Chapter 14. Tutorial: Update component routes with custom domains and TLS certificates

Procedure

1. Log in to your cluster using an account with cluster-admin privileges.

2. Configure an environment variable for your cluster name:

   $ export CLUSTER_NAME=$(oc get infrastructure cluster -o=jsonpath="{.status.infrastructureName}"  | sed 's/-[a-z0-9]\{5\}$//')

3. Ensure all fields output correctly before moving to the next section:

   $ echo "Cluster: ${CLUSTER_NAME}"

   Example output

   Cluster: my-rosa-cluster

Procedure

1. Verify that you can reach the component routes on their default hostnames.

   You can find the hostnames by querying the lists of routes in the openshift-console and openshift-authentication projects.

   $ oc get routes -n openshift-console

   $ oc get routes -n openshift-authentication

   Example output

   NAME        HOST/PORT                                                                          PATH       SERVICES    PORT    TERMINATION          WILDCARD
   console     console-openshift-console.apps.my-example-cluster-aws.z9a9.p1.openshiftapps.com    ... 1 more  console    https   reencrypt/Redirect   None
   downloads   downloads-openshift-console.apps.my-example-cluster-aws.z9a9.p1.openshiftapps.com  ... 1 more  downloads  http    edge/Redirect        None
   NAME              HOST/PORT                                                             PATH        SERVICES          PORT   TERMINATION            WILDCARD
   oauth-openshift   oauth-openshift.apps.my-example-cluster-aws.z9a9.p1.openshiftapps.com ... 1 more  oauth-openshift   6443   passthrough/Redirect   None

   From this output you can see that your base hostname is z9a9.p1.openshiftapps.com.

2. Get the ID of the default ingress by running the following command:

   $ export INGRESS_ID=$(rosa list ingress -c ${CLUSTER_NAME} -o json | jq -r '.[] | select(.default == true) | .id')

3. Ensure all fields output correctly before moving to the next section:

   $ echo "Ingress ID: ${INGRESS_ID}"

   Example output

   Ingress ID: r3l6

   By running these commands you can see that the default component routes for your cluster are:

   • console-openshift-console.apps.my-example-cluster-aws.z9a9.p1.openshiftapps.com for Console
   • downloads-openshift-console.apps.my-example-cluster-aws.z9a9.p1.openshiftapps.com for Downloads

   • oauth-openshift.apps.my-example-cluster-aws.z9a9.p1.openshiftapps.com for OAuth

     You can use the rosa edit ingress command to change the hostname of each service and add a TLS certificate for all of your component routes. The relevant parameters are shown in this excerpt of the command-line help for the rosa edit ingress command:

     $ rosa edit ingress -h
     Edit a cluster ingress for a cluster. Usage:
       rosa edit ingress ID [flags]
       [...]
       --component-routes string                Component routes settings. Available keys [oauth, console, downloads]. For each key a pair of hostname and tlsSecretRef is expected to be supplied. Format should be a comma separate list 'oauth: hostname=example-hostname;tlsSecretRef=example-secret-ref,downloads:...'

     For this example, you use the following custom component routes:

   • console.my-new-domain.dev for Console
   • downloads.my-new-domain.dev for Downloads
   • oauth.my-new-domain.dev for OAuth

Procedure

1. Update your default ingress route with the new base domain and the secret reference associated with it, and update the hostnames for each component route:

   $ rosa edit ingress -c ${CLUSTER_NAME} ${INGRESS_ID} --component-routes 'console: hostname=console.my-new-domain.dev;tlsSecretRef=console-tls,downloads: hostname=downloads.my-new-domain.dev;tlsSecretRef=downloads-tls,oauth: hostname=oauth.my-new-domain.dev;tlsSecretRef=oauth-tls'

   Alternatively, you can edit only a subset of the component routes by leaving the component routes you do not want to change set to an empty string. For example, to change only the Console and OAuth server hostnames and TLS certificates, run the following command:

   $ rosa edit ingress -c ${CLUSTER_NAME} ${INGRESS_ID} --component-routes 'console: hostname=console.my-new-domain.dev;tlsSecretRef=console-tls,downloads: hostname="";tlsSecretRef="", oauth: hostname=oauth.my-new-domain.dev;tlsSecretRef=oauth-tls'

2. Verify that your changes were successfully made:

   $ rosa list ingress -c ${CLUSTER_NAME} -ojson | jq ".[] | select(.id == \"${INGRESS_ID}\") | .component_routes"

   Example output

   {
     "console": {
       "kind": "ComponentRoute",
       "hostname": "console.my-new-domain.dev",
       "tls_secret_ref": "console-tls"
     },
     "downloads": {
       "kind": "ComponentRoute",
       "hostname": "downloads.my-new-domain.dev",
       "tls_secret_ref": "downloads-tls"
     },
     "oauth": {
       "kind": "ComponentRoute",
       "hostname": "oauth.my-new-domain.dev",
       "tls_secret_ref": "oauth-tls"
     }
   }

3. Add your certificate to the truststore on your local system.
4. Confirm that you can access your components at their new routes by using your local web browser.