Enable Diagnostic UI in the internal k8s network only

[jfrabaute]

Please describe your use case / problem.
Since 1.6, when the diagnostics is disabled, the admin UI is not exposed to envoy, but it is also not exposed to the pod IP. It is only exposed the 127.0.0.1.
This makes exposing the UI difficult.
Our use case is that we have another ambassador group running, for all the admin UIs and we were exposing the public ambassador admin with this admin ambassador group. Now it returns Not found.

Describe the solution you'd like
Right now, there is a flag diagnotics.enabled which is "true" or "false".
There are two options: Either we make this flag accept multiple values (ex: "disabled", "enabled", "pod_enabled_only") instead of a bool, or we add a second flag, (ex pod_enabled: true) to enable the admin UI outside of the pod (but not publicly).
(Names are probably bad, it's just provided as example).

Additional context
Initial discussion: https://datawire-oss.slack.com/archives/CAULN7S76/p1605206931353900

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jfrabaute]

/notstale

[kflynn]

As mentioned on Slack:

I would probably lean more towards a second variable like diag_bind_address maybe, since I think that’s what would actually be changing? I’m not opposed to more granularity here.

[jfrabaute]

Actually.... this is not related to the bind address. It's just hardcoded in the code:

    enabled = app.ir.ambassador_module.diagnostics.get("enabled", False)
    if not enabled and not _is_local_request():
        return Response("Not found\n", 404)

so when I set diagnostics.enabled to false, it blocks the request from the request handler.
diagnostics.enabled to true is adding the mappings which expose the diag UI to the outside world.

I might need to add something like expose_non_local: true ? So something like that?

      config:
        diagnostics:
          enabled: false
          expose_non_local: true

Maybe there is another way...

[kflynn]

I'd go with allow_non_local, but yes, after our discussion on Slack, I think that's as good as you're gonna get. Go for it. 🙂