Chapter 21. Configuring ingress cluster traffic

Procedure

1. Optional: To display the current external IP configuration, enter the following command:

   $ oc describe networks.config cluster

2. To edit the configuration, enter the following command:

   $ oc edit networks.config cluster

3. Modify the ExternalIP configuration, as in the following example:

   apiVersion: config.openshift.io/v1
   kind: Network
   metadata:
     name: cluster
   spec:
     ...
     externalIP: 1
     ...

   1

   Specify the configuration for the externalIP stanza.

4. To confirm the updated ExternalIP configuration, enter the following command:

   $ oc get networks.config cluster -o go-template='{{.spec.externalIP}}{{"\n"}}'

Procedure

1. Create a new project for your service by running the oc new-project command:

   $ oc new-project myproject

2. Use the oc new-app command to create your service:

   $ oc new-app nodejs:12~https://github.com/sclorg/nodejs-ex.git

3. To verify that the service was created, run the following command:

   $ oc get svc -n myproject

   Example output

   NAME        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   nodejs-ex   ClusterIP   172.30.197.157   <none>        8080/TCP   70s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project myproject

3. Run the oc expose service command to expose the route:

   $ oc expose service nodejs-ex

   Example output

   route.route.openshift.io/nodejs-ex exposed

4. To verify that the service is exposed, you can use a tool, such as cURL, to make sure the service is accessible from outside the cluster.

   1. Use the oc get route command to find the route’s host name:

      $ oc get route

      Example output

      NAME        HOST/PORT                        PATH   SERVICES    PORT       TERMINATION   WILDCARD
      nodejs-ex   nodejs-ex-myproject.example.com         nodejs-ex   8080-tcp                 None

   2. Use cURL to check that the host responds to a GET request:

      $ curl --head nodejs-ex-myproject.example.com

      Example output

      HTTP/1.1 200 OK
      ...

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml
   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: IngressController
     metadata:
       name: sharded
       namespace: openshift-ingress-operator
     spec:
       domain: <apps-sharded.basedomain.example.net> 1
       nodePlacement:
         nodeSelector:
           matchLabels:
             node-role.kubernetes.io/worker: ""
       routeSelector:
         matchLabels:
           type: sharded
     status: {}
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

   1

   Specify a domain to be used by the Ingress Controller. This domain must be different from the default Ingress Controller domain.

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that have the label type: sharded.

3. Create a new route using the domain configured in the router-internal.yaml:

   $ oc expose svc <service-name> --hostname <route-name>.apps-sharded.basedomain.example.net

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml

   Example output

   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: IngressController
     metadata:
       name: sharded
       namespace: openshift-ingress-operator
     spec:
       domain: <apps-sharded.basedomain.example.net> 1
       nodePlacement:
         nodeSelector:
           matchLabels:
             node-role.kubernetes.io/worker: ""
       namespaceSelector:
         matchLabels:
           type: sharded
     status: {}
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

   1

   Specify a domain to be used by the Ingress Controller. This domain must be different from the default Ingress Controller domain.

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that is selected by the namespace selector that have the label type: sharded.

3. Create a new route using the domain configured in the router-internal.yaml:

   $ oc expose svc <service-name> --hostname <route-name>.apps-sharded.basedomain.example.net

Procedure

1. Create a new project for your service by running the oc new-project command:

   $ oc new-project myproject

2. Use the oc new-app command to create your service:

   $ oc new-app nodejs:12~https://github.com/sclorg/nodejs-ex.git

3. To verify that the service was created, run the following command:

   $ oc get svc -n myproject

   Example output

   NAME        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   nodejs-ex   ClusterIP   172.30.197.157   <none>        8080/TCP   70s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project myproject

3. Run the oc expose service command to expose the route:

   $ oc expose service nodejs-ex

   Example output

   route.route.openshift.io/nodejs-ex exposed

4. To verify that the service is exposed, you can use a tool, such as cURL, to make sure the service is accessible from outside the cluster.

