Skip to content

Commit 6c0a0f7

Browse files
jldohmannjldohmann
authored
Merge pull request #71284 from smunje1/OSDOCS-9495
OSDOCS-9495
2 parents cdfde25 + 0731bbb commit 6c0a0f7

10 files changed

+201
-18
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1017,7 +1017,7 @@ Topics:
10171017
Distros: openshift-rosa
10181018
Topics:
10191019
- Name: Custom domains for applications
1020-
File: osd-config-custom-domains-applications
1020+
File: rosa-config-custom-domains-applications
10211021
# - Name: Application GitOps workflows
10221022
# File: rosa-app-gitops-workflows
10231023
# - Name: Application logging

‎applications/deployments/rosa-config-custom-domains-applications.adoc

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="rosa-config-custom-domains-applications"]
3+
= Custom domains for applications
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: rosa-config-custom-domains-applications
6+
7+
toc::[]
8+
9+
[NOTE]
10+
====
11+
Starting with {product-title} 4.14, the Custom Domain Operator is deprecated. To manage Ingress in {product-title} 4.14, use the Ingress Operator. The functionality is unchanged for {product-title} 4.13 and earlier versions.
12+
====
13+
14+
You can configure a custom domain for your applications. Custom domains are specific wildcard domains that can be used with {product-title} applications.
15+
16+
include::modules/rosa-applications-config-custom-domains.adoc[leveloffset=+1]
17+
include::modules/rosa-applications-renew-custom-domains.adoc[leveloffset=+1]

‎cloud_experts_tutorials/cloud-experts-configure-custom-tls-ciphers.adoc

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ Modify this command to meet your specific business requirements.
6666
====
6767
+
6868
Before creating the CronJob, apply the `tlsSecurityProfile` configuration to validate changes.
69-
This process depends on if you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator].
69+
This process depends on if you are using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator].
7070
+
71-
.. Clusters not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
71+
.. Clusters not using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator]:
7272
+
73-
If you are only using the default Ingress Controller, and not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], run the following command to patch the Ingress Controller:
73+
If you are only using the default Ingress Controller, and not using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator], run the following command to patch the Ingress Controller:
7474
+
7575
[source,terminal]
7676
----
@@ -87,9 +87,9 @@ Once you run the command, you will receive a response that looks like this:
8787
ingresscontroller.operator.openshift.io/default patched
8888
----
8989
+
90-
.. Clusters using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
90+
.. Clusters using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator]:
9191
+
92-
Customers who are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator] need to loop through each of their Ingress Controllers to patch each one.
92+
Customers who are using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator] need to loop through each of their Ingress Controllers to patch each one.
9393
To patch all of your cluster's Ingress Controllers, run the following command:
9494
+
9595
[source,terminal]
@@ -111,11 +111,11 @@ ingresscontroller.operator.openshift.io/custom2 patched
111111
+
112112
Occasionally, the cluster's Ingress Controllers can get recreated. In these cases, the Ingress Controller will likely not retain the `tlsSecurityProfile` changes that were applied.
113113
To ensure this does not happen, create a CronJob that goes through and updates the cluster's Ingress Controllers.
114-
This process depends on if you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator].
114+
This process depends on if you are using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator].
115115
+
116-
.. Clusters not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
116+
.. Clusters not using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator]:
117117
+
118-
If you are not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], create the CronJob by running the following command:
118+
If you are not using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator], create the CronJob by running the following command:
119119
+
120120
[source,terminal]
121121
----
@@ -156,9 +156,9 @@ ingresscontroller.operator.openshift.io/default patched (no change)
156156
----
157157
====
158158
+
159-
.. Clusters using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
159+
.. Clusters using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator]:
160160
+
161-
If you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], the CronJob needs to loop through and patch each Ingress Controller.
161+
If you are using the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-config-custom-domains-applications[Custom Domain Operator], the CronJob needs to loop through and patch each Ingress Controller.
162162
To create this CronJob, run the following command:
163163
+
164164
[source,terminal]

‎cloud_experts_tutorials/cloud-experts-external-dns.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ toc::[]
2323
Starting with {product-title} 4.14, the Custom Domain Operator is deprecated. To manage Ingress in {product-title} 4.14, use the Ingress Operator. The functionality is unchanged for {product-title} 4.13 and earlier versions.
2424
====
2525

26-
Configuring the xref:../applications/deployments/osd-config-custom-domains-applications.adoc[Custom Domain Operator] requires a wildcard CNAME DNS record in your Amazon Route 53 hosted zone. If you do not want to use a wildcard record, you can use the `External DNS` Operator to create individual entries for routes.
26+
Configuring the xref:../applications/deployments/rosa-config-custom-domains-applications.adoc[Custom Domain Operator] requires a wildcard CNAME DNS record in your Amazon Route 53 hosted zone. If you do not want to use a wildcard record, you can use the `External DNS` Operator to create individual entries for routes.
2727

