You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This guide demonstrates how to properly patch the cluster ingress controllers, as well as ingress controllers created by the Custom Domain Operator.
20
-
This functionality allows customers to modify the `tlsSecurityProfile` value on cluster ingress controllers.
21
-
This guide will demonstrate how to apply a custom `tlsSecurityProfile`, a scoped service account (with the associated role and role binding), and a CronJob that the cipher changes are reapplied with 60 minutes (in the event that an ingress controller is recreated or modified).
//Adding the support statement based on a conversation with Michael McNeill
21
+
22
+
This guide demonstrates how to properly patch the cluster Ingress Controllers, as well as Ingress Controllers created by the Custom Domain Operator.
23
+
This functionality allows customers to modify the `tlsSecurityProfile` value on cluster Ingress Controllers.
24
+
This guide demonstrates how to apply a custom `tlsSecurityProfile`, a scoped service account with the associated role and role binding, and a CronJob that the cipher changes are reapplied with 60 minutes in the event that an Ingress Controller is recreated or modified.
22
25
23
26
.Prerequisites
24
27
25
-
* Review the link:https://docs.openshift.com/container-platform/4.13/networking/ingress-operator.html#configuring-ingress-controller-tls[OpenShift Documentation that explains the options for the `tlsSecurityProfile`]. By default, ingress controllers are configured to use the `Intermediate` profile, which corresponds to the link:https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29[Intermediate Mozilla profile].
28
+
* Review the link:https://docs.openshift.com/container-platform/4.13/networking/ingress-operator.html#configuring-ingress-controller-tls[OpenShift Documentation that explains the options for the `tlsSecurityProfile`]. By default, Ingress Controllers are configured to use the `Intermediate` profile, which corresponds to the link:https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29[Intermediate Mozilla profile].
26
29
27
30
.Procedure
28
31
@@ -36,47 +39,47 @@ To create a service account, run the following command:
36
39
$ oc create sa cron-ingress-patch-sa -n openshift-ingress-operator
37
40
----
38
41
39
-
. Create a role and role binding that allows limited access to patch the ingress controllers.
42
+
. Create a role and role binding that allows limited access to patch the Ingress Controllers.
40
43
+
41
44
Role-based access control (RBAC) is critical to ensuring security inside your cluster.
42
-
Creating a role allows us to provide scoped access to only the API resources we need within the cluster. To create the role, run the following command:
45
+
Creating a role allows us to provide scoped access to only the API resources needed within the cluster. To create the role, run the following command:
43
46
+
44
47
[source,terminal]
45
48
----
46
49
$ oc create role cron-ingress-patch-role --verb=get,patch,update --resource=ingresscontroller.operator.openshift.io -n openshift-ingress-operator
47
50
----
48
51
+
49
-
Once the role has been created, you need to bind the role to the service account using a role binding.
52
+
Once the role has been created, you must bind the role to the service account using a role binding.
50
53
To create the role binding, run the following command:
The examples provided below add an additional cipher to the ingress controller's `tlsSecurityProfile` to allow IE 11 access from Windows Server 2008 R2.
62
-
You should modify this command to meet your specific business requirements.
64
+
The examples provided below add an additional cipher to the Ingress Controller's `tlsSecurityProfile` to allow IE 11 access from Windows Server 2008 R2.
65
+
Modify this command to meet your specific business requirements.
63
66
====
64
67
+
65
-
Before we create the CronJob, we first want to apply the `tlsSecurityProfile` configuration to validate our changes.
68
+
Before creating the CronJob, apply the `tlsSecurityProfile` configuration to validate changes.
66
69
This process depends on if you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator].
67
70
+
68
71
.. Clusters not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
69
72
+
70
-
If you are only using the default ingress controller, and not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], run the following command to patch the ingress controller:
73
+
If you are only using the default Ingress Controller, and not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], run the following command to patch the Ingress Controller:
This patch will add the `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` cipher which allows access from IE 11 on Windows Server 2008 R2 when using RSA certificates.
