You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To enable {microshift-short} node access for services, configure the cluster routes. By using this configuration, you can expose specific applications directly through the network interface of the node.
11
-
12
-
Secure routes provide the ability to use several types of TLS termination to serve certificates to the client. See the _Additional resources_ section for links to the {OCP} documentation that describe how to create re-encrypt, edge, and passthrough routes with custom certificates.
9
+
You can configure routes for services to have {microshift-short} node access.
13
10
14
11
//OCP module, edit with care; Creating an insecure/http route
Secure routes provide the ability to use several types of TLS termination to serve certificates to the client. The following links to the {OCP} documentation describe how to create re-encrypt, edge, and passthrough routes with custom certificates.
58
57
59
58
* link:https://docs.redhat.com/en/documentation/openshift_container_platform/{ocp-version}/html/networking/configuring-routes#nw-ingress-creating-a-reencrypt-route-with-a-custom-certificate_secured-routes[Creating a re-encrypt route with a custom certificate]
Copy file name to clipboardExpand all lines: modules/microshift-nw-create-http-based-route.adoc
+10-16Lines changed: 10 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,10 +6,7 @@
6
6
[id="microshift-nw-creating-a-route_{context}"]
7
7
= Creating an HTTP-based route
8
8
9
-
[role="_abstract"]
10
-
To host your application at a public URL by using the basic HTTP routing protocol, create an HTTP-based route. This configuration exposes a service on an unsecured application port, allowing external access without TLS encryption.
11
-
12
-
A route can either be secure or unsecured, depending on the network security configuration of your application.
9
+
A route allows you to host your application at a public URL. It can either be secure or unsecured, depending on the network security configuration of your application. An HTTP-based route is an unsecured route that uses the basic HTTP routing protocol and exposes a service on an unsecured application port.
13
10
14
11
The following procedure describes how to create a simple HTTP-based route to a web application, using the `hello-microshift` application as an example.
$ oc get routes -o yaml <name of resource> -n $namespace
41
+
$ oc get routes -o yaml <name of resource> -n $namespace <1>
45
42
----
46
-
* `namespace`: Specifies the route that is named `hello-microshift` and the namespace is named `hello-microshift`.
47
-
+
48
-
.Sample YAML definition for the created unsecured route
43
+
<1> In this example, the route is named `hello-microshift` and the namespace is named `hello-microshift`.
44
+
45
+
.Sample YAML definition of the created unsecured route:
49
46
[source,yaml]
50
47
----
51
48
apiVersion: route.openshift.io/v1
@@ -54,20 +51,17 @@ metadata:
54
51
name: hello-microshift
55
52
namespace: hello-microshift
56
53
spec:
57
-
host: microshift.com
54
+
host: microshift.com <1>
58
55
port:
59
-
targetPort: 8080
56
+
targetPort: 8080 <2>
60
57
to:
61
58
kind: Service
62
59
name: hello-microshift
63
60
----
64
-
+
65
-
where:
66
-
+
67
-
`spec.host`:: Specifies the hostname.
68
-
`port.targetPort`:: Specifies the target port for the router to map the endpoint port in the service.
61
+
<1> Example hostname.
62
+
<2> `targetPort` is required for the router to map the endpoint port in the service.
69
63
+
70
64
[NOTE]
71
65
====
72
-
{microshift-short} does not use an API that creates a default ingress domain, but instead provides a wildcard for automatically generated domains. Each route can also define a separate hostname.
66
+
{microshift-short} does not a use an API that creates a default ingress domain, but instead provides a wildcard for automatically generated domains. Each route can also define a separate hostname.
= Enforcing HTTP Strict Transport Security per-domain
8
8
9
-
[role="_abstract"]
10
-
To enforce secure communication per-domain, configure routes with a compliant HSTS policy annotation. For upgraded nodes with non-compliant routes, ensure consistent enforcement by updating the source manifests to apply the new security policies.
9
+
You can configure a route with a compliant HSTS policy annotation. To handle an upgraded node with noncompliant HSTS routes, you can update the manifests at the source and apply the updates.
11
10
12
11
You cannot use `oc expose route` or `oc create route` commands to add a route in a domain that enforces HSTS because the API for these commands does not accept annotations.