2828
Use this tutorial to deploy and configure the `External DNS` Operator with a custom domain in {product-title} (ROSA).
2929

‎modules/osd-applications-config-custom-domains.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Module included in the following assemblies for OSD and ROSA:
1+
// Module included in the following assembly for OSD:
22
//
33
// * applications/deployments/osd-config-custom-domains-applications.adoc
44

‎modules/osd-applications-renew-custom-domains.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Module included in the following assemblies for OSD and ROSA:
1+
// Module included in the following assembly for OSD:
22
//
33
// * applications/deployments/osd-config-custom-domains-applications.adoc
44

‎modules/rosa-applications-config-custom-domains.adoc

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
// Module included in the following assembly for ROSA:
2+
//
3+
// * applications/deployments/rosa-config-custom-domains-applications.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="rosa-applications-config-custom-domains_{context}"]
7+
= Configuring custom domains for applications
8+
9+
The top-level domains (TLDs) are owned by the customer that is operating the {product-title} cluster. The Custom Domains Operator sets up a new ingress controller with a custom certificate as a second day operation. The public DNS record for this ingress controller can then be used by an external DNS to create a wildcard CNAME record for use with a custom domain.
10+
11+
[NOTE]
12+
====
13+
Custom API domains are not supported because Red Hat controls the API domain. However, customers can change their application domains. For private custom domains with a private `IngressController`, set `.spec.scope` to `Internal` in the `CustomDomain` CR.
14+
====
15+
16+
.Prerequisites
17+
18+
* A user account with `dedicated-admin` privileges
19+
* A unique domain or wildcard domain, such as `*.apps.<company_name>.io`
20+
* A custom certificate or wildcard custom certificate, such as `CN=*.apps.<company_name>.io`
21+
* Access to a cluster with the latest version of the `oc` CLI installed
22+
23+
[IMPORTANT]
24+
Do not use the reserved names `default` or `apps*`, such as `apps` or `apps2`, in the `metadata/name:` section of the `CustomDomain` CR.
25+
26+
.Procedure
27+
28+
. Create a new TLS secret from a private key and a public certificate, where `fullchain.pem` and `privkey.pem` are your public or private wildcard certificates.
29+
+
30+
.Example
31+
[source,terminal]
32+
----
33+
$ oc create secret tls <name>-tls --cert=fullchain.pem --key=privkey.pem -n <my_project>
34+
----
35+
36+
. Create a new `CustomDomain` custom resource (CR):
37+
+
38+
.Example `<company_name>-custom-domain.yaml`
39+
[source,yaml]
40+
----
41+
apiVersion: managed.openshift.io/v1alpha1
42+
kind: CustomDomain
43+
metadata:
44+
name: <company_name>
45+
spec:
46+
domain: apps.<company_name>.io <1>
47+
scope: External
48+
loadBalancerType: Classic <2>
49+
certificate:
50+
name: <name>-tls <3>
51+
namespace: <my_project>
52+
routeSelector: <4>
53+
matchLabels:
54+
route: acme
55+
namespaceSelector: <5>
56+
matchLabels:
57+
type: sharded
58+
----
59+
<1> The custom domain.
60+
<2> The type of load balancer for your custom domain. This type can be the default `classic` or `NLB` if you use a network load balancer.
61+
<3> The secret created in the previous step.
62+
<4> Optional: Filters the set of routes serviced by the CustomDomain ingress. If no value is provided, the default is no filtering.
63+
<5> Optional: Filters the set of namespaces serviced by the CustomDomain ingress. If no value is provided, the default is no filtering.
64+
65+
. Apply the CR:
66+
+
67+
.Example
68+
[source,terminal]
69+
----
70+
$ oc apply -f <company_name>-custom-domain.yaml
71+
----
72+
73+
. Get the status of your newly created CR:
74+
+
75+
[source,terminal]
76+
----
77+
$ oc get customdomains
78+
----
79+
+
80+
.Example output
81+
[source,terminal]
82+
----
83+
NAME ENDPOINT DOMAIN STATUS
84+
<company_name> xxrywp.<company_name>.cluster-01.opln.s1.openshiftapps.com *.apps.<company_name>.io Ready
85+
----
86+
87+
ifdef::openshift-rosa[]
88+
. Using the endpoint value, add a new wildcard CNAME recordset to your managed DNS provider, such as Route53.
89+
endif::openshift-rosa[]
90+
ifndef::openshift-rosa[]
91+
. Using the endpoint value, add a new wildcard CNAME recordset to your managed DNS provider, such as Route53, Azure DNS, or Google DNS.
92+
endif::openshift-rosa[]
93+
94+
+
95+
.Example
96+
+
97+
[source,terminal]
98+
----
99+
*.apps.<company_name>.io -> xxrywp.<company_name>.cluster-01.opln.s1.openshiftapps.com
100+
----
101+
102+
. Create a new application and expose it:
103+
+
104+
.Example
105+
[source,terminal]
106+
----
107+
$ oc new-app --docker-image=docker.io/openshift/hello-openshift -n my-project
108+
----
109+
+
110+
[source,terminal]
111+
----
112+
$ oc create route <route_name> --service=hello-openshift hello-openshift-tls --hostname hello-openshift-tls-my-project.apps.<company_name>.io -n my-project
113+
----
114+
+
115+
[source,terminal]
116+
----
117+
$ oc get route -n my-project
118+
----
119+
+
120+
[source,terminal]
121+
----
122+
$ curl https://hello-openshift-tls-my-project.apps.<company_name>.io
123+
Hello OpenShift!
124+
----
125+
126+
.Troubleshooting
127+
* link:https://access.redhat.com/solutions/5419501[Error creating TLS secret]
128+
* link:https://access.redhat.com/solutions/6546011[Troubleshooting: CustomDomain in NotReady state]

