Search code examples
openshiftopenshift-originokd

Multiple wildcard DNS values in an OpenShift cluster


The OpenShift installation manual details the use of a wildcard DNS that will be appended to the route URLs. It is setup in the Ansible hosts file, e.g:

openshift_master_default_subdomain=cloud.myorg.com

I have been working in several clients where, while there is only one OCP cluster, they have different subdomains, depending on the environment (OCP Projects). For instance:

project: departament1-dev
subdomain: clouddev.myorg.com
App URL: myapp-department1-dev.clouddev.myorg.com

project: departament1-uat
subdomain: cloudpre.myorg.com
App URL: myapp-department1-uat.cloudpre.myorg.com

project: departament1-pro
subdomain: cloud.myorg.com
App URL: myapp-department1-pro.cloud.myorg.com   

project: departament2-dev
subdomain: clouddev.myorg.com
App URL: myapp-department2-dev.clouddev.myorg.com

project: departament2-uat
subdomain: cloudpre.myorg.com
App URL: myapp-department2-uat.cloudpre.myorg.com

project: departament2-pro
subdomain: cloud.myorg.com
App URL: myapp-department2-pro.cloud.myorg.com

1) How can I configure multiple subdomains in a cluster (associated to OCP projects)?

2) Is that a good practice? I sounds like a good way to distinguish environments directly in the URL.


Solution

  • This can be solved with extra DNS entries and custom route configuration.

    The wildcard subdomain set up during OpenShift installation is mostly for developer convenience and to reduce the operational complexity of needing to request separate DNS entries and certificates per OpenShift route. Operations teams can just set up a single wildcard dns name and certificate and the rest is taken care of for all future applications.

    It is not required however that all routes use the wildcard subdomain DNS name, and in fact this is not what is recommended for production use-cases for security reasons (as evidenced by the fact that the IETF recommends against using wildcard certificates). You can use any DNS name you like for a given route as long as the value matches what is configured in the Route's spec.host field and the DNS name resolves to the OpenShift hosts running the HAProxy router.

    Unfortunately you can only configure a single routing subdomain in the master-config.yml file on the OpenShift master hosts, so in your case every other wildcard route will have to be manually included in those route definitions, but multiple wildcard DNS entries at least cuts down on the number of DNS records/tickets.