OpenShift 4.4 Ingress across multiple projects

I’d like to demonstrate how to configure Ingress routing across multiple projects using same hostname for each context on OpenShift 4.4(OCP 4.4).

This configuration can enable as of OCP 4.4, refer related-release note for the Ingress Enhancements section.

Environments

I will work the simple Microservices system like the following picture through in this article.

Create two projects for each service

$ oc new-project project-a

$ oc new-project project-b

Create the simple web server application pods

$ oc run -n project-a poda \
--image=registry.access.redhat.com/rhel7 \
-- bash -c \
'mkdir -p /tmp/test/svca; cd /tmp/test; echo "SERVICE A" > svca/index.html; python -m SimpleHTTPServer 8080'

$ oc run -n project-b podb \
--image=registry.access.redhat.com/rhel7 \
-- bash -c \
'mkdir -p /tmp/test/svcb; cd /tmp/test; echo "SERVICE B" > svcb/index.html; python -m SimpleHTTPServer 8080'

Create the Service objects in its project

$ oc create -f - <<EOF
apiVersion: v1
kind: Service
metadata:
labels:
app: service-a
name: service-a
namespace: project-a
spec:
ports:
- name: 8080-8080
port: 8080
protocol: TCP
targetPort: 8080
selector:
run: poda
sessionAffinity: None
type: ClusterIP
EOF

For service B,

$ oc create -f - <<EOF
apiVersion: v1
kind: Service
metadata:
labels:
app: service-b
name: service-b
namespace: project-b
spec:
ports:
- name: 8080-8080
port: 8080
protocol: TCP
targetPort: 8080
selector:
run: podb
sessionAffinity: None
type: ClusterIP
EOF

Create the Route objects in its project

For service A,

$ oc create -f - <<EOF
apiVersion: route.openshift.io/v1
kind: Route
metadata:
labels:
app: service-a
name: route-a
namespace: project-a
spec:
host: test.apps.example.com
path: /svca
port:
targetPort: 8080-8080
to:
kind: Service
name: service-a
weight: 100
EOF

For service B,

$ oc create -f - <<EOF
apiVersion: route.openshift.io/v1
kind: Route
metadata:
labels:
app: service-b
name: route-b
namespace: project-b
spec:
host: test.apps.example.com
path: /svcb
port:
targetPort: 8080-8080
to:
kind: Service
name: service-b
weight: 100
EOF

Now, we has done all required configuration except for new feature which enable allow Ingress access across multiple projects using same hostname.

Testing before and after enabling Ingress access across multiple projects

$ oc describe ingresscontroller/default -n openshift-ingress-operator | grep Domain:
Domain: apps.ocp44.test.local

Before changing “InterNamespaceAllowed” from “Strict”(default) to IngressController, the same hostname does not be applied on its project as follows. The “route-b” was not available with “HostAlreadyClaimed”.

$ oc get route route-a -n project-a 
NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
route-a test.apps.example.com /svca service-a 8080-8080 None

$ oc get route route-b -n project-b
NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
route-b HostAlreadyClaimed /svcb service-b 8080-8080 None

After changing “InterNamespaceAllowed”, you can see both routes showed same hostname without “HostAlreadyClaimed” in the “project-b”.

$ oc -n openshift-ingress-operator patch ingresscontroller/default \
--patch '{"spec":{"routeAdmission":{"namespaceOwnership":"InterNamespaceAllowed"}}}' \
--type=merge
ingresscontroller.operator.openshift.io/default patched

$ oc get route route-a -n project-a
NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
route-a test.apps.example.com /svca service-a 8080-8080 None

$ oc get route route-b -n project-b
NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
route-b test.apps.example.com /svcb service-b 8080-8080 None

Test whether each context, “/svca” and “/svcb”, shows each page from its running pod in the different project. Prerequisite is “test.apps.example.com” should resolve the valid VIP of the LB, and it can route the appropriate route pod on the nodes.

$ curl http://test.apps.example.com/svca/
SERVICE A

$ curl http://test.apps.example.com/svcb/
SERVICE B

Thank you for reading.

Hi, there. I’m Daein. Just do something fun :) Nothing happens, if you do nothing. #OpenShift #Kubernetes #Containers #Troubleshooting #Linux #OpenSource