiding this comment. 🚫 [vale] reported by reviewdog 🐶 |
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚫 [vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'transcoding'?