WebSocket 用の Spring Security を適切に設定 - CSRF を完全に無効にし、WebSocket handhake 用のセッション作成 IF REQUIRED を有効にする
/ws/** エンドポイントの CSRF を無効にし、SockJS /ws/info 405 エラーを修正するためのセキュリティ設定を簡素化
明示的にGET/POST/HEAD メソッドを /ws/** エンドポイントで SockJS /ws/info 405 エラーを修正
コンパイルエラー(MediaSession、ServerHttpResponse の getStatusCode の getId )による不正なメソッド呼び出しを削除します
IngressRouteにWebSocketミドルウェアとServersTransportを追加
- WebSocketアップグレードヘッダー用のメディアWebsocketアップグレードミドルウェアを追加しました - HTTP/2 (WebSocket は HTTP/1.1 が必要です) を無効にするメディア websocket-transport を追加しました。 - これは、Trefikの侵入による適切なWeb...
WebSocket live message delivery - disable ChatMessageHandler subscription, enhance logging
- Disabled ChatMessageHandler subscription to chat.session.> that was consuming messages without forwarding to WebSocket - Enhanced WebSocketConfig logging to t...
WebSocket persistent connection with aggressive keepalive
Idle timeout set to 0, heartbeat 20s, disconnect delay 30s, match frontend timing
Hardcode SSL settings in ConfigMap for production
- Removed environment variable placeholders - Hardcoded port 8443, SSL enabled, keystore path - Fixes Spring Boot not resolving env vars correctly
Correct Spring Boot SSL environment variable names
- Changed SSL_ENABLED to SERVER_SSL_ENABLED - Changed SSL_KEY_STORE to SERVER_SSL_KEY_STORE - Changed SSL_KEY_STORE_PASSWORD to SERVER_SSL_KEY_STORE_PASSWORD - ...
Use SSLHostConfig API for Tomcat SSL configuration
- Use SSLHostConfig and SSLHostConfigCertificate (correct Tomcat API) - Configure certificate via **************** - Fixes compilation errors with setAttribute/...
Use setAttribute for Tomcat SSL configuration
- Changed from setKeystoreFile/Pass/Type/Alias to setAttribute - Tomcat 10+ uses setAttribute for SSL properties - Fixes compilation errors
Run MediaService on BOTH ports 80 (HTTP API) and 8443 (HTTPS WebSocket)
- Reverted service.yaml and ingressroute.yaml to use port 80 - Removed forced SERVER_PORT and SSL_ENABLED env vars - Added DualPortConfig to programmatically ad...
Use NodePort 30843 instead of hostPort for WebSocket
- hostPort may be blocked by firewall rules - NodePort 30843 is in valid range (30000-32767) - Browser connects to external port 8443 - Router forwards 8443 -> ...
Add SSL configuration to k8s ConfigMap
- ConfigMap was missing SSL config from application.yml - Added server.ssl settings with environment variable support - Matches local application.yml configurat...
Use hostPort instead of NodePort for 8443
- NodePort range is 30000-32767, cannot use 8443 - Use hostPort to bind directly to host port 8443 - Removed service-websocket.yaml
Use explicit Host() for /ws route to enable TLSOption
- Changed /ws route from HostRegexp to Host(media.kamocrm.com) - TLSOption can only be applied to explicit hosts (not regex) - ALPN negotiation happens during T...
Force HTTP/1.1 for MediaService ONLY via TLSOption
- Created media-tls-http1 TLSOption with alpnProtocols: [http/1.1] - Referenced ONLY in media-route IngressRoute - Does not affect other Traefik routes - Fixes ...
Separate /ws route for WebSocket, keep HTTP/2 for API
- Added two routes: /ws for WebSocket (higher priority), rest for API - Only /ws uses media-websocket-transport (HTTP/2 disabled) - API routes can use HTTP/2 fo...
Use Host() instead of HostRegexp() for media-route
- Simplified to Host(media.kamocrm.com) - Avoids regex escaping issues with backticks - Tests show route is working with simple Host match
Force HTTP/1.1 via TLSOption for WebSocket compatibility
- Created TLSOption to disable HTTP/2 ALPN negotiation - Forces browsers to use HTTP/1.1 for media.kamocrm.com - WebSocket upgrades require HTTP/1.1 protocol - ...
