Chapter 25. Configuring ingress cluster traffic

Procedure

1. Optional: To display the current external IP configuration, enter the following command:

   $ oc describe networks.config cluster

2. To edit the configuration, enter the following command:

   $ oc edit networks.config cluster

3. Modify the ExternalIP configuration, as in the following example:

   apiVersion: config.openshift.io/v1
   kind: Network
   metadata:
     name: cluster
   spec:
     ...
     externalIP: 1
     ...

   1

   Specify the configuration for the externalIP stanza.

4. To confirm the updated ExternalIP configuration, enter the following command:

   $ oc get networks.config cluster -o go-template='{{.spec.externalIP}}{{"\n"}}'

Procedure

1. Create a new project for your service by running the oc new-project command:

   $ oc new-project myproject

2. Use the oc new-app command to create your service:

   $ oc new-app nodejs:12~https://github.com/sclorg/nodejs-ex.git

3. To verify that the service was created, run the following command:

   $ oc get svc -n myproject

   Example output

   NAME        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   nodejs-ex   ClusterIP   172.30.197.157   <none>        8080/TCP   70s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project myproject

3. Run the oc expose service command to expose the route:

   $ oc expose service nodejs-ex

   Example output

   route.route.openshift.io/nodejs-ex exposed

4. To verify that the service is exposed, you can use a tool, such as cURL, to make sure the service is accessible from outside the cluster.

   1. Use the oc get route command to find the route’s host name:

      $ oc get route

      Example output

      NAME        HOST/PORT                        PATH   SERVICES    PORT       TERMINATION   WILDCARD
      nodejs-ex   nodejs-ex-myproject.example.com         nodejs-ex   8080-tcp                 None

   2. Use cURL to check that the host responds to a GET request:

      $ curl --head nodejs-ex-myproject.example.com

      Example output

      HTTP/1.1 200 OK
      ...

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml
   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     name: sharded
     namespace: openshift-ingress-operator
   spec:
     domain: <apps-sharded.basedomain.example.net> 1
     nodePlacement:
       nodeSelector:
         matchLabels:
           node-role.kubernetes.io/worker: ""
     routeSelector:
       matchLabels:
         type: sharded

   1

   Specify a domain to be used by the Ingress Controller. This domain must be different from the default Ingress Controller domain.

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that have the label type: sharded.

3. Create a new route using the domain configured in the router-internal.yaml:

   $ oc expose svc <service-name> --hostname <route-name>.apps-sharded.basedomain.example.net

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml

   Example output

   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     name: sharded
     namespace: openshift-ingress-operator
   spec:
     domain: <apps-sharded.basedomain.example.net> 1
     nodePlacement:
       nodeSelector:
         matchLabels:
           node-role.kubernetes.io/worker: ""
     namespaceSelector:
       matchLabels:
         type: sharded

   1

   Specify a domain to be used by the Ingress Controller. This domain must be different from the default Ingress Controller domain.

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that is selected by the namespace selector that have the label type: sharded.

3. Create a new route using the domain configured in the router-internal.yaml:

   $ oc expose svc <service-name> --hostname <route-name>.apps-sharded.basedomain.example.net

Procedure

1. Create a project called hello-openshift by running the following command:

   $ oc new-project hello-openshift

2. Create a pod in the project by running the following command:

   $ oc create -f https://raw.githubusercontent.com/openshift/origin/master/examples/hello-openshift/hello-pod.json

3. Create a service called hello-openshift by running the following command:

   $ oc expose pod/hello-openshift

4. Create a route definition called hello-openshift-route.yaml:

   YAML definition of the created route for sharding:

   apiVersion: route.openshift.io/v1
   kind: Route
   metadata:
     labels:
       type: sharded 1
     name: hello-openshift-edge
     namespace: hello-openshift
   spec:
     subdomain: hello-openshift 2
     tls:
       termination: edge
     to:
       kind: Service
       name: hello-openshift

   1

   Both the label key and its corresponding label value must match the ones specified in the Ingress Controller. In this example, the Ingress Controller has the label key and value type: sharded.

   2

   The route will be exposed using the value of the subdomain field. When you specify the subdomain field, you must leave the hostname unset. If you specify both the host and subdomain fields, then the route will use the value of the host field, and ignore the subdomain field.

5. Use hello-openshift-route.yaml to create a route to the hello-openshift application by running the following command:

   $ oc -n hello-openshift create -f hello-openshift-route.yaml

Procedure

1. Create a new project for your service by running the oc new-project command:

   $ oc new-project myproject

2. Use the oc new-app command to create your service:

   $ oc new-app nodejs:12~https://github.com/sclorg/nodejs-ex.git

3. To verify that the service was created, run the following command:

   $ oc get svc -n myproject

   Example output

   NAME        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   nodejs-ex   ClusterIP   172.30.197.157   <none>        8080/TCP   70s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project myproject

3. Run the oc expose service command to expose the route:

   $ oc expose service nodejs-ex

   Example output

   route.route.openshift.io/nodejs-ex exposed

4. To verify that the service is exposed, you can use a tool, such as cURL, to make sure the service is accessible from outside the cluster.

