Skip to content

Commit e9a0599

Browse files
xenolinuxxenolinux
committed
NE-986: Add the information about allowedsourceranges
1 parent 7ef9cbd commit e9a0599

6 files changed

+122
-3
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1226,6 +1226,9 @@ Topics:
12261226
- Name: Configuring ingress cluster traffic using a NodePort
12271227
File: configuring-ingress-cluster-traffic-nodeport
12281228
Distros: openshift-enterprise,openshift-origin
1229+
- Name: Configuring ingress cluster traffic using load balancer allowed source ranges
1230+
File: configuring-ingress-cluster-traffic-load-balancer-allowed-source-ranges
1231+
Distros: openshift-enterprise,openshift-origin
12291232
# Kubernetes NMState (TECHNOLOGY PREVIEW)
12301233
- Name: Kubernetes NMState
12311234
Dir: k8s_nmstate

‎modules/nw-configuring-lb-allowed-source-ranges-migration.adoc

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// Modules included in the following assemblies:
2+
//
3+
// * networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-load-balancer-allowed-source-ranges.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-configuring-lb-allowed-source-ranges-migration_{context}"]
7+
= Migrating to load balancer allowed source ranges
8+
9+
If you have already set the annotation `service.beta.kubernetes.io/load-balancer-source-ranges`, you can migrate to load balancer allowed source ranges. When you set the `AllowedSourceRanges`, the Ingress Controller sets the `spec.loadBalancerSourceRanges` field based on the `AllowedSourceRanges` value and unsets the `service.beta.kubernetes.io/load-balancer-source-ranges` annotation.
10+
11+
[NOTE]
12+
====
13+
If you have already set the `spec.loadBalancerSourceRanges` field or the load balancer service anotation `service.beta.kubernetes.io/load-balancer-source-ranges` in a previous version of {product-title}, the Ingress Controller starts reporting `Progressing=True` after an upgrade. To fix this, set `AllowedSourceRanges` that overwrites the `spec.loadBalancerSourceRanges` field and clears the `service.beta.kubernetes.io/load-balancer-source-ranges` annotation. The Ingress Controller starts reporting `Progressing=False` again.
14+
====
15+
16+
.Prerequisites
17+
18+
* You have set the `service.beta.kubernetes.io/load-balancer-source-ranges` annotation.
19+
20+
.Procedure
21+
22+
. Ensure that the `service.beta.kubernetes.io/load-balancer-source-ranges` is set:
23+
+
24+
[source,terminal]
25+
----
26+
$ oc get svc router-default -n openshift-ingress -o yaml
27+
----
28+
+
29+
.Example output
30+
[source,yaml]
31+
----
32+
apiVersion: v1
33+
kind: Service
34+
metadata:
35+
annotations:
36+
service.beta.kubernetes.io/load-balancer-source-ranges: 192.168.0.1/32
37+
----
38+
39+
. Ensure that the `spec.loadBalancerSourceRanges` field is unset:
40+
+
41+
[source,terminal]
42+
----
43+
$ oc get svc router-default -n openshift-ingress -o yaml
44+
----
45+
+
46+
.Example output
47+
[source,yaml]
48+
----
49+
...
50+
spec:
51+
loadBalancerSourceRanges:
52+
- 0.0.0.0/0
53+
...
54+
----
55+
56+
. Update your cluster to {product-title} 4.12.
57+
58+
. Set the allowed source ranges API for the `ingresscontroller` by running the following command:
59+
+
60+
[source,terminal]
61+
----
62+
$ oc -n openshift-ingress-operator patch ingresscontroller/default \
63+
--type=merge --patch='{"spec":{"endpointPublishingStrategy": \
64+
{"loadBalancer":{"allowedSourceRanges":["0.0.0.0/0"]}}}}' <1>
65+
----
66+
<1> The example value `0.0.0.0/0` specifies the allowed source range.

