OSDOCS-9350-deepdive-3: endpointPublishingStrategy updates #80110
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,180 @@ | ||
| // Module included in the following assemblies: | ||
| // | ||
| // * networking/configuring_ingress_cluster_traffic/nw-configuring-ingress-controller-endpoint-publishing-strategy.adoc | ||
|
|
||
| :_mod-docs-content-type: PROCEDURE | ||
| [id="nw-ingress-controller-nodeportservice-projects_{context}"] | ||
| = Adding a single NodePort service to an Ingress Controller | ||
|
|
||
| Instead of creating a `NodePort`-type `Service` for each project, you can create a custom Ingress Controller to use the `NodePortService` endpoint publishing strategy. To prevent port conflicts, consider this configuration for your Ingress Controller when you want to apply a set of routes, through Ingress sharding, to nodes that might already have a `HostNetwork` Ingress Controller. | ||
|
|
||
| Before you set a `NodePort`-type `Service` for each project, read the following considerations: | ||
|
|
||
| * You must create a wildcard DNS record for the Nodeport Ingress Controller domain. A Nodeport Ingress Controller route can be reached from the address of a worker node. For more information about the required DNS records for routes, see "User-provisioned DNS requirements". | ||
| * You must expose a route for your service and specify the `--hostname` argument for your custom Ingress Controller domain. | ||
| * You must append the port that is assigned to the `NodePort`-type `Service` in the route so that you can access application pods. | ||
|
|
||
| .Prerequisites | ||
|
|
||
| * You installed the {oc-first}. | ||
| * Logged in as a user with `cluster-admin` privileges. | ||
| * You created a wildcard DNS record. | ||
| // https://docs.openshift.com/container-platform/4.16/networking/ingress-controller-dnsmgt.html (does not detail how to create the DNS) | ||
|
|
||
| .Procedure | ||
|
|
||
| . Create a custom resource (CR) file for the Ingress Controller: | ||
| + | ||
| .Example of a CR file that defines information for the `IngressController` object | ||
| [source,yaml] | ||
| ---- | ||
| apiVersion: v1 | ||
| items: | ||
| - apiVersion: operator.openshift.io/v1 | ||
| kind: IngressController | ||
| metadata: | ||
| name: <custom_ic_name> <1> | ||
| namespace: openshift-ingress-operator | ||
| spec: | ||
| replicas: 1 | ||
| domain: <custom_ic_domain_name> <2> | ||
| nodePlacement: | ||
| nodeSelector: | ||
| matchLabels: | ||
| <key>: <value> <3> | ||
| namespaceSelector: | ||
| matchLabels: | ||
| <key>: <value> <4> | ||
| endpointPublishingStrategy: | ||
| type: NodePortService | ||
| # ... | ||
| ---- | ||
|
There was a problem hiding this comment. We just create one custom ingresscontroller here so better not use |
||
| <1> Specify the a custom `name` for the `IngressController` CR. | ||
| <2> The DNS name that the Ingress Controller services. As an example, the default ingresscontroller domain is `apps.ipi-cluster.example.com`, so you would specify the `<custom_ic_domain_name>` as `nodeportsvc.ipi-cluster.example.com`. | ||
| <3> Specify the label for the nodes that include the custom Ingress Controller. | ||
| <4> Specify the label for a set of namespaces. Substitute `<key>:<value>` with a map of key-value pairs where `<key>` is a unique name for the new label and `<value>` is its value. For example: `ingresscontroller: custom-ic`. | ||
|
|
||
| . Add a label to a node by using the `oc label node` command: | ||
dfitzmau marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc label node <node_name> <key>=<value> <1> | ||
| ---- | ||
| <1> Where `<value>` must match the key-value pair specified in the `nodePlacement` section of your `IngressController` CR. | ||
|
|
||
| . Create the `IngressController` object: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc create -f <ingress_controller_cr>.yaml | ||
| ---- | ||
|
|
||
| . Find the port for the service created for the `IngressController` CR: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc get svc -n openshift-ingress | ||
| ---- | ||
| + | ||
