第 8 章 Exposing the RHACS portal over HTTP
Enable an unencrypted HTTP server to expose the RHACS portal through ingress controllers, Layer 7 load balancers, Istio, or other solutions.
If you use an ingress controller, Istio, or a Layer 7 load balancer that prefers unencrypted HTTP back ends, you can configure Red Hat Advanced Cluster Security for Kubernetes to expose the RHACS portal over HTTP. Doing this makes the RHACS portal available over a plaintext back end.
To expose the RHACS portal over HTTP, you must be using an ingress controller, a Layer 7 load balancer, or Istio to encrypt external traffic with HTTPS. It is insecure to expose the RHACS portal directly to external clients by using plain HTTP.
You can expose the RHACS portal over HTTP during installation or on an existing deployment.
8.1. Prerequisites 复制链接链接已复制到粘贴板!
To specify an HTTP endpoint you must use an
<endpoints_spec>. It is a comma-separated list of single endpoint specifications in the form of<type>@<addr>:<port>, where:-
typeisgrpcorhttp. Usinghttpas type works in most use cases. For advanced use cases, you can either usegrpcor omit its value. If you omit the value fortype, you can configure two endpoints in your proxy, one for gRPC and the other for HTTP. Both these endpoints point to the same exposed HTTP port on Central. However, most proxies do not support carrying both gRPC and HTTP traffic on the same external port. -
addris the IP address to expose Central on. You can omit this, or uselocalhostor127.0.0.1if you need an HTTP endpoint which is only accessible by using port-forwarding. -
portis the port to expose Central on. The following are several valid
<endpoints_spec>values:-
8080 -
http@8080 -
:8081 -
grpc@:8081 -
localhost:8080 -
http@localhost:8080 -
http@8080,grpc@8081 -
8080, grpc@:8081, http@0.0.0.0:8082
-
-