   1. Use the oc get route command to find the route’s host name:

      $ oc get route

      Example output

      NAME        HOST/PORT                        PATH   SERVICES    PORT       TERMINATION   WILDCARD
      nodejs-ex   nodejs-ex-myproject.example.com         nodejs-ex   8080-tcp                 None

   2. Use cURL to check that the host responds to a GET request:

      $ curl --head nodejs-ex-myproject.example.com

      Example output

      HTTP/1.1 200 OK
      ...

1. Log in to OpenShift Container Platform.

2. Load the project where the service you want to expose is located.

   $ oc project project1

3. Open a text file on the control plane node and paste the following text, editing the file as needed:

   Sample load balancer configuration file

   apiVersion: v1
   kind: Service
   metadata:
     name: egress-2 1
   spec:
     ports:
     - name: db
       port: 3306 2
     loadBalancerIP:
     loadBalancerSourceRanges: 3
     - 10.0.0.0/8
     - 192.168.0.0/16
     type: LoadBalancer 4
     selector:
       name: mysql 5

   1

   Enter a descriptive name for the load balancer service.

   2

   Enter the same port that the service you want to expose is listening on.

   3

   Enter a list of specific IP addresses to restrict traffic through the load balancer. This field is ignored if the cloud-provider does not support the feature.

   4

   Enter Loadbalancer as the type.

   5

   Enter the name of the service.

   Note

   To restrict traffic through the load balancer to specific IP addresses, it is recommended to use the service.beta.kubernetes.io/load-balancer-source-ranges annotation rather than setting the loadBalancerSourceRanges field. With the annotation, you can more easily migrate to the OpenShift API, which will be implemented in a future release.

4. Save and exit the file.

5. Run the following command to create the service:

   $ oc create -f <file-name>

   For example:

   $ oc create -f mysql-lb.yaml

6. Execute the following command to view the new service:

   $ oc get svc

   Example output

   NAME       TYPE           CLUSTER-IP      EXTERNAL-IP                             PORT(S)          AGE
   egress-2   LoadBalancer   172.30.22.226   ad42f5d8b303045-487804948.example.com   3306:30357/TCP   15m

   The service has an external IP address automatically assigned if there is a cloud provider enabled.

7. On the master, use a tool, such as cURL, to make sure you can reach the service using the public IP address:

   $ curl <public-ip>:<port>

   For example:

   $ curl 172.29.121.74:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connecting with the service:

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p

   Example output

   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Create a file with a new default Ingress Controller. The following example assumes that your default Ingress Controller has an External scope and no other customizations:

   Example ingresscontroller.yml file

   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     creationTimestamp: null
     name: default
     namespace: openshift-ingress-operator
   spec:
     endpointPublishingStrategy:
       loadBalancer:
         scope: External
         providerParameters:
           type: AWS
           aws:
             type: NLB
       type: LoadBalancerService

   If your default Ingress Controller has other customizations, ensure that you modify the file accordingly.

2. Force replace the Ingress Controller YAML file:

   $ oc replace --force --wait -f ingresscontroller.yml

   Wait until the Ingress Controller is replaced. Expect serveral of minutes of outages.

1. Create the Ingress Controller manifest:

    $ cat ingresscontroller-aws-nlb.yaml

   Example output

   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     name: $my_ingress_controller1
     namespace: openshift-ingress-operator
   spec:
     domain: $my_unique_ingress_domain2
     endpointPublishingStrategy:
       type: LoadBalancerService
       loadBalancer:
         scope: External3
         providerParameters:
           type: AWS
           aws:
             type: NLB

   1

   Replace $my_ingress_controller with a unique name for the Ingress Controller.

   2

   Replace $my_unique_ingress_domain with a domain name that is unique among all Ingress Controllers in the cluster. This variable must be a subdomain of the DNS name <clustername>.<domain>.

   3

   You can replace External with Internal to use an internal NLB.

2. Create the resource in the cluster:

   $ oc create -f ingresscontroller-aws-nlb.yaml

1. Change to the directory that contains the installation program and create the manifests:

   $ ./openshift-install create manifests --dir <installation_directory> 1

   1

   For <installation_directory>, specify the name of the directory that contains the install-config.yaml file for your cluster.

