Error dialing the worker, handshake request fails

Hello everyone,

I’m trying to connect to a postgres target using the following command:

boundary connect postgres -target-id $TARGETID -dbname $DBNAME -token=$TOKEN 

I get the following error:

Error dialing the worker: failed to WebSocket dial: failed to send handshake request: Get "MyDomain:9202/v1/proxy": dial tcp MyIP:9202: i/o timeout

psql: server closed the connection unexpectedly
        This probably means the server terminated abnormally
        before or while processing the request.

error fetching connection to send session teardown request to worker: Error dialing the worker: failed to WebSocket dial: failed to send handshake request: Get "MyDomain:9202/v1/proxy": dial tcp MyIP:9202: i/o timeout

P.S:

  • I’m not using dev mode
  • I’m using an ingress

I/O timeouts usually mean something like a firewall is dropping the traffic. Can you give more detail about your configuration?

Hello @omkensey,

I’m using the following:

The controller:

	name = "kubernetes-controller"
	description = "my controller!"
	database {
			url = "env://BOUNDARY_PG_URL"
	}
	public_cluster_addr = "localhost"

The worker:

worker {
	name = "kubernetes-worker"
	description = "My worker for kubernetes "
	address = "mydomain"
  controllers = ["localhost"]
	public_addr = "mydomain:9202"
}

listener "tcp" {
	address = "0.0.0.0"
	purpose = "api"
	tls_disable = true
}

listener "tcp" {
	address = "0.0.0.0"
	purpose = "cluster"
	tls_disable = true
}

listener "tcp" {
	address = "0.0.0.0"
	purpose = "proxy"
	tls_disable = true
}

I’m following this documentation:

Rather than using the forwarding system, I’m using an ingress with the following rules:

rules:
    - host: MyDomain
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: boundary-controller
                port:
                  number: 80
          - path: /cluster
            pathType: Prefix
            backend:
              service:
                name: boundary-controller
                port:
                  number: 9201
          - path: /proxy
            pathType: Prefix
            backend:
              service:
                name: boundary-controller
                port:
                  number: 9202

The first thing that sticks out to me is you may need to use path rewriting to make that work with an ingress – but I’m also not sure that having a worker exposed via an L7 ingress will even work, because workers do layer-4 proxying. When I do workers in a Kubernetes cluster I expose them via NodePort services.

1 Like

Thanks @omkensey since I couldn’t find a way with an ingress, I ended up using a load balancer for it to work.

As @omkensey suggested, Layer 7 forwarding is not currently supported for Boundary workers; it must be Layer 4.