Chapter 1. Deployments

Procedure

1. Create a new TLS secret from a private key and a public certificate, where fullchain.pem and privkey.pem are your public or private wildcard certificates.

   Example

   $ oc create secret tls <name>-tls --cert=fullchain.pem --key=privkey.pem -n <my_project>

2. Create a new CustomDomain custom resource (CR):

   Example <company_name>-custom-domain.yaml

   apiVersion: managed.openshift.io/v1alpha1
   kind: CustomDomain
   metadata:
     name: <company_name>
   spec:
     domain: apps.<company_name>.io 1
     scope: External
     loadBalancerType: Classic 2
     certificate:
       name: <name>-tls 3
       namespace: <my_project>
     routeSelector: 4
       matchLabels:
        route: acme
     namespaceSelector: 5
       matchLabels:
        type: sharded

   1

   The custom domain.

   2

   The type of load balancer for your custom domain. This type can be the default classic or NLB if you use a network load balancer.

   3

   The secret created in the previous step.

   4

   Optional: Filters the set of routes serviced by the CustomDomain ingress. If no value is provided, the default is no filtering.

   5

   Optional: Filters the set of namespaces serviced by the CustomDomain ingress. If no value is provided, the default is no filtering.

3. Apply the CR:

   Example

   $ oc apply -f <company_name>-custom-domain.yaml

4. Get the status of your newly created CR:

   $ oc get customdomains

   Example output

   NAME               ENDPOINT                                                    DOMAIN                       STATUS
   <company_name>     xxrywp.<company_name>.cluster-01.opln.s1.openshiftapps.com  *.apps.<company_name>.io     Ready

5. Using the endpoint value, add a new wildcard CNAME recordset to your managed DNS provider, such as Route53.

   Example

   *.apps.<company_name>.io -> xxrywp.<company_name>.cluster-01.opln.s1.openshiftapps.com

6. Create a new application and expose it:

   Example

   $ oc new-app --docker-image=docker.io/openshift/hello-openshift -n my-project

   $ oc create route <route_name> --service=hello-openshift hello-openshift-tls --hostname hello-openshift-tls-my-project.apps.<company_name>.io -n my-project

   $ oc get route -n my-project

   $ curl https://hello-openshift-tls-my-project.apps.<company_name>.io
   Hello OpenShift!

Procedure

1. Create new secret

   $ oc create secret tls <secret-new> --cert=fullchain.pem --key=privkey.pem -n <my_project>

2. Patch CustomDomain CR

   $ oc patch customdomain <company_name> --type='merge' -p '{"spec":{"certificate":{"name":"<secret-new>"}}}'

3. Delete old secret

   $ oc delete secret <secret-old> -n <my_project>