Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 2. Ingress Operator in OpenShift Dedicated

The Ingress Operator implements the IngressController API and is the component responsible for enabling external access to OpenShift Dedicated cluster services.

This Operator is installed on OpenShift Dedicated clusters by default.

2.1. OpenShift Dedicated Ingress Operator
Copy link

When you create your OpenShift Dedicated cluster, pods and services running on the cluster are each allocated their own IP addresses. The IP addresses are accessible to other pods and services running nearby but are not accessible to outside clients.

The Ingress Operator makes it possible for external clients to access your service by deploying and managing one or more HAProxy-based Ingress Controllers to handle routing.

Red Hat Site Reliability Engineers (SRE) manage the Ingress Operator for OpenShift Dedicated clusters. While you cannot alter the settings for the Ingress Operator, you may view the default Ingress Controller configurations, status, and logs as well as the Ingress Operator status.

2.2. View the default Ingress Controller
Copy link

The Ingress Operator is a core feature of OpenShift Dedicated and is enabled out of the box.

Every new OpenShift Dedicated installation has an ingresscontroller named default. It can be supplemented with additional Ingress Controllers. If the default ingresscontroller is deleted, the Ingress Operator will automatically recreate it within a minute.

Procedure

  • View the default Ingress Controller: 

    $ oc describe --namespace=openshift-ingress-operator ingresscontroller/default

2.3. View Ingress Operator status
Copy link

You can view and inspect the status of your Ingress Operator.

Procedure

  • View your Ingress Operator status: 

    $ oc describe clusteroperators/ingress

2.4. View Ingress Controller logs
Copy link

You can view your Ingress Controller logs.

Procedure

  • View your Ingress Controller logs: 

    $ oc logs --namespace=openshift-ingress-operator deployments/ingress-operator -c <container_name>

2.5. View Ingress Controller status
Copy link

Your can view the status of a particular Ingress Controller.

Procedure

  • View the status of an Ingress Controller: 

    $ oc describe --namespace=openshift-ingress-operator ingresscontroller/<name>

The following table details the components of the default Ingress Controller managed by the Ingress Operator and whether Red Hat Site Reliability Engineering (SRE) maintains this component on OpenShift Dedicated clusters.

Expand
Table 2.1. Ingress Operator Responsibility Chart
Ingress componentManaged byDefault configuration?

Scaling Ingress Controller

SRE

Yes

Ingress Operator thread count

SRE

Yes

Ingress Controller access logging

SRE

Yes

Ingress Controller sharding

SRE

Yes

Ingress Controller route admission policy

SRE

Yes

Ingress Controller wildcard routes

SRE

Yes

Ingress Controller X-Forwarded headers

SRE

Yes

Ingress Controller route compression

SRE

Yes

When you create an OpenShift Dedicated cluster in noninteractive mode, you can pass a namespace label selector so that namespaces matching those labels are excluded from the default application ingress. This allows you to exclude namespaces that host workloads through the default ingress, such as namespaces with sensitive data or internal services.

Prerequisites

  • You installed the ocm CLI and logged in with credentials that can create clusters in Red Hat OpenShift Cluster Manager.
  • You are using the noninteractive mode for ocm create cluster. For interactive mode, use the prompts for ingress settings when they are available for your ocm version.
Note

Do not exclude namespaces that host required platform routes (for example, openshift-console or openshift-authentication). Excluding them can break the web console, downloads, or OAuth flows.

Procedure

  1. Run ocm create cluster -h and confirm that your ocm version lists the --exclude-namespace-selector flag.

  2. Build your ocm create cluster command with the required parameters for your cloud provider and subscription model.

    The following example shows only the ingress-related fragment. Replace the rest of the flags with the values required for your environment. 

    $ ocm create cluster <cluster_name> \
  --provider=<aws_or_gcp> \
  <other_required_flags> \
  --default-ingress-excluded-namespace-selectors '<key>=<value>,<key2>=<value2>'

    where:

    <cluster_name>
    Specifies the cluster name.
    --provider=<aws_or_gcp>
    Specifies the cloud provider.
    <other_required_flags>
    Required parameters such as region, version, CCS settings, or billing flags, as described in the cluster creation documentation for your platform.
    --default-ingress-excluded-namespace-selectors
    Specifies label selectors; namespaces whose labels match are excluded from the default application ingress, subject to validation by the service. Replace <key>=<value> with your labels. Do not include spaces around the = sign.

Verification

  • After the cluster reaches ready state, confirm ingress settings and inspect the default ingress object for the configured exclusion data. 

    $ ocm list ingress -c <cluster_name>

As a cluster administrator, you can use the OpenShift Cluster Manager CLI (ocm) to set which namespaces are excluded from the default application ingress on an existing cluster. Excluded namespaces do not have routes served by that ingress.

Prerequisites

  • You installed the ocm CLI and logged in with credentials that can modify cluster ingress settings in Red Hat OpenShift Cluster Manager.
  • You have the cluster name, cluster ID, or external ID of your cluster.
Important

Do not exclude namespaces that host required platform routes (for example, openshift-console or openshift-authentication). Excluding them can break the web console, downloads, or OAuth flows.

Procedure

  1. Optional: Set your cluster name in a variable: 

    $ export CLUSTER_NAME=<cluster_name>

  2. List ingress endpoints for the cluster and note the id of the default ingress: 

    $ ocm list ingress -c ${CLUSTER_NAME}

  3. Optional: To store the default ingress ID in a variable: 

    $ export INGRESS_ID=$(ocm list ingress -c ${CLUSTER_NAME}| jq -r '.[] | select(.default == true) | .id')

  4. Edit the default ingress and set excluded namespaces as a comma-separated list of namespace names: 

    $ ocm edit ingress -c ${CLUSTER_NAME} ${INGRESS_ID} \
    --excluded-namespaces 'namespace-one,namespace-two'

    Substitute namespace-one, namespace-two, and any additional entries with the metadata names of the namespaces to exclude.

Verification

  • After the command completes, verify that the updated ingress object reflects your excluded namespace settings. 

    $ ocm list ingress -c <cluster_name>
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top