Run OpenShift console on port 443

This post was originally written by Akram Ben Aissi in his blog: http://akrambenaissi.com/2016/02/21/run-openshift-console-on-port-443/ 

One thing that I really like on OpenShift, is that it very often eat its own food. To my opinion, it is generally a sign of a good design, but that’s another story.
In this blog, I wanted to give a clue on how to make the OpenShift console run on port 443 by using the openshift-router facilities, service and endpoints. This could be very useful for example, if you do have some network setup preventing access to port 8443, which is often the case on corporate networks.

As a disclaimer, I want just to state that this is not (well for now) a production-proof design but, at least you can use it for demonstration purposes or simply to understand the way OpenShift externalservices works.

You will guess that the idea here, is to create an OpenShift external service pointing to the OpenShift master URL and then create a route that will be served by openshift-router to forward request to the OpenShift master itself. It this road, need to create and OpenShift Endpoint as stated by documentation.
And the final trick, is to change your masterPublicURL and master publicURL parameters in master-config.yaml OpenShift configuration to match the route’s URL.

Here is the configuration: You will need to get:
– Your master internal IP address
– A wildcard entry or DNS entry pointing to your openshift-router nodes (can also the be the master itself if you are running the router on master)
– That’s all

So, let’s assume the following settings:
My master’s domaine name is: pass.mycompany.com
My master’s internal IP address is: 192.168.1.1
My openshift-router runs on IP 50.50.50.50 and my DNS entry pass.mycompany.com points to it

So you need to create a Service:

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: null
  labels:
  name: openshift-master
spec:
  ports:
  - name: 8443-tcp
    port: 8443
    protocol: TCP
    targetPort: 8443
  selector: {}
status:
  loadBalancer: {}

and create manually the corresponding Endpoint

apiVersion: v1
kind: Endpoints
metadata:
  creationTimestamp: null
  name: openshift-master
subsets:
- addresses:
  - ip: 192.168.1.1
  ports:
  - name: 8443-tcp
    port: 443
    protocol: TCP

And then, you need a route with a host entry point to 50.50.50.50

apiVersion: v1
kind: Route
metadata:
  creationTimestamp: null
  name: openshift-master
spec:
  host: paas.mycompany.com
  port:
    targetPort: 8443
  to:
    kind: Service
    name: openshift-master
  tls:
    termination: passthrough
status:
  ingress: null

and the last point, is to modify your master-config.yaml to change any occurrences to masterPublicURL or publicURL to
https://paas.mycompany.com:443.
Keep in mind that the certificates that you have generated for the console must be valid for the host URL you are pointing to, and must update your corsAllowedOrigins to add the new domain you are pointing to.

apiLevels:
- v1
apiVersion: v1
assetConfig:
  extensionDevelopment: false
  extensionScripts: null
  extensionStylesheets: null
  extensions: null
  loggingPublicURL: ""
  logoutURL: ""
  masterPublicURL: https://paas.mycompany.com:443
  metricsPublicURL: https://paas.mycompany.com/hawkular/metrics
  publicURL: https://paas.mycompany.com:443/console/
  servingInfo:
    bindAddress: 0.0.0.0:8443
    bindNetwork: tcp4
    certFile: master.server.crt
    clientCA: ""
    keyFile: master.server.key
    maxRequestsInFlight: 0
    namedCertificates: null
    requestTimeoutSeconds: 0
controllerLeaseTTL: 0
controllers: '*'
corsAllowedOrigins:
- 127.0.0.1
- 50.50.50.50:8443
- localhost
- paas.mycompany.com
disabledFeatures: null
...

Et voilà!
Your OpenShift master console should now be available on port 443

Author

Akram Ben Aissi

Cloud and Platform Architect,
Red Hat Consulting

LinkedIn: https://linkedin.com/in/akrambenaissi

Twitter: @akrambenaissi

GitHub: https://github.com/akram

Categories
OpenShift Container Platform, OpenShift Dedicated, OpenShift Online, OpenShift Origin, Products
Tags
,
Comments are closed.