<p>I have a following service in open shift</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v1
      kind: Mapping
      name: _api_minio
      service: "http://minio-svc:9000"
      prefix: /api/minio/
      rewrite: /
      bypass_auth: true
      host: xxxx
      add_response_headers:
        Strict-Transport-Security: max-age=15552000; includeSubDomains
        X-Frame-Options: SAMEORIGIN
  creationTimestamp: '2020-01-09T15:10:34Z'
  labels:
    platform: xxx
  name: minio
  namespace: xxx
  resourceVersion: 'xxxxx'
  selfLink: /api/v1/namespaces/services/minio
  uid: 2f7619a0-32f2-11ea-9dcc-xxxxxxxx
spec:
  clusterIP:xxxxx
  ports:
    - port: 80
      protocol: TCP
      targetPort: 80
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}
</code></pre>

<p>So this is a service which proxy the external request to internal minio which our object storage but as soon as I try to reach a url to the object I get:</p>

<pre><code>The request signature we calculated does not match the signature you provided. Check your key and signing method.
</code></pre>

<p>which seems that the above service does not pass through all the headers sent from browser.
Can anyone shed light on how I can pass through all headers coming in to the service to the internal service which is minio in this case? </p>

<p>In it's most basic configuration, Ambassador routes based off the incoming <code>prefix</code> of the request. Currently, you have Ambassador configured to route requests with <code>prefix: /api/minio/</code> to the service named <code>minio-svc</code> over port <code>9000</code> with <code>prefix: /</code>.</p>

<p>With this configuration, a request to <code>http(s)://{{IP}}/api/minio/</code> will correctly hit the <code>minio-svc</code> with the prefix rewritten to <code>/</code>. However, if you inspect the network logs, you will see that when minio receives a request with <code>prefix: /</code> it issues a 307 redirect to <code>/minio/</code> which is not a registered route in Ambassador which is why you see the failure.</p>

<p>The fix for this is to edit you <code>Mapping</code> to route based off the <code>prefix: /minio/</code> and not rewrite that prefix when sending the request downstream:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v1
      kind: Mapping
      name: _api_minio
      service: "http://minio-svc:9000"
      prefix: /minio/
      rewrite: ""
      bypass_auth: true
      host: xxxx
      add_response_headers:
        Strict-Transport-Security: max-age=15552000; includeSubDomains
        X-Frame-Options: SAMEORIGIN
  creationTimestamp: '2020-01-09T15:10:34Z'
  labels:
    platform: xxx
  name: minio
  namespace: xxx
  resourceVersion: 'xxxxx'
  selfLink: /api/v1/namespaces/services/minio
  uid: 2f7619a0-32f2-11ea-9dcc-xxxxxxxx
spec:
  clusterIP:xxxxx
  ports:
    - port: 80
      protocol: TCP
      targetPort: 80
  sessionAffinity: None
  type: ClusterIP
</code></pre>

<p>Now a request to <code>http(s)://{{IP}}/minio/</code> will be sent to the service <code>minio-svc</code> on port <code>9000</code> with <code>prefix: /minio/</code> which should resolve.</p>

<p>When debugging these kind of larger, GUI application behind a reverse proxy it is very useful to check the network logs of your browser to see if there are resource requests that are failing.</p>