   1. Use the oc get route command to find the route’s host name:

      $ oc get route

      Example output

      NAME        HOST/PORT                        PATH   SERVICES    PORT       TERMINATION   WILDCARD
      nodejs-ex   nodejs-ex-myproject.example.com         nodejs-ex   8080-tcp                 None

   2. Use cURL to check that the host responds to a GET request:

      $ curl --head nodejs-ex-myproject.example.com

      Example output

      HTTP/1.1 200 OK
      ...

1. Log in to OpenShift Container Platform.

2. Load the project where the service you want to expose is located.

   $ oc project project1

3. Open a text file on the control plane node and paste the following text, editing the file as needed:

   Sample load balancer configuration file

   apiVersion: v1
   kind: Service
   metadata:
     name: egress-2 1
   spec:
     ports:
     - name: db
       port: 3306 2
     loadBalancerIP:
     loadBalancerSourceRanges: 3
     - 10.0.0.0/8
     - 192.168.0.0/16
     type: LoadBalancer 4
     selector:
       name: mysql 5

   1

   Enter a descriptive name for the load balancer service.

   2

   Enter the same port that the service you want to expose is listening on.

   3

   Enter a list of specific IP addresses to restrict traffic through the load balancer. This field is ignored if the cloud-provider does not support the feature.

   4

   Enter Loadbalancer as the type.

   5

   Enter the name of the service.

   Note

   To restrict traffic through the load balancer to specific IP addresses, it is recommended to use the service.beta.kubernetes.io/load-balancer-source-ranges annotation rather than setting the loadBalancerSourceRanges field. With the annotation, you can more easily migrate to the OpenShift API, which will be implemented in a future release.

4. Save and exit the file.

5. Run the following command to create the service:

   $ oc create -f <file-name>

   For example:

   $ oc create -f mysql-lb.yaml

6. Execute the following command to view the new service:

   $ oc get svc

   Example output

   NAME       TYPE           CLUSTER-IP      EXTERNAL-IP                             PORT(S)          AGE
   egress-2   LoadBalancer   172.30.22.226   ad42f5d8b303045-487804948.example.com   3306:30357/TCP   15m

   The service has an external IP address automatically assigned if there is a cloud provider enabled.

7. On the master, use a tool, such as cURL, to make sure you can reach the service using the public IP address:

   $ curl <public-ip>:<port>

   For example:

   $ curl 172.29.121.74:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connecting with the service:

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p

   Example output

   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Optional: To confirm what IP address ranges are configured for use with ExternalIP, enter the following command:

   $ oc get networks.config cluster -o jsonpath='{.spec.externalIP}{"\n"}'

   If autoAssignCIDRs is set, OpenShift Container Platform automatically assigns an ExternalIP to a new Service object if the spec.externalIPs field is not specified.

2. Attach an ExternalIP to the service.

   1. If you are creating a new service, specify the spec.externalIPs field and provide an array of one or more valid IP addresses. For example:

      apiVersion: v1
      kind: Service
      metadata:
        name: svc-with-externalip
      spec:
        ...
        externalIPs:
        - 192.174.120.10

   2. If you are attaching an ExternalIP to an existing service, enter the following command. Replace <name> with the service name. Replace <ip_address> with a valid ExternalIP address. You can provide multiple IP addresses separated by commas.

      $ oc patch svc <name> -p \
        '{
          "spec": {
            "externalIPs": [ "<ip_address>" ]
          }
        }'

      For example:

      $ oc patch svc mysql-55-rhel7 -p '{"spec":{"externalIPs":["192.174.120.10"]}}'

      Example output

      "mysql-55-rhel7" patched

3. To confirm that an ExternalIP address is attached to the service, enter the following command. If you specified an ExternalIP for a new service, you must create the service first.

   $ oc get svc

   Example output

   NAME               CLUSTER-IP      EXTERNAL-IP     PORT(S)    AGE
   mysql-55-rhel7     172.30.131.89   192.174.120.10  3306/TCP   13m

Procedure

1. Create a new project for your service by running the oc new-project command:

   $ oc new-project myproject

2. Use the oc new-app command to create your service:

   $ oc new-app nodejs:12~https://github.com/sclorg/nodejs-ex.git

3. To verify that the service was created, run the following command:

   $ oc get svc -n myproject

   Example output

   NAME        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   nodejs-ex   ClusterIP   172.30.197.157   <none>        8080/TCP   70s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project myproject

3. To expose a node port for the application, modify the custom resource definition (CRD) of a service by entering the following command:

   $ oc edit svc <service_name>

   Example output

   spec:
     ports:
     - name: 8443-tcp
       nodePort: 30327 1
       port: 8443
       protocol: TCP
       targetPort: 8443
     sessionAffinity: None
     type: NodePort 2

   1

   Optional: Specify the node port range for the application. By default, OpenShift Container Platform selects an available port in the 30000-32767 range.

   2

   Define the service type.

4. Optional: To confirm the service is available with a node port exposed, enter the following command:

   $ oc get svc -n myproject

   Example output

   NAME                TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
   nodejs-ex           ClusterIP   172.30.217.127   <none>        3306/TCP         9m44s
   nodejs-ex-ingress   NodePort    172.30.107.72    <none>        3306:31345/TCP   39s

5. Optional: To remove the service created automatically by the oc new-app command, enter the following command:

   $ oc delete svc nodejs-ex