Disattivare CSRF per /ws/** endpoint e semplificare la configurazione di sicurezza per correggere l'errore SockJS /ws/info 405
Explicitly consentire GET/POST/HEAD metodi per /ws/** endpoints per correggere l'errore SockJS /ws/info 405
Rimuovere le chiamate metodo non valide causando errori di compilazione (getId su MediaSession, getStatusCode su ServerHttpResponse)
Aggiungi registrazione EXTENSIVE a WebSocketConfig e ChatWebSocketController - ogni frame STOMP, handshake, abbonamento e messaggio registrato
Aggiungi WebSocket middleware e ServerTrasporto a IngressRoute
- Aggiunto middleware media-websocket-upgrade per WebSocket upgrade headers - Aggiunto media-websocket-trasporto per disabilitare HTTP/2 (WebSocket richiede HTT...
WebSocket live message delivery - disable ChatMessageHandler subscription, enhance logging
- Disabled ChatMessageHandler subscription to chat.session.> that was consuming messages without forwarding to WebSocket - Enhanced WebSocketConfig logging to t...
Use session GUID directly as NATS consumer name - Session GUID is already unique, no need for prefix - Simplifies code and consumer naming
WebSocket persistent connection with aggressive keepalive
Idle timeout set to 0, heartbeat 20s, disconnect delay 30s, match frontend timing
Add TomcatConnectorCustomizer to force SSL keystore config
- Spring Boot's application.yml SSL config not being applied - Use TomcatConnectorCustomizer to programmatically set keystore - Forces connector to use /etc/ssl...
Hardcode SSL settings in ConfigMap for production
- Removed environment variable placeholders - Hardcoded port 8443, SSL enabled, keystore path - Fixes Spring Boot not resolving env vars correctly
Correct Spring Boot SSL environment variable names
- Changed SSL_ENABLED to SERVER_SSL_ENABLED - Changed SSL_KEY_STORE to SERVER_SSL_KEY_STORE - Changed SSL_KEY_STORE_PASSWORD to SERVER_SSL_KEY_STORE_PASSWORD - ...
Simplify to HTTPS:8443 only, remove dual port config
- MediaService runs ONLY on port 8443 (HTTPS) - No more Traefik routing for MediaService - Removed DualPortConfig complexity - All traffic (API + WebSocket) goe...
Use SSLHostConfig API for Tomcat SSL configuration
- Use SSLHostConfig and SSLHostConfigCertificate (correct Tomcat API) - Configure certificate via **************** - Fixes compilation errors with setAttribute/...
Use setAttribute for Tomcat SSL configuration
- Changed from setKeystoreFile/Pass/Type/Alias to setAttribute - Tomcat 10+ uses setAttribute for SSL properties - Fixes compilation errors
Run MediaService on BOTH ports 80 (HTTP API) and 8443 (HTTPS WebSocket)
- Reverted service.yaml and ingressroute.yaml to use port 80 - Removed forced SERVER_PORT and SSL_ENABLED env vars - Added DualPortConfig to programmatically ad...
Use NodePort 30843 instead of hostPort for WebSocket
- hostPort may be blocked by firewall rules - NodePort 30843 is in valid range (30000-32767) - Browser connects to external port 8443 - Router forwards 8443 -> ...
Add SSL configuration to k8s ConfigMap
- ConfigMap was missing SSL config from application.yml - Added server.ssl settings with environment variable support - Matches local application.yml configurat...
Use hostPort instead of NodePort for 8443
- NodePort range is 30000-32767, cannot use 8443 - Use hostPort to bind directly to host port 8443 - Removed service-websocket.yaml
Expose MediaService on port 8443 for WebSocket over HTTPS/HTTP1.1
- Added NodePort service on 8443 for direct WebSocket access (bypasses Traefik) - Mount wildcard-kamocrm-com SSL certificate - Init container converts PEM to PK...
Restore HTTP/2 for WebSockets (RFC 8441 support)
- WebSockets CAN work over HTTP/2 via RFC 8441 - Removed TLSOption (not needed) - Removed ServersTransport reference (let HTTP/2 work) - Restored simple domain-...
Use explicit Host() for /ws route to enable TLSOption
- Changed /ws route from HostRegexp to Host(media.kamocrm.com) - TLSOption can only be applied to explicit hosts (not regex) - ALPN negotiation happens during T...
Force HTTP/1.1 for MediaService ONLY via TLSOption
- Created media-tls-http1 TLSOption with alpnProtocols: [http/1.1] - Referenced ONLY in media-route IngressRoute - Does not affect other Traefik routes - Fixes ...
