Chapter 12. Configuring ingress cluster traffic

Procedure

1. Optional: To display the current external IP configuration, enter the following command:

   $ oc describe networks.config cluster

2. To edit the configuration, enter the following command:

   $ oc edit networks.config cluster

3. Modify the ExternalIP configuration, as in the following example:

   apiVersion: config.openshift.io/v1
   kind: Network
   metadata:
     name: cluster
   spec:
     ...
     externalIP: 1
     ...

   1

   Specify the configuration for the externalIP stanza.

4. To confirm the updated ExternalIP configuration, enter the following command:

   $ oc get networks.config cluster -o go-template='{{.spec.externalIP}}{{"\n"}}'

Procedure

1. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

2. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/rhscl/mysql-80-rhel7

3. Run the following command to see that the new service is created:

   $ oc get svc -n myproject

   Example output

   NAME             TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   mysql-80-rhel7   ClusterIP   172.30.63.31   <none>        3306/TCP   4m55s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. Run the following command to expose the route:

   $ oc expose service <service_name>

   For example:

   $ oc expose service mysql-80-rhel7

   Example output

   route "mysql-80-rhel7" exposed

4. Use a tool, such as cURL, to make sure you can reach the service using the cluster IP address for the service:

   $ curl <pod_ip>:<port>

   For example:

   $ curl 172.30.131.89:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connected to the service.

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p

   Example output

   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml
   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: IngressController
     metadata:
       name: sharded
       namespace: openshift-ingress-operator
     spec:
       domain: <apps-sharded.basedomain.example.net>
       nodePlacement:
         nodeSelector:
           matchLabels:
             node-role.kubernetes.io/worker: ""
       routeSelector:
         matchLabels:
           type: sharded
     status: {}
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that have the label type: sharded.

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml

   Example output

   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: IngressController
     metadata:
       name: sharded
       namespace: openshift-ingress-operator
     spec:
       domain: <apps-sharded.basedomain.example.net>
       nodePlacement:
         nodeSelector:
           matchLabels:
             node-role.kubernetes.io/worker: ""
       namespaceSelector:
         matchLabels:
           type: sharded
     status: {}
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that is selected by the namespace selector that have the label type: sharded.

Procedure

1. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

2. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/rhscl/mysql-80-rhel7

3. Run the following command to see that the new service is created:

   $ oc get svc -n myproject

   Example output

   NAME             TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   mysql-80-rhel7   ClusterIP   172.30.63.31   <none>        3306/TCP   4m55s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. Run the following command to expose the route:

   $ oc expose service <service_name>

   For example:

   $ oc expose service mysql-80-rhel7

   Example output

   route "mysql-80-rhel7" exposed

4. Use a tool, such as cURL, to make sure you can reach the service using the cluster IP address for the service:

   $ curl <pod_ip>:<port>

   For example:

   $ curl 172.30.131.89:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connected to the service.

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p

   Example output

   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

1. Log in to OpenShift Container Platform.

2. Load the project where the service you want to expose is located.

   $ oc project project1

3. Open a text file on the master node and paste the following text, editing the file as needed:

   Sample load balancer configuration file

   apiVersion: v1
   kind: Service
   metadata:
     name: egress-2 1
   spec:
     ports:
     - name: db
       port: 3306 2
     loadBalancerIP:
     type: LoadBalancer 3
     selector:
       name: mysql 4

   1

   Enter a descriptive name for the load balancer service.

   2

   Enter the same port that the service you want to expose is listening on.

   3

   Enter loadbalancer as the type.

   4

   Enter the name of the service.

4. Save and exit the file.

5. Run the following command to create the service:

   $ oc create -f <file-name>

   For example:

   $ oc create -f mysql-lb.yaml

6. Execute the following command to view the new service:

   $ oc get svc

   Example output

   NAME       TYPE           CLUSTER-IP      EXTERNAL-IP                             PORT(S)          AGE
   egress-2   LoadBalancer   172.30.22.226   ad42f5d8b303045-487804948.example.com   3306:30357/TCP   15m

   The service has an external IP address automatically assigned if there is a cloud provider enabled.

7. On the master, use a tool, such as cURL, to make sure you can reach the service using the public IP address:

   $ curl <public-ip>:<port>

   For example:

   $ curl 172.29.121.74:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connecting with the service:

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p

   Example output

   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Optional: To confirm what IP address ranges are configured for use with ExternalIP, enter the following command:

   $ oc get networks.config cluster -o jsonpath='{.spec.externalIP}{"\n"}'

   If autoAssignCIDRs is set, OpenShift Container Platform automatically assigns an ExternalIP to a new Service object if the spec.externalIPs field is not specified.

2. Attach an ExternalIP to the service.

   1. If you are creating a new service, specify the spec.externalIPs field and provide an array of one or more valid IP addresses. For example:

      apiVersion: v1
      kind: Service
      metadata:
        name: svc-with-externalip
      spec:
        ...
        externalIPs:
        - 192.174.120.10

   2. If you are attaching an ExternalIP to an existing service, enter the following command. Replace <name> with the service name. Replace <ip_address> with a valid ExternalIP address. You can provide multiple IP addresses separated by commas.

      $ oc patch svc <name> -p \
        '{
          "spec": {
            "externalIPs": [ "<ip_address>" ]
          }
        }'

      For example:

      $ oc patch svc mysql-55-rhel7 -p '{"spec":{"externalIPs":["192.174.120.10"]}}'

      Example output

      "mysql-55-rhel7" patched

3. To confirm that an ExternalIP address is attached to the service, enter the following command. If you specified an ExternalIP for a new service, you must create the service first.

   $ oc get svc

   Example output

   NAME               CLUSTER-IP      EXTERNAL-IP     PORT(S)    AGE
   mysql-55-rhel7     172.30.131.89   192.174.120.10  3306/TCP   13m

Procedure

1. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

2. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/rhscl/mysql-80-rhel7

3. Run the following command to see that the new service is created:

   $ oc get svc -n myproject

   Example output

   NAME             TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
   mysql-80-rhel7   ClusterIP   172.30.63.31   <none>        3306/TCP   4m55s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. To expose a node port for the application, enter the following command. OpenShift Container Platform automatically selects an available port in the 30000-32767 range.

   $ oc expose dc mysql-80-rhel7 --type=NodePort --name=mysql-ingress

4. Optional: To confirm the service is available with a node port exposed, enter the following command:

   $ oc get svc -n myproject

   Example output

   NAME             TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
   mysql-80-rhel7   ClusterIP   172.30.217.127   <none>        3306/TCP         9m44s
   mysql-ingress    NodePort    172.30.107.72    <none>        3306:31345/TCP   39s

5. Optional: To remove the service created automatically by the oc new-app command, enter the following command:

   $ oc delete svc mysql-80-rhel7