Skip to content

Commit c76cd57

Browse files
committed
OSDOCS-14578: adds ingress control options to MicroShift
1 parent ffec83d commit c76cd57

File tree

3 files changed

+149
-13
lines changed

3 files changed

+149
-13
lines changed

modules/microshift-config-yaml-custom.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
:_mod-docs-content-type: CONCEPT
66
[id="microshift-yaml-custom_{context}"]
77
= Using custom settings
8+
89
To create custom configurations, make a copy of the `config.yaml.default` file that is provided in the `/etc/microshift/` directory, renaming it `config.yaml`. Keep this file in the `/etc/microshift/` directory, and then you can change supported settings that are expected to override the defaults before starting or restarting {microshift-short}.
910

1011
[IMPORTANT]

modules/microshift-default-settings.adoc

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,15 @@ apiServer:
3333
subjectAltNames: []
3434
tls:
3535
cipherSuites:
36-
- ""
36+
- TLS_AES_128_GCM_SHA256
37+
- TLS_AES_256_GCM_SHA384
38+
- TLS_CHACHA20_POLY1305_SHA256
39+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
40+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
41+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
42+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
43+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
44+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
3745
minVersion: VersionTLS12
3846
debugging:
3947
logLevel: "Normal"
@@ -42,6 +50,31 @@ dns:
4250
etcd:
4351
memoryLimitMB: 0
4452
ingress:
53+
accessLogging:
54+
destination:
55+
type:
56+
container:
57+
maxLength: 1024
58+
syslog:
59+
address: ""
60+
facility: ""
61+
maxLength: 1024
62+
port: 0
63+
type: ""
64+
httpCaptureCookies:
65+
- matchType: ""
66+
maxLength: 0
67+
name: ""
68+
namePrefix: ""
69+
httpCaptureHeaders:
70+
request:
71+
- maxLength: 0
72+
name: ""
73+
response:
74+
- maxLength: 0
75+
name: ""
76+
httpLogFormat: ""
77+
status: Disabled
4578
certificateSecret: router-certs-default
4679
clientTLS:
4780
allowedSubjectPatterns:
@@ -54,8 +87,9 @@ ingress:
5487
mimeTypes:
5588
- ""
5689
httpEmptyRequestsPolicy: Respond
57-
listenAddress:
58-
- ""
90+
httpErrorCodePages:
91+
name: ""
92+
listenAddress: []
5993
logEmptyRequests: Log
6094
ports:
6195
http: 80
@@ -65,14 +99,7 @@ ingress:
6599
wildcardPolicy: WildcardPolicyAllowed
66100
status: Managed
67101
tlsSecurityProfile:
68-
type: Custom
69-
custom:
70-
ciphers:
71-
- ECDHE-ECDSA-CHACHA20-POLY1305
72-
- ECDHE-RSA-CHACHA20-POLY1305
73-
- ECDHE-RSA-AES128-GCM-SHA256
74-
- ECDHE-ECDSA-AES128-GCM-SHA256
75-
minTLSVersion: VersionTLS12
102+
type: Intermediate
76103
tuningOptions:
77104
clientFinTimeout: "1s"
78105
clientTimeout: "30s"

modules/microshift-ingress-controller-config.adoc

Lines changed: 110 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,30 @@ Configuration snippet YAMLs take precedence over both built-in settings and the
4141
apiServer:
4242
# ...
4343
ingress:
44+
accessLogging:
45+
destination:
46+
container:
47+
maxLength: 1024
48+
syslog:
49+
address: ""
50+
facility: ""
51+
maxLength: 1024
52+
port: 0
53+
type: ""
54+
httpCaptureCookies:
55+
- matchType: ""
56+
maxLength: 0
57+
name: ""
58+
namePrefix: ""
59+
httpCaptureHeaders:
60+
request:
61+
- maxLength: 0
62+
name: ""
63+
response:
64+
- maxLength: 0
65+
name: ""
66+
httpLogFormat: ""
67+
status: Disabled
4468
certificateSecret: router-certs-custom
4569
clientTLS:
4670
allowedSubjectPatterns: []
@@ -53,6 +77,8 @@ ingress:
5377
mimeTypes:
5478
- ""
5579
httpEmptyRequestsPolicy: Respond
80+
httpErrorCodePages:
81+
name: ""
5682
listenAddress: []
5783
logEmptyRequests: Log
5884
ports:
@@ -69,7 +95,6 @@ ingress:
6995
minTLSVersion:""
7096
intermediate: {}
7197
old: {}
72-
type: ""
7398
tuningOptions:
7499
clientFinTimeout: 1s
75100
clientTimeout: 30s
@@ -91,7 +116,90 @@ ingress:
91116
|Parameter |Description
92117