13
12
@@ -17,30 +16,28 @@ HSTS cannot be applied to insecure, or non-TLS, routes.
17
16
====
18
17
19
18
.Prerequisites
20
-
21
19
* You have root access to the node.
22
20
* You installed the {oc-first}.
23
21
24
22
.Procedure
25
23
26
-
* Apply HSTS to all routes in the node by running the following command:
24
+
* Apply HSTS to all routes in the node by running the following `oc annotate command`:
To enable applications to manage session persistence and load distribution, annotate the route with a custom cookie name. Overwriting the default cookie allows the backend application to identify and delete the specific cookie, forcing endpoint re-selection when necessary.
16
-
17
-
When a server is overloaded, the server tries to remove the requests from the client and redistribute the requests to other endpoints.
14
+
You can set a cookie name to overwrite the default, auto-generated one for the route. This allows the application receiving route traffic to know the cookie name. Deleting the cookie can force the next request to re-choose an endpoint. The result is that if a server is overloaded, that server tries to remove the requests from the client and redistribute them.
18
15
19
16
.Procedure
20
17
@@ -25,10 +22,12 @@ When a server is overloaded, the server tries to remove the requests from the cl
Copy file name to clipboardExpand all lines: modules/nw-disabling-hsts.adoc
+2-5Lines changed: 2 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,8 +6,7 @@
6
6
[id="nw-disabling-hsts_{context}"]
7
7
= Disabling HTTP Strict Transport Security per-route
8
8
9
-
[role="_abstract"]
10
-
To allow unencrypted connections or troubleshoot access issues, disable HTTP Strict Transport Security (HSTS) for a specific route. Setting the `max-age` route annotation to `0` instructs browsers to stop enforcing HTTPS requirements on the route host.
9
+
To disable HTTP strict transport security (HSTS) per-route, you can set the `max-age` value in the route annotation to `0`.
11
10
12
11
.Prerequisites
13
12
ifndef::microshift[]
@@ -20,7 +19,7 @@ endif::microshift[]
20
19
21
20
.Procedure
22
21
23
-
* To disable HSTS, enter the following to set the `max-age` value in the route annotation to `0`:
22
+
* To disable HSTS, set the `max-age` value in the route annotation to `0`, by entering the following command:
24
23
+
25
24
[source,terminal]
26
25
----
@@ -33,8 +32,6 @@ You can alternatively apply the following YAML to create the config map for disa
Copy file name to clipboardExpand all lines: modules/nw-enabling-hsts-per-route.adoc
+7-10Lines changed: 7 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,8 +6,7 @@
6
6
[id="nw-enabling-hsts-per-route_{context}"]
7
7
= Enabling HTTP Strict Transport Security per-route
8
8
9
-
[role="_abstract"]
10
-
To enforce secure HTTPS connections for specific applications, enable HTTP Strict Transport Security (HSTS) on a per-route basis. Applying the `haproxy.router.openshift.io/hsts_header` annotation to edge and re-encrypt routes ensures that browsers reject unencrypted traffic.
9
+
HTTP strict transport security (HSTS) is implemented in the HAProxy template and applied to edge and re-encrypt routes that have the `haproxy.router.openshift.io/hsts_header` annotation.
11
10
12
11
.Prerequisites
13
12
ifndef::microshift[]
@@ -22,7 +21,7 @@ endif::microshift[]
22
21
23
22
* To enable HSTS on a route, add the `haproxy.router.openshift.io/hsts_header` value to the edge-terminated or re-encrypt route. You can use the `oc annotate` tool to do this by running the following command. To properly run the command, ensure that the semicolon (`;`) in the `haproxy.router.openshift.io/hsts_header` route annotation is also surrounded by double quotation marks (`""`).
24
23
+
25
-
.Example `annotate` command that sets the maximum age to `31536000` ms (approximately 8.5 hours)
24
+
.Example `annotate` command that sets the maximum age to `31536000` ms (approximetly 8.5 hours)
`max-age`:: Specifies the measurement of the length of time, in seconds, for the HSTS policy. If set to `0`, it negates the policy.
53
-
`includeSubDomains`:: Specifies that all subdomains of the host must have the same HSTS policy as the host. Optional parameter.