Remove @kubernetescrd suffix from serversTransport reference
- Traefik error: cross-namespace format not allowed when crossnamespace disabled - IngressRoute and ServersTransport are in same namespace (kamo) - Use simple n...
Use full Kubernetes CRD provider name for ServersTransport reference
Traefik requires the @kubernetescrd suffix when referencing CRD resources like ServersTransport.
Simplify MediaService WebSocket IngressRoute configuration
Remove media-websocket-upgrade middleware that was forcing headers and causing WebSocket handshake issues. Traefik automatically handles WebSocket upgrade when ...
Add end anchor to WebSocket path regex pattern
- Add $ to end of PathRegexp to ensure exact match - Fixes regex parsing error in Traefik - /ws/info is now working (200 OK) but WebSocket upgrade route needs p...
Only apply WebSocket upgrade middleware to actual WebSocket paths
- Change route match from PathPrefix(/ws/) to **************** - /ws/info is a regular HTTP request, not a WebSocket upgrade - Adding Upgrade header to /ws/info...
Add separate route for WebSocket paths with upgrade middleware
- Create separate route matching /ws/** paths with media-websocket-upgrade middleware - This ensures Upgrade: websocket header is added for WebSocket upgrade re...
Use ServersTransport to disable HTTP/2 for WebSocket connections
- Create ServersTransport resource with disableHTTP2: true - Reference ServersTransport in IngressRoute service configuration - Remove invalid disableHTTP2 fiel...
MediaServiceバックエンド接続用のHTTP/2を無効にする
- バックエンド接続のためにHTTP/1.1を強制するHTTP2:trueを追加 - HTTP/2 拡張 CONNECT は、アップグレードヘッダーを正しく変換しない - WebSocket のアップグレードには、HTTP/1.1 が必要です。 - これは、WebSocketハンドシェイクの「アップグレードヘッダー:n...
WebSocketサポート用のIngressRouteサービススキームの設定
- 設定スキーム: http は、WebSocket のアップグレードの適切な HTTP/1.1 処理を確実にするために - HTTP/2 拡張 CONNECT は HTTP/1.1 のアップグレードヘッダーに適切な変換が必要 - これは、WebSocketハンドシェイクの「アップグレードヘッダー:null」エラーを修...
無効なハンドハンドハンドラを削除し、SockJSの設定を修正
- 無効な DefaultHandshakeHandler オーバーライドを削除します (メソッドは存在しません) - 無効な setSupressCors コールを削除します(メソッドは存在しません) - HttpSessionHandshakeの試行をログするためのインターセプターをキープ - これは、WebSoc...
Add WebSocket handshake logging and SockJS configuration
- Add handshake handler and interceptor logging to diagnose WebSocket connection issues - Configure SockJS to suppress CORS (handled by Spring Security) and dis...
Remove media-cors middleware from IngressRoute to allow WebSocket connections
- media-cors middleware was clearing CORS headers which interfered with WebSocket upgrades - WebSocket connections require direct pass-through without header mo...
Remove invalid Spring Security pattern /ws/**/info
- PatternParseException: No more pattern data allowed after {*...} or ** - /ws/** already covers all paths under /ws including /ws/info - This was causing 500 e...
Apply media-cors middleware to MediaService IngressRoute
- Apply media-cors middleware to allow CORS headers for WebSocket connections - Matches the pattern used for theme domains
Explicitly permit OPTIONS requests for CORS preflight
- Add explicit permit for OPTIONS method on all paths - Add explicit permit for /ws/info endpoint (SockJS handshake) - This ensures CORS preflight requests reac...
Make CORS configuration more permissive for WebSocket connections
- Explicitly handle '*' wildcard for origins, methods, and headers - Add WebSocket-related headers to exposed headers - Add logging to verify CORS configuration...
Add logging and configure SockJS heartbeat/disconnect settings
- Add logging to verify WebSocket endpoint registration - Configure SockJS heartbeat and disconnect delay - This should help diagnose why SockJS handshake isn't...
Revert IngressRoute changes - Traefik handles WebSocket automatically
Remove duplicate WebSocket endpoint registration and improve logging
- Removed duplicate /ws endpoint registration (SockJS already handles native WebSocket) - Added null check for payload in subscribeToSession - This may fix WebS...
Remove invalid Spring Security path pattern /ws/**/websocket
- Spring Security does not allow path segments after /** pattern - /ws/** already matches all paths under /ws including websocket endpoints - This fixes Pattern...