80
+
This patch adds the `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` cipher which allows access from IE 11 on Windows Server 2008 R2 when using RSA certificates.
78
81
+
79
-
Once you have run the command, you will receive a response that looks like this:
82
+
Once you run the command, you will receive a response that looks like this:
.. Clusters using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
88
91
+
89
-
Customers who are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator] will need to loop through each of their ingress controllers to patch each one.
90
-
To patch all of your cluster's ingress controllers, run the following command:
92
+
Customers who are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator] need to loop through each of their Ingress Controllers to patch each one.
93
+
To patch all of your cluster's Ingress Controllers, run the following command:
91
94
+
92
95
[source,terminal]
93
96
----
94
97
$ for ic in $(oc get ingresscontroller -o name -n openshift-ingress-operator); do oc patch ${ic} -n openshift-ingress-operator --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Custom","custom":{"ciphers":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-CHACHA20-POLY1305","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"],"minTLSVersion":"VersionTLS12"}}}}'; done
95
98
----
96
99
+
97
-
Once you have run the command, you will receive a response that looks like this:
100
+
Once you run the command, you will receive a response that looks like this:
. Create the CronJob to ensure that the TLS configuration is not overwritten.
108
111
+
109
-
Occasionally, the cluster's ingress controller can get recreated. In these cases, the ingress controller will likely not retain the `tlsSecurityProfile` changes that we have made.
110
-
To ensure this does not happen, we will create a CronJob that goes through and updates the cluster's ingress controller(s).
112
+
Occasionally, the cluster's Ingress Controllers can get recreated. In these cases, the Ingress Controller will likely not retain the `tlsSecurityProfile` changes that were applied.
113
+
To ensure this does not happen, create a CronJob that goes through and updates the cluster's Ingress Controllers.
111
114
This process depends on if you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator].
112
115
+
113
116
.. Clusters not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
114
117
+
115
-
If you are not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], creating the CronJob is as simple as running the following command:
118
+
If you are not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], create the CronJob by running the following command:
116
119
+
117
120
[source,terminal]
118
121
----
@@ -142,9 +145,9 @@ EOF
142
145
+
143
146
[NOTE]
144
147
====
145
-
This CronJob will run every hour, and will patch the ingress controller, if necessary.
148
+
This CronJob runs every hour and patches the Ingress Controllers, if necessary.
146
149
It is important that this CronJob does not run constantly, as it can trigger reconciles that could overload the OpenShift Ingress Operator.
147
-
Most of the time, the logs of the CronJob pod will look something like this, as it will not be changing anything:
150
+
Most of the time, the logs of the CronJob pod looks like the following example, as it will not be changing anything:
148
151
149
152
.Example output
150
153
[source,terminal]
@@ -155,7 +158,7 @@ ingresscontroller.operator.openshift.io/default patched (no change)
155
158
+
156
159
.. Clusters using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
157
160
+
158
-
If you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], the CronJob will need to loop through and patch each ingress controller.
161
+
If you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], the CronJob needs to loop through and patch each Ingress Controller.
159
162
To create this CronJob, run the following command:
160
163
+
161
164
[source,terminal]
@@ -186,7 +189,7 @@ EOF
186
189
+
187
190
[NOTE]
188
191
====
189
-
This CronJob will run every hour, and will patch the ingress controller, if necessary. It is important that this CronJob does not run constantly, as it can trigger reconciles that could overload the OpenShift Ingress Operator. Most of the time, the logs of the CronJob pod will look something like this, as it will not be changing anything:
192
+
This CronJob runs every hour and patches the Ingress Controllers, if necessary. It is important that this CronJob does not run constantly, as it can trigger reconciles that could overload the OpenShift Ingress Operator. Most of the time, the logs of the CronJob pod will look something like this, as it will not be changing anything:
0 commit comments