Separate /ws route for WebSocket, keep HTTP/2 for API
- Added two routes: /ws for WebSocket (higher priority), rest for API - Only /ws uses media-websocket-transport (HTTP/2 disabled) - API routes can use HTTP/2 fo...
Use Host() instead of HostRegexp() for media-route
- Simplified to Host(media.kamocrm.com) - Avoids regex escaping issues with backticks - Tests show route is working with simple Host match
Force HTTP/1.1 via TLSOption for WebSocket compatibility
- Created TLSOption to disable HTTP/2 ALPN negotiation - Forces browsers to use HTTP/1.1 for media.kamocrm.com - WebSocket upgrades require HTTP/1.1 protocol - ...
Add CORS middleware to media-route for cross-origin WebSocket
- Added cors middleware to allow cross-origin connections - Enables WebSocket connections from internal.* to media.* - Allows all origins, methods, and headers ...
Remove @kubernetescrd suffix from serversTransport reference
- Traefik error: cross-namespace format not allowed when crossnamespace disabled - IngressRoute and ServersTransport are in same namespace (kamo) - Use simple n...
Add WebSocket signaling for peer-to-peer calls
- Added WebRTCSignalingController for call signaling - Handles offer/answer exchange via STOMP - Forwards ICE candidates between peers - Manages call hangup not...
Add Janus WebRTC integration
- Added WebRTCController for token generation and call management - Configured Janus API URL and secrets (api, token, admin) - Configured STUN/TURN servers (kam...
Use full Kubernetes CRD provider name for ServersTransport reference
Traefik requires the @kubernetescrd suffix when referencing CRD resources like ServersTransport.
Simplify MediaService WebSocket IngressRoute configuration
Remove media-websocket-upgrade middleware that was forcing headers and causing WebSocket handshake issues. Traefik automatically handles WebSocket upgrade when ...
Add end anchor to WebSocket path regex pattern
- Add $ to end of PathRegexp to ensure exact match - Fixes regex parsing error in Traefik - /ws/info is now working (200 OK) but WebSocket upgrade route needs p...
Only apply WebSocket upgrade middleware to actual WebSocket paths
- Change route match from PathPrefix(/ws/) to **************** - /ws/info is a regular HTTP request, not a WebSocket upgrade - Adding Upgrade header to /ws/info...
Add separate route for WebSocket paths with upgrade middleware
- Create separate route matching /ws/** paths with media-websocket-upgrade middleware - This ensures Upgrade: websocket header is added for WebSocket upgrade re...
Use ServersTransport to disable HTTP/2 for WebSocket connections
- Create ServersTransport resource with disableHTTP2: true - Reference ServersTransport in IngressRoute service configuration - Remove invalid disableHTTP2 fiel...
Disable HTTP/2 for MediaService backend connection
- Add disableHTTP2: true to force HTTP/1.1 for backend connections - HTTP/2 Extended CONNECT is not properly converting Upgrade header - WebSocket upgrades requ...
Configurare lo schema di servizio IngressRoute per il supporto WebSocket
- Impostare lo schema: http per garantire una corretta gestione HTTP/1.1 per gli aggiornamenti WebSocket - HTTP/2 Extended CONNECT ha bisogno di una corretta co...
Rimuovere il maniglione manuale non valido e correggere la configurazione SockJS
- Rimuovere non valido DefaultHandshakeHandler override (metodo non esiste) - Rimuovere il set non validoSupressCors chiamata (metodo non esiste) - Tenere HttpS...
Add WebSocket handshake logging and SockJS configuration
- Add handshake handler and interceptor logging to diagnose WebSocket connection issues - Configure SockJS to suppress CORS (handled by Spring Security) and dis...
Remove media-cors middleware from IngressRoute to allow WebSocket connections
- media-cors middleware was clearing CORS headers which interfered with WebSocket upgrades - WebSocket connections require direct pass-through without header mo...
Remove invalid Spring Security pattern /ws/**/info
- PatternParseException: No more pattern data allowed after {*...} or ** - /ws/** already covers all paths under /ws including /ws/info - This was causing 500 e...
Apply media-cors middleware to MediaService IngressRoute
- Apply media-cors middleware to allow CORS headers for WebSocket connections - Matches the pattern used for theme domains
Come quello che vedi la spedizione?
Ognuno di questi aggiornamenti atterra automaticamente nello spazio di lavoro. Inizia gratis e guardalo crescere settimana dopo settimana.