93118
|`ingress`
94-
|The `ingress` section of the {microshift-short} `config.yaml` file defines the configurable parameters for the implemented portions of the {OCP} Ingress Control Operator. All parameters in the rest of this table are subsections in the `ingress` section of the `config.yaml`.
119+
|The `ingress` section of the {microshift-short} `config.yaml` file defines the configurable parameters for the implemented portions of the {OCP} Ingress Control Operator. The full Operator is not supported on {microshift-short}. All of the following parameters in this table are subsections in the `ingress` section of the {microshift-short} `config.yaml`.
120+
121+
|`accessLogging`
122+
|Describes how client requests are logged. If this field is empty, access logging is disabled.
123+
//how do we activate it? in the `status` field? (if yes, how come status is not first in this list?)
124+
125+
|`accessLogging.destination`
126+
|A destination for logs. The destination for logs can be a local sidecar container or remote.
127+
//is the default just empty?
128+
129+
|`accessLogging.destination.type`
130+
|The type of destination for logs. Valid values are `Container` or `Syslog`.
131+
132+
* Setting this value to `Container` specifies that logs should go to a sidecar container. The Ingress Operator configures the container, named logs, on the Ingress Controller pod and configures the Ingress Controller to write logs to the container. The expectation is that the administrator configures a custom logging solution that reads logs from this container. Using container logs means that logs may be dropped if the rate of logs exceeds the container runtime capacity or the custom logging solution capacity.
133+
//how is microshift handling this?
134+
* Setting this value to `Syslog` specifies that logs are sent to a Syslog endpoint. You must configure a custom Syslog instance and specify an endpoint that can receive Syslog messages.
135+
//should we supply instructions or links for these actions?
136+
137+
|`accessLogging.destination.container`
138+
|Describes parameters for the Container logging destination type.
139+
//"Currently there are no parameters for container logging, so this field must be empty." per the openshift docs -?
140+
141+
|`accessLogging.destination.container.maxLength`
142+
|Default value is 1024.
143+
//characters or data size? what's the context for this number? and behavior when exceeded? are there min and max values?
144+
145+
|`accessLogging.destination.syslog`
146+
|Describes parameters for the `Syslog` logging destination type.
147+
148+
|`accessLogging.destination.syslog.address`
149+
|The IP address of the syslog endpoint that receives log messages.
150+
//any invalid values we should know about?
151+
152+
|`accessLogging.destination.syslog.facility`
153+
|Specifies the syslog facility of log messages. If this field is empty, the facility is `local1`. Otherwise, the field must specify one of the following valid syslog facilities: `kern`, `user`, `mail`, `daemon`, `auth`, `syslog`, `lpr`, `news`, `uucp`, `cron`, auth2``, `ftp`, `ntp`, `audit`, `alert`, `cron2`, `local0`, `local1`, `local2`, `local3`, `local4`, `local5`, `local6`, or `local7`.
154+
//all true for microshift?
155+
156+
|`accessLogging.destination.syslog.maxLength`
157+
|The maximum length of the `Syslog` message. Message length must be at least `480` and not greater than `4096` bytes. If this field is empty, the maximum length is set to the default value of 1024 bytes.
158+
159+
|`accessLogging.destination.syslog.port`
160+
|The UDP port number of the syslog endpoint that receives log messages. The default value is `0`.
161+
162+
|`httpCaptureCookies`
163+
|
164+
165+
|`httpCaptureCookiesmatchType`
166+
|
167+
168+
|`httpCaptureCookiesmaxLength`
169+
|
170+
171+
|`httpCaptureCookiesname`
172+
|
173+
174+
|`httpCaptureCookiesnamePrefix`
175+
|
176+
177+
|`httpCaptureHeaders`
178+
|
179+
180+
|`httpCaptureHeaders.request`
181+
|
182+
183+
|`httpCaptureHeaders.request.maxLength`
184+
|
185+
186+
|`httpCaptureHeaders.request.name`
187+
|
188+
189+
|`httpCaptureHeaders.response`
190+
|
191+
192+
|`httpCaptureHeaders.responsemaxLength`
193+
|
194+
195+
|`httpCaptureHeaders.responsename`
196+
|
197+
198+
|`httpLogFormat`
199+
|
200+
201+
|`status`
202+
|Valid values are `Enabled` and `Disabled`. Default value is `Disabled`. If this field is set to `Enabled`, the `accessLogging.destination.type` is automatically set to `Container`.
95203

96204
|`certificateSecret`
97205
|A reference to a `kubernetes.io/tls` type of secret that contains the default certificate that is served by the {microshift-short} ingress controller. When routes do not specify their own certificate, the `certificateSecret` parameter is used. All secrets used must contain `tls.key` key file contents and `tls.crt` certificate file contents.

0 commit comments

Comments
 (0)