54
-
`preload`:: Specifies that the site is included in the HSTS preload list when `max-age` is greater than `0`. For example, sites such as Google can construct a list of sites that have `preload` set. Browsers can then use these lists to determine which sites they can communicate with over HTTPS, even before they have interacted with the site. Without `preload` set, browsers must have interacted with the site over HTTPS, at least once, to get the header. Optional parameter.
48
+
<1> Required. `max-age` measures the length of time, in seconds, that the HSTS policy is in effect. If set to `0`, it negates the policy.
49
+
<2> Optional. When included, `includeSubDomains` tells the client
50
+
that all subdomains of the host must have the same HSTS policy as the host.
51
+
<3> Optional. When `max-age` is greater than 0, you can add `preload` in `haproxy.router.openshift.io/hsts_header` to allow external services to include this site in their HSTS preload lists. For example, sites such as Google can construct a list of sites that have `preload` set. Browsers can then use these lists to determine which sites they can communicate with over HTTPS, even before they have interacted with the site. Without `preload` set, browsers must have interacted with the site over HTTPS, at least once, to get the header.
Copy file name to clipboardExpand all lines: modules/nw-enabling-hsts.adoc
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,8 +7,7 @@
7
7
[id="nw-enabling-hsts_{context}"]
8
8
= HTTP Strict Transport Security
9
9
10
-
[role="_abstract"]
11
-
To enhance security and optimize website performance, use the HTTP Strict Transport Security (HSTS) policy. This mechanism signals browsers to use only HTTPS traffic on the route host, eliminating the need for HTTP redirects and speeding up user interactions.
10
+
HTTP Strict Transport Security (HSTS) policy is a security enhancement, which signals to the browser client that only HTTPS traffic is allowed on the route host. HSTS also optimizes web traffic by signaling HTTPS transport is required, without using HTTP redirects. HSTS is useful for speeding up interactions with websites.
12
11
13
12
When HSTS policy is enforced, HSTS adds a Strict Transport Security header to HTTP and HTTPS responses from the site. You can use the `insecureEdgeTerminationPolicy` value in a route to redirect HTTP to HTTPS. When HSTS is enforced, the client changes all requests from the HTTP URL to HTTPS before the request is sent, eliminating the need for a redirect.
Copy file name to clipboardExpand all lines: modules/nw-http-header-configuration.adoc
+7-9Lines changed: 7 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,16 +7,12 @@
7
7
[id="nw-http-header-configuration_{context}"]
8
8
= HTTP header configuration
9
9
10
-
[role="_abstract"]
11
10
ifndef::microshift[]
12
-
To customize request and response headers for your applications, configure the Ingress Controller or apply specific route annotations. Understanding the interaction between these configuration methods ensures you effectively manage global and route-specific header policies.
13
-
14
-
You can also set certain headers by using route annotations. The various ways of configuring headers can present challenges when working together.
11
+
{product-title} provides different methods for working with HTTP headers. When setting or deleting headers, you can use specific fields in the Ingress Controller or an individual route to modify request and response headers. You can also set certain headers by using route annotations. The various ways of configuring headers can present challenges when working together.
15
12
endif::microshift[]
16
-
ifdef::microshift[]
17
-
To customize request and response headers, modify individual route configurations or apply route annotations. Understanding the interaction between these methods ensures you effectively manage header policies and resolve potential configuration conflicts.
18
13
19
-
The various ways of configuring headers can present challenges when working together.
14
+
ifdef::microshift[]
15
+
When setting or deleting headers, you can use an individual route to modify request and response headers. You can also set certain headers by using route annotations. The various ways of configuring headers can present challenges when working together.
20
16
endif::microshift[]
21
17
22
18
ifndef::microshift[]
@@ -34,7 +30,8 @@ You can only set or delete headers within a `Route` CR. You cannot append header
When the same HTTP header is modified both in the Ingress Controller and in a route, HAProxy prioritizes the actions in certain ways depending on whether it is a request or response header.
40
37
@@ -107,7 +104,8 @@ ifdef::microshift[]
107
104
Any actions defined in a route override values set using route annotations.
0 commit comments