2. Create a file that is named cluster-ingress-default-ingresscontroller.yaml in the <installation_directory>/manifests/ directory:

   $ touch <installation_directory>/manifests/cluster-ingress-default-ingresscontroller.yaml 1

   1

   For <installation_directory>, specify the directory name that contains the manifests/ directory for your cluster.

   After creating the file, several network configuration files are in the manifests/ directory, as shown:

   $ ls <installation_directory>/manifests/cluster-ingress-default-ingresscontroller.yaml

   Example output

   cluster-ingress-default-ingresscontroller.yaml

3. Open the cluster-ingress-default-ingresscontroller.yaml file in an editor and enter a custom resource (CR) that describes the Operator configuration you want:

   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     creationTimestamp: null
     name: default
     namespace: openshift-ingress-operator
   spec:
     endpointPublishingStrategy:
       loadBalancer:
         scope: External
         providerParameters:
           type: AWS
           aws:
             type: NLB
       type: LoadBalancerService

4. Save the cluster-ingress-default-ingresscontroller.yaml file and quit the text editor.
5. Optional: Back up the manifests/cluster-ingress-default-ingresscontroller.yaml file. The installation program deletes the manifests/ directory when creating the cluster.

Procedure

1. Optional: To confirm what IP address ranges are configured for use with ExternalIP, enter the following command:

   $ oc get networks.config cluster -o jsonpath='{.spec.externalIP}{"\n"}'

   If autoAssignCIDRs is set, OpenShift Container Platform automatically assigns an ExternalIP to a new Service object if the spec.externalIPs field is not specified.

2. Attach an ExternalIP to the service.

   1. If you are creating a new service, specify the spec.externalIPs field and provide an array of one or more valid IP addresses. For example:

      apiVersion: v1
      kind: Service
      metadata:
        name: svc-with-externalip
      spec:
        ...
        externalIPs:
        - 192.174.120.10

   2. If you are attaching an ExternalIP to an existing service, enter the following command. Replace <name> with the service name. Replace <ip_address> with a valid ExternalIP address. You can provide multiple IP addresses separated by commas.

      $ oc patch svc <name> -p \
        '{
          "spec": {
            "externalIPs": [ "<ip_address>" ]
          }
        }'

      For example:

      $ oc patch svc mysql-55-rhel7 -p '{"spec":{"externalIPs":["192.174.120.10"]}}'

      Example output

      "mysql-55-rhel7" patched

3. To confirm that an ExternalIP address is attached to the service, enter the following command. If you specified an ExternalIP for a new service, you must create the service first.

   $ oc get svc

   Example output

   NAME               CLUSTER-IP      EXTERNAL-IP     PORT(S)    AGE
   mysql-55-rhel7     172.30.131.89   192.174.120.10  3306/TCP   13m

Procedure

1. Create a new project for your service by running the oc new-project command:

   $ oc new-project myproject

2. Use the oc new-app command to create your service:

   $ oc new-app nodejs:12~https://github.com/sclorg/nodejs-ex.git

3. To verify that the service was created, run the following command:

   $ oc get svc -n myproject

   Example output

   NAME        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
   nodejs-ex   ClusterIP   172.30.197.157   <none>        8080/TCP   70s

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project myproject

3. To expose a node port for the application, enter the following command. OpenShift Container Platform automatically selects an available port in the 30000-32767 range.

   $ oc expose service nodejs-ex  --type=NodePort --name=nodejs-ex-nodeport --generator="service/v2"

   Example output

   service/nodejs-ex-nodeport exposed

4. Optional: To confirm the service is available with a node port exposed, enter the following command:

   $ oc get svc -n myproject

   Example output

   NAME                TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
   nodejs-ex           ClusterIP   172.30.217.127   <none>        3306/TCP         9m44s
   nodejs-ex-ingress   NodePort    172.30.107.72    <none>        3306:31345/TCP   39s

5. Optional: To remove the service created automatically by the oc new-app command, enter the following command:

   $ oc delete svc nodejs-ex