Added info for routes to accept ingress objects #8109

bfallonf · 2018-03-13T01:34:09Z

Thanks, @knobunc in the end, I thought it was better to create a new PR rather than merging and editing. I have some questions, I'll ask them inline.

NOTE: this is not to be cherrypicked into another branch until this is found to be a supported procedure. Ben, do you know when this will be?

bfallonf · 2018-03-13T01:34:48Z

admin_guide/managing_networking.adoc

+[[admin-guide-managing-networking-ingress]]
+== Setting up the HAProxy router to accept ingress objects
+
+By default, the HAProxy router only accepts route objects. You can set up the


In order to describe the comparison, I mentioned the router only accepts route objects. Is this accurate?

That is correct.

bfallonf · 2018-03-13T01:35:24Z

admin_guide/managing_networking.adoc

+link:https://kubernetes.io/docs/concepts/services-networking/ingress/[Ingress
+Controller] so that it accepts both route and ingress objects. If configured,
+the same rules apply for claiming a domain for a namespace based on the creation
+time of the object.


I'm not sure what the above means. Can this be elaborated on? Is this listed somewhere else in the docs (it mentions "same rules")?

Hm... the best I can find is a tangential reference in install_config/router/default_haproxy_router.adoc at arond line 1218.

bfallonf · 2018-03-13T01:35:53Z

admin_guide/managing_networking.adoc

+* Ingress objects store the keys and certificates in secrets, so the router needs permission to read all secrets in the system.
+* Ingress objects only support edge termination for `https` routes.
+
+To configure an existing router to have Ingress support (assuming the default name of `router` for the deployment configuration and the ):


This sentence trailed off. Do you remember what was supposed to be here?

Oops. "and the service-account"

knobunc · 2018-03-14T14:15:40Z

admin_guide/managing_networking.adoc

+[[admin-guide-managing-networking-ingress]]
+== Setting up the HAProxy router to accept ingress objects
+
+By default, the HAProxy router only accepts route objects. You can set up the


That is correct.

knobunc · 2018-03-14T14:20:04Z

admin_guide/managing_networking.adoc

+link:https://kubernetes.io/docs/concepts/services-networking/ingress/[Ingress
+Controller] so that it accepts both route and ingress objects. If configured,
+the same rules apply for claiming a domain for a namespace based on the creation
+time of the object.


Hm... the best I can find is a tangential reference in install_config/router/default_haproxy_router.adoc at arond line 1218.

knobunc · 2018-03-14T14:20:34Z

admin_guide/managing_networking.adoc

+* Ingress objects store the keys and certificates in secrets, so the router needs permission to read all secrets in the system.
+* Ingress objects only support edge termination for `https` routes.
+
+To configure an existing router to have Ingress support (assuming the default name of `router` for the deployment configuration and the ):


Oops. "and the service-account"

knobunc · 2018-03-14T14:22:06Z

The supported procedure may be openshift/origin#18658 which if we can get consensus should be in 3.10.

bfallonf · 2018-03-15T01:49:27Z

Thanks @knobunc . We can look at this again for 3.10.

In the meantime, let me know if there's anything more. @openshift/team-documentation PTAL

mburke5678 · 2018-03-15T18:35:34Z

admin_guide/managing_networking.adoc

+time of the object. For example, ownership of routes is based on the claims made
+for a host name with the namespace with the oldest route winning against any
+other claimants.
+


This sentence seems awkward (or a run on?) because of the two with the phrases. But, I see that the same sentence is in the Install Guide, so maybe I am mistaken.
https://docs.openshift.com/container-platform/3.7/install_config/router/default_haproxy_router.html#using-wildcard-routes.

mburke5678 · 2018-03-15T18:36:43Z

admin_guide/managing_networking.adoc

+
+* Ingress objects store the keys and certificates in secrets, so the router needs permission to read all secrets in the system.
+* Ingress objects only support edge termination for `https` routes.
+


Should the https be bolded with asterisks?

mburke5678 · 2018-03-15T18:38:44Z

@bfallonf A couple of nits. Otherwise LGTM

bfallonf · 2018-03-16T00:32:22Z

Thanks @mburke5678 I've made changes as you suggested. I'll merge this.

Note that this is only for Origin as of now, but I'll continuously poke @knobunc until this is ready to be cherry-picked into the OCP branches.

vikram-redhat · 2018-03-16T01:59:51Z

@bfallonf - please make sure to get a QE review before merging.

bfallonf · 2018-03-16T06:04:44Z

@vikram-redhat I merged before I saw your comment...

@bmeng Can I please get a QA of this PR? If there's issues, please let me know. I'll create another PR if needed.

lihongan · 2018-03-16T08:00:40Z

admin_guide/managing_networking.adoc

+. Add the cluster-admin role to the router:
+
+----
+$ oc adm policy add-role-to-user cluster-admin router`


Below two role should be added to sa router, oc adm policy add-role-to-user cluster-admin router is invalid.

