Chapter 5. Networking

Procedure

1. Define a proxy using the http_proxy and https_proxy environment variables or using the crc config set command as follows:

   $ crc config set http-proxy http://proxy.example.com:<port>
   $ crc config set https-proxy http://proxy.example.com:<port>
   $ crc config set no-proxy <comma-separated-no-proxy-entries>

2. If the proxy uses a custom CA certificate file, set it as follows:

   $ crc config set proxy-ca-file <path-to-custom-ca-file>

Procedure

1. Start the cluster:

   $ crc start

   Ensure that the cluster remains running during this procedure.

2. Install the haproxy package and other utilities:

   $ sudo dnf install haproxy /usr/sbin/semanage

3. Modify the firewall to allow communication with the cluster:

   $ sudo systemctl enable --now firewalld
   $ sudo firewall-cmd --add-service=http --permanent
   $ sudo firewall-cmd --add-service=https --permanent
   $ sudo firewall-cmd --add-service=kube-apiserver --permanent
   $ sudo firewall-cmd --reload

4. For SELinux, allow HAProxy to listen on TCP port 6443 to serve kube-apiserver on this port:

   $ sudo semanage port -a -t http_port_t -p tcp 6443

5. Create a backup of the default haproxy configuration:

   $ sudo cp /etc/haproxy/haproxy.cfg{,.bak}

6. Configure haproxy for use with the cluster:

   $ export CRC_IP=$(crc ip)
   $ sudo tee /etc/haproxy/haproxy.cfg &>/dev/null <<EOF
   global
       log /dev/log local0
   
   defaults
       balance roundrobin
       log global
       maxconn 100
       mode tcp
       timeout connect 5s
       timeout client 500s
       timeout server 500s
   
   listen apps
       bind 0.0.0.0:80
       server crcvm $CRC_IP:80 check
   
   listen apps_ssl
       bind 0.0.0.0:443
       server crcvm $CRC_IP:443 check
   
   listen api
       bind 0.0.0.0:6443
       server crcvm $CRC_IP:6443 check
   EOF

7. Start the haproxy service:

   $ sudo systemctl start haproxy

Procedure

1. Install the dnsmasq package:

   $ sudo dnf install dnsmasq

2. Enable the use of dnsmasq for DNS resolution in NetworkManager:

   $ sudo tee /etc/NetworkManager/conf.d/use-dnsmasq.conf &>/dev/null <<EOF
   [main]
   dns=dnsmasq
   EOF

3. Add DNS entries for CodeReady Containers to the dnsmasq configuration:

   $ sudo tee /etc/NetworkManager/dnsmasq.d/external-crc.conf &>/dev/null <<EOF
   address=/apps-crc.testing/SERVER_IP_ADDRESS
   address=/api.crc.testing/SERVER_IP_ADDRESS
   EOF

   Note

   Comment out any existing entries in /etc/NetworkManager/dnsmasq.d/crc.conf. These entries are created by running a local instance of CodeReady Containers and will conflict with the entries for the remote cluster.

4. Reload the NetworkManager service:

   $ sudo systemctl reload NetworkManager

5. Log in to the remote cluster as the developer user with oc:

   $ oc login -u developer -p developer https://api.crc.testing:6443

   The remote OpenShift Web Console is available at https://console-openshift-console.apps-crc.testing.