Testing connectivity with Unleash Edge

[fdebuire]

Hello,

We are trying to debug our connectivity to Unleash with Unleash edge.

Here is an example of curl command that works:

curl -i -H "Authorization: user:REDACTED" https://eu.app.unleash-hosted.com/REDACTED/api/admin/projects

where the user we are trying to use is a Service Account token.

And this is the one which doesn't work:

curl -i -H "Authorization: user:REDACTED" http://unleash-edge.unleash-edge.svc.cluster.local:3063/api/admin/projects

It ends up in a 403.

We believe it's because unleash edge is expecting another header than Authorization but we are not able to figure out which one from the documentation.

Also using Unleash Edge on another project works fine but the client is using the Java SDK and not direct API call, but it shows that our Unleash Edge setup is working.

Thanks

[sighphyre]

Hey @fdebuire,

Unleash Edge only exposes a read replica of the endpoints necessary for SDKs to work. That means that this endpoint: https://eu.app.unleash-hosted.com/REDACTED/api/admin/projects isn't available using Edge, you need to go through the Unleash API directly if you're looking for information about projects.

Because Edge only exposes the SDK endpoints, it only accepts Client Tokens and Frontend Tokens. The service account token you're using here only allows access to the admin endpoints.

Edge is likely working fine with your Java SDK (which must be using a Client Token) because its smart enough to reuse the token that the Java SDK sends it, in order to authenticate to Unleash itself.

As an aside, it can be helpful to set the RUST_LOG env variable to debug if you're trying to figure out what Edge is up to - that will cause it to emit full debug logging (it's quite noisy so definitely don't do that in prod).

What are you trying to do here? It sounds like you might be wanting to use Edge for a use case we hadn't considered?

[fdebuire]

Hello, thanks for the answer.

On this particular case we wanted to do mostly admin operations and we are used to use Unleash Edge so we forgot that this was only a read replica.

Our use case is basically to redevelop one part of the Unleash UI (...) in a tool where our clients have access (we don't want to give them access to Unleash itself) so they can configure their feature flags.

[sighphyre]

Ah, that makes sense. Yes, you definitely want to talk directly to Unleash here and not Edge.