Search code examples
openshifthaproxyopenshift-originopenshift-web-console

how is the traffic to the openshift_cluster_hostname is redirected to the openshift web console

Question 1 :

1.1. who is sitting behind the "openshift_master_cluster_public_hostname" hostname ? is it the web console ( web console service ? or web service deployment ) or something else ?

1.2. when doing oc get service -n openshift-web-console i can see that the web console is runnung in 443 , isn't it supposed to work on port 8443 , same thing for api server , shouldn't be working on port 8443 ?

1.3. can you explain to me the flow of a request to https://openshift_master_cluster_public_hostname:8443 ?

1.4. in the documentation is

Question 2:

why i get different response for curl and wget ?
when i : curl https://openshift_master_cluster_public_hostname:8443 , i get :

{
  "paths": [
    "/api",
    "/api/v1",
    "/apis",
    "/apis/",
    "/apis/admissionregistration.k8s.io",
    "/apis/admissionregistration.k8s.io/v1beta1",
    "/apis/apiextensions.k8s.io",
    "/apis/apiextensions.k8s.io/v1beta1",
    ...
    "/swagger.json",
    "/swaggerapi",
    "/version",
    "/version/openshift"
  ]
}

when i : wget https://openshift_master_cluster_public_hostname:8443 i get an index.html page.

Is the web console answering this request or the

Question 3 :

how can i do to expose the web console on port 443 rather then the 8443 , i found several solution :

  1. using variables "openshift_master_console_port,openshift_master_api_port" but found out that these ports are ‘internal’ ports and not designed to be the public ports. So changing this ports could crash your OpenShift setup

  2. using an external service ( described here )

I'm kind of trying to setup port forwarding on an external haporxy , is it doable ?

Solution

  • Answer to Q1:

    1.1. Cite from the documentation Configuring Your Inventory File

    This variable overrides the public host name for the cluster, 
which defaults to the host name of the master. If you use an 
external load balancer, specify the address of the external load balancer.

For example:

> openshift_master_cluster_public_hostname=openshift-ansible.public.example.com

    This means that this Variable is the Public facing interface to the OpenShift Web-Console.

    1.2 A Service is a virtual Object which connects the Service Name to the pods and is used to connect the Route Object with the Service Object. This is explained in the documentation Services. You can use almost every port for a Service because it's virtual and nothing will bind on this Port.

    1.3. The answer depend on your setup. I explain it in a ha-setup with a TCP loadbalancer in front of the masters.

                           /> Master API 1
client -> loadbalancer -> Master API 2
                       \> Master API 3

    The Client make a request to https://openshift_master_cluster_public_hostname:8443 the loadbalancer forwards the Client to the Master API 1 or 2 or 3 and the Client get the answer from the requested Master API Server.

    api server redirect to console if request come from a browser ( https://github.com/openshift/origin/blob/release-3.11/pkg/cmd/openshift-kube-apiserver/openshiftkubeapiserver/patch_handlerchain.go#L60-L61 )

    Answer to Q2:

    curl and wget behaves different because they are different tools but the https request is the same.

    curl behavior with wget
    wget --output-document=- https://openshift_master_cluster_public_hostname:8443

    wget behavior with curl
    curl -o index.html https://openshift_master_cluster_public_hostname:8443

    Why - is described in Usage of dash (-) in place of a filename

    Answer to Q3:

    You can use the OpenShift Router which you use for the apps to make the Web-Console available on 443. It's a little bit outdated but the concept is the same for the current 3.x versions Make OpenShift console available on port 443 (https) [UPDATE]