Cannot create a route/ingress with custom domain in RedHatOpenshift 4.15

[os-learner]

I followed the instructions mentioned in here but the route is inaccessible.

I'm using certified operator 1.4.8 on Redhat openshift. The old operator and older neuvector version was working great. The new version broke our existing install as well and we are now trying with a fresh install.

I have a tls.key and tls.pem from 3rd party cert provider. I created a secret called https-cert in the namespace "neuvector".

I modified neuvector instance operator manager section and controller section.

I tried ingress but route doesn't get created following the instructions above. I tried to change the class name to customdomain but of no avail.

I get "Application not available" when I try to access manager UI.

I'm not seeing any errors.

Try 2:
Instead of using ingress, i tried passthrough for the route. Now, the route gets created but I get the error ERR_SSL_PROTOCOL_ERROR "The site can't provide a secure connection".

We are on RedHat openshift on AWS. The API endpoint for the cluster is different and I'm trying to access neuvector manager UI using a custom ingress controller setup for our custom domain.

Try 3:
If I don't specify any secret in the secret section and create a route, the route gets created but I get cert error and still able to access manager UI.

My issue is, either I'm not following the instructions correctly or the instructions are different for ROSA (RedHat OpenShift on AWS).

Please assist.

[os-learner]

Any update on this?

[saurabhsadhalesuse]

@os-learner are you still facing this issue ?

When you are deploying in Non-Privileged Mode there is a "kind: Route" yaml which helps create a route which is in "passthrough" type.

If you are still facing this issue please help elaborate on the steps to test and confirm the behaviour.

[os-learner]

Hi,
I'm still facing the issue.
The route is setup as "passthrough". I'm attaching the neuvector operator yaml.
Steps to test:

1. Certificate used is wild card cert for a custom domain (*.apps.example.com)
2. Created an instance using neuvector yaml
3. Accessed the endpoint using route. (neuvector.apps.example.com). -- cert-error.png

If I point tls.key and tls.crt to a secret, I cannot access the UI at all.

If I don't point tls.key and tls.crt and leave empty, I can access the UI but the cert served is neuvector cert (cert-info.png)

neuvector-neuvector-yaml.txt

[saurabhsadhalesuse]

@os-learner I think I understand the confusion here.

The documentation that you are following mentions in the Step 3 to change in the deployment for controller and manager.
However, that would not be possible in case of operator-based deployment as the resources are governed by the "kind: Neuvector" resource which would not allow to make a change directly.

In the current attached yaml file, changes are not done as described in the documentation section.

The correct thing to pursue here is to ensure that changes be done in the kind: Neuvector resource in the following sections as mentioned in the documentation:

• Neuvector.spec.manager.certificate.secret
• Neuvector.spec.manager.certificate.keyFile
• Neuvector.spec.manager.certificate.pemFile
• Neuvector.spec.manager.ingress.secretName
• Neuvector.spec.controller.certificate.secret
• Neuvector.spec.controller.certificate.keyFile
• Neuvector.spec.controller.certificate.pemFile

Performing the above would ensure that the configuration persist and added appropriately to the deployments and then your route should be successfully accessible.

Let me know if that helps your issue.