‎modules/nw-configuring-lb-allowed-source-ranges.adoc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Modules included in the following assemblies:
2+
//
3+
// * networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-load-balancer-allowed-source-ranges.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-configuring-lb-allowed-source-ranges_{context}"]
7+
= Configuring load balancer allowed source ranges
8+
9+
You can enable and configure the `spec.endpointPublishingStrategy.loadBalancer.allowedSourceRanges` field. By configuring load balancer allowed source ranges, you can limit the access to the load balancer for the Ingress Controller to a specified list of IP address ranges. The Ingress Operator reconciles the load balancer Service and sets the `spec.loadBalancerSourceRanges` field based on `AllowedSourceRanges`.
10+
11+
[NOTE]
12+
====
13+
If you have already set the `spec.loadBalancerSourceRanges` field or the load balancer service anotation `service.beta.kubernetes.io/load-balancer-source-ranges` in a previous version of {product-title}, Ingress Controller starts reporting `Progressing=True` after an upgrade. To fix this, set `AllowedSourceRanges` that overwrites the `spec.loadBalancerSourceRanges` field and clears the `service.beta.kubernetes.io/load-balancer-source-ranges` annotation. Ingress Controller starts reporting `Progressing=False` again.
14+
====
15+
16+
.Prerequisites
17+
18+
* You have a deployed Ingress Controller on a running cluster.
19+
20+
.Procedure
21+
22+
* Set the allowed source ranges API for the Ingress Controller by running the following command:
23+
+
24+
[source,terminal]
25+
----
26+
$ oc -n openshift-ingress-operator patch ingresscontroller/default \
27+
--type=merge --patch='{"spec":{"endpointPublishingStrategy": \
28+
{"loadBalancer":{"allowedSourceRanges":["0.0.0.0/0"]}}}}' <1>
29+
----
30+
<1> The example value `0.0.0.0/0` specifies the allowed source range.

‎modules/nw-create-load-balancer-service.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,7 @@ spec:
5454
+
5555
[NOTE]
5656
====
57-
To restrict traffic through the load balancer to specific IP addresses, it is recommended to use the `service.beta.kubernetes.io/load-balancer-source-ranges` annotation rather than setting the `loadBalancerSourceRanges` field.
58-
With the annotation, you can more easily migrate to the OpenShift API, which will be implemented in a future release.
57+
To restrict the traffic through the load balancer to specific IP addresses, it is recommended to use the Ingress Controller field `spec.endpointPublishingStrategy.loadBalancer.allowedSourceRanges`. Do not set the `loadBalancerSourceRanges` field.
5958
====
6059
. Save and exit the file.
6160

‎modules/nw-ingress-controller-configuration-parameters.adoc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ If empty, the default value is `ingress.config.openshift.io/cluster` `.spec.doma
3131
|`endpointPublishingStrategy`
3232
|`endpointPublishingStrategy` is used to publish the Ingress Controller endpoints to other networks, enable load balancer integrations, and provide access to other systems.
3333

34+
On GCP, AWS, and Azure you can configure the following `endpointPublishingStrategy` fields:
35+
36+
* `loadBalancer.scope`
37+
* `loadBalancer.allowedSourceRanges`
38+
3439
If not set, the default value is based on `infrastructure.config.openshift.io/cluster` `.status.platform`:
3540

3641
* Amazon Web Services (AWS): `LoadBalancerService` (with External scope)
@@ -225,7 +230,7 @@ supports up to `64` threads. If this field is empty, the Ingress Controller uses
225230
226231
* `tunnelTimeout` specifies how long a tunnel connection, including websockets, remains open while the tunnel is idle. The default timeout is `1h`.
227232
228-
* `maxConnections` specifies the maximum number of simultaneous connections that can be established per HAProxy process. Increasing this value allows each ingress controller pod to handle more connections at the cost of additional system resources. Permitted values are `0`, `-1`, any value within the range `2000` and `2000000`, or the field can be left empty.
233+
* `maxConnections` specifies the maximum number of simultaneous connections that can be established per HAProxy process. Increasing this value allows each ingress controller pod to handle more connections at the cost of additional system resources. Permitted values are `0`, `-1`, any value within the range `2000` and `2000000`, or the field can be left empty.
229234
230235
** If this field is left empty or has the value `0`, the Ingress Controller will use the default value of `50000`. This value is subject to change in future releases.
231236

‎networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-load-balancer-allowed-source-ranges.adoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
:_content-type: ASSEMBLY
2+
[id="configuring-ingress-cluster-traffic-lb-allowed-source-ranges"]
3+
= Configuring ingress cluster traffic using load balancer allowed source ranges
4+
include::_attributes/common-attributes.adoc[]
5+
:context: configuring-ingress-cluster-traffic-lb-allowed-source-ranges
6+
7+
toc::[]
8+
9+
You can specify a list of IP address ranges for the `IngressController`. This restricts access to the load balancer service when the `endpointPublishingStrategy` is `LoadBalancerService`.
10+
11+
include::modules/nw-configuring-lb-allowed-source-ranges.adoc[leveloffset=+1]
12+
include::modules/nw-configuring-lb-allowed-source-ranges-migration.adoc[leveloffset=+1]
13+
14+
[role="_additional-resources"]
15+
== Additional resources
16+
* xref:../../updating/index.adoc#index[Updating your cluster]

0 commit comments

Comments
 (0)