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:default:router oc adm policy add-cluster-role-to-user system:openshift:controller:service-serving-cert-controller system:serviceaccount:default:router

maybe oc adm policy add-cluster-role-to-user cluster-reader -z router also work here.

lihongan · 2018-03-16T08:30:27Z

And another issue is how haproxy handle the situation if ingress and route claim the same hostname ?
From my testing, it shows only the first created resource will be served by haproxy.
@knobunc could you please help confirm ? if that true, then we should also write down them here I think.

knobunc · 2018-03-20T13:09:08Z

Yes, internally ingress objects and route objects get turned into the same data structure in the router, so there is no real difference except that an ingress object can turn into multiple objects. Once that has been done, the same rules apply. Then the object that with the earliest creation date claims a hostname for a namespace, it doesn't matter if it is a route or ingress. BUT... since an ingress object could have two hostnames, one hostname can be claimed by the ingress and be active, but the other might not be able to claim, and be ignored.

There are docs in default_haproxy_router.adoc about the claim rules. But they seem to be under the wildcard information. It would be good to make them a little more prominent.

knobunc · 2018-03-20T13:10:24Z

@mburke5678 PLEASE NOTE that this is likely only going to be Origin docs. We have a better solution coming that will supersede all of this for 3.10 so we don't want to support it in OSE for 3.9 just to replace it.

mburke5678 · 2018-03-20T13:54:34Z

@bfallonf See Ben's notes ^^

bfallonf · 2018-03-22T01:58:47Z

Thanks @lihongan @bmeng @knobunc .

I've created #8337 as a followup. Please let me know if you have any further thoughts.

openshift-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 13, 2018

bfallonf commented Mar 13, 2018

View reviewed changes

bfallonf mentioned this pull request Mar 13, 2018

Added documentation on how to enable Ingres Object support #8099

Closed

knobunc requested changes Mar 14, 2018

View reviewed changes

bfallonf force-pushed the ingress_edit branch from 352afb1 to efd3d73 Compare March 15, 2018 01:48

mburke5678 reviewed Mar 15, 2018

View reviewed changes

added info for routes to accept ingress objects

7650ad0

bfallonf force-pushed the ingress_edit branch from efd3d73 to 7650ad0 Compare March 16, 2018 00:31

bfallonf merged commit 3c1eaee into openshift:master Mar 16, 2018

lihongan reviewed Mar 16, 2018

View reviewed changes

bfallonf deleted the ingress_edit branch March 22, 2018 01:09

bfallonf restored the ingress_edit branch March 22, 2018 01:56

bfallonf mentioned this pull request Mar 22, 2018

Further edits to ingress object section #8337

Merged

bfallonf deleted the ingress_edit branch March 26, 2018 00:59

mburke5678 mentioned this pull request Mar 26, 2020

Found description "Setting up the HAProxy router to accept ingress objects" in documentation of okd but not in OpenShift Enterprise #15985

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added info for routes to accept ingress objects #8109

Added info for routes to accept ingress objects #8109

bfallonf commented Mar 13, 2018

bfallonf Mar 13, 2018

knobunc Mar 14, 2018

bfallonf Mar 13, 2018

knobunc Mar 14, 2018

bfallonf Mar 13, 2018

knobunc Mar 14, 2018

knobunc Mar 14, 2018

knobunc Mar 14, 2018

knobunc Mar 14, 2018

knobunc commented Mar 14, 2018

bfallonf commented Mar 15, 2018

mburke5678 Mar 15, 2018

mburke5678 Mar 15, 2018

mburke5678 commented Mar 15, 2018

bfallonf commented Mar 16, 2018

vikram-redhat commented Mar 16, 2018

bfallonf commented Mar 16, 2018

lihongan Mar 16, 2018

bmeng Mar 16, 2018

lihongan commented Mar 16, 2018

knobunc commented Mar 20, 2018

knobunc commented Mar 20, 2018

mburke5678 commented Mar 20, 2018

bfallonf commented Mar 22, 2018


		* Ingress objects store the keys and certificates in secrets, so the router needs permission to read all secrets in the system.
		* Ingress objects only support edge termination for `https` routes.

Added info for routes to accept ingress objects #8109

Added info for routes to accept ingress objects #8109

Conversation

bfallonf commented Mar 13, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

knobunc commented Mar 14, 2018

bfallonf commented Mar 15, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mburke5678 commented Mar 15, 2018

bfallonf commented Mar 16, 2018

vikram-redhat commented Mar 16, 2018

bfallonf commented Mar 16, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lihongan commented Mar 16, 2018

knobunc commented Mar 20, 2018

knobunc commented Mar 20, 2018

mburke5678 commented Mar 20, 2018

bfallonf commented Mar 22, 2018