‎modules/rosa-applications-renew-custom-domains.adoc

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
// Module included in the following assembly for ROSA:
2+
//
3+
// * applications/deployments/rosa-config-custom-domains-applications.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="rosa-applications-renew-custom-domains_{context}"]
7+
= Renewing a certificate for custom domains
8+
9+
You can renew certificates with the Custom Domains Operator (CDO) by using the `oc` CLI tool.
10+
11+
//s a customer of OSD/ROSA, I would like instructions on how to renew certificates with Custom Domains Operator (CDO).
12+
.Prerequisites
13+
* You have the latest version `oc` CLI tool installed.
14+
15+
.Procedure
16+
. Create new secret
17+
+
18+
[source,terminal]
19+
----
20+
$ oc create secret tls <secret-new> --cert=fullchain.pem --key=privkey.pem -n <my_project>
21+
----
22+
23+
. Patch CustomDomain CR
24+
+
25+
[source,terminal]
26+
----
27+
$ oc patch customdomain <company_name> --type='merge' -p '{"spec":{"certificate":{"name":"<secret-new>"}}}'
28+
----
29+
30+
. Delete old secret
31+
+
32+
[source,terminal]
33+
----
34+
$ oc delete secret <secret-old> -n <my_project>
35+
----
36+
37+
.Troubleshooting
38+
* link:https://access.redhat.com/solutions/5419501[Error creating TLS secret]

‎rosa_planning/rosa-hcp-prereqs.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ include::modules/rosa-sts-aws-requirements-access-req.adoc[leveloffset=+2]
3232
[role="_additional-resources"]
3333
[id="additional-resources_aws-access-requirements_{context}"]
3434
.Additional resources
35-
* See xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-applications-config-custom-domains[Configuring custom domains for applications]
35+
* See xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-applications-config-custom-domains[Configuring custom domains for applications]
3636

3737
include::modules/rosa-sts-aws-requirements-support-req.adoc[leveloffset=+2]
3838
include::modules/rosa-sts-aws-requirements-security-req.adoc[leveloffset=+2]
@@ -82,5 +82,5 @@ include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+1]
8282
[id="additional-resources_aws-prerequisites_{context}"]
8383
== Additional resources
8484
* xref:../rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc#rosa-policy-sre-access_rosa-policy-process-security[SRE access to all Red Hat OpenShift Service on AWS clusters]
85-
* xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-applications-config-custom-domains[Configuring custom domains for applications]
85+
* xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-applications-config-custom-domains[Configuring custom domains for applications]
8686
* xref:../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-instance-types_rosa-service-definition[Instance types]

‎rosa_planning/rosa-sts-aws-prereqs.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ include::modules/rosa-sts-aws-requirements-access-req.adoc[leveloffset=+2]
3434
[role="_additional-resources"]
3535
[id="additional-resources_aws-access-requirements_{context}"]
3636
.Additional resources
37-
* See xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-applications-config-custom-domains[Configuring custom domains for applications]
37+
* See xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-applications-config-custom-domains[Configuring custom domains for applications]
3838

3939
include::modules/rosa-sts-aws-requirements-support-req.adoc[leveloffset=+2]
4040
include::modules/rosa-sts-aws-requirements-security-req.adoc[leveloffset=+2]
@@ -84,5 +84,5 @@ include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+1]
8484
[id="additional-resources_aws-prerequisites_{context}"]
8585
== Additional resources
8686
* xref:../rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc#rosa-policy-sre-access_rosa-policy-process-security[SRE access to all Red Hat OpenShift Service on AWS clusters]
87-
* xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-applications-config-custom-domains[Configuring custom domains for applications]
87+
* xref:../applications/deployments/rosa-config-custom-domains-applications.adoc#rosa-applications-config-custom-domains[Configuring custom domains for applications]
8888
* xref:../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-instance-types_rosa-service-definition[Instance types]

0 commit comments

Comments
 (0)