| .Example output that shows port `80:32432/TCP` for the `router-nodeport-custom-ic3` service | ||
| [source,terminal] | ||
| ---- | ||
| NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE | ||
| router-internal-default ClusterIP 172.30.195.74 <none> 80/TCP,443/TCP,1936/TCP 223d | ||
| router-nodeport-custom-ic3 NodePort 172.30.109.219 <none> 80:32432/TCP,443:31366/TCP,1936:30499/TCP 155m | ||
| ---- | ||
|
|
||
| . To create a new project, enter the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc new-project <project_name> | ||
| ---- | ||
|
|
||
| . To label the new namespace, enter the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc label namespace <project_name> <key>=<value> <1> | ||
| ---- | ||
| <1> Where `<key>=<value>` must match the value in the `namespaceSelector` section of your Ingress Controller CR. | ||
|
|
||
| . Create a new application in your cluster: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc new-app --image=<image_name> <1> | ||
| ---- | ||
| <1> An example of `<image_name>` is `quay.io/openshifttest/hello-openshift:multiarch`. | ||
|
|
||
| . Create a `Route` object for a service, so that the pod can use the service to expose the application external to the cluster. | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc expose svc/<service_name> --hostname=<svc_name>-<project_name>.<custom_ic_domain_name> <1> | ||
| ---- | ||
| + | ||
| [NOTE] | ||
| ==== | ||
| You must specify the domain name of your custom Ingress Controller in the `--hostname` argument. If you do not do this, the Ingress Operator uses the default Ingress Controller to serve all the routes for your cluster. | ||
| ==== | ||
|
|
||
dfitzmau marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| . Check that the route has the `Admitted` status and that it includes metadata for the custom Ingress Controller: | ||
| + | ||
| [source,terminal,subs="quotes,attributes"] | ||
| ---- | ||
| $ oc get route/hello-openshift -o json | jq '.status.ingress' | ||
| ---- | ||
| + | ||
| .Example output | ||
| [source,terminal] | ||
| ---- | ||
| # ... | ||
| { | ||
| "conditions": [ | ||
| { | ||
| "lastTransitionTime": "2024-05-17T18:25:41Z", | ||
| "status": "True", | ||
| "type": "Admitted" | ||
| } | ||
| ], | ||
| [ | ||
| { | ||
| "host": "hello-openshift.nodeportsvc.ipi-cluster.example.com", | ||
| "routerCanonicalHostname": "router-nodeportsvc.nodeportsvc.ipi-cluster.example.com", | ||
| "routerName": "nodeportsvc", "wildcardPolicy": "None" | ||
| } | ||
| ], | ||
| } | ||
| ---- | ||
|
|
||
| . Update the default `IngressController` CR to prevent the default Ingress Controller from managing the `NodePort`-type `Service`. The default Ingress Controller will continue to monitor all other cluster traffic. | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc patch --type=merge -n openshift-ingress-operator ingresscontroller/default --patch '{"spec":{"namespaceSelector":{"matchExpressions":[{"key":"<key>","operator":"NotIn","values":["<value>]}]}}}' | ||
| ---- | ||
|
|
||
| .Verification | ||
|
|
||
| . Verify that the DNS entry can route inside and outside of your cluster by entering the following command. The command outputs the IP address of the node that received the label from running the `oc label node` command earlier in the procedure. | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ dig +short <svc_name>-<project_name>.<custom_ic_domain_name> | ||
| ---- | ||
|
|
||
| . To verify that your cluster uses the IP addresses from external DNS servers for DNS resolution, check the connection of your cluster by entering the following command: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ curl <svc_name>-<project_name>.<custom_ic_domain_name>:<port> <1> | ||
| ---- | ||
| <1> Where `<port>` is the node port from the `NodePort`-type `Service`. Based on example output from the `oc get svc -n openshift-ingress` command, the `80:32432/TCP` HTTP route means that `32432` is the node port. | ||
| + | ||
| .Output example | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| Hello OpenShift! | ||
| ---- | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.