Skip to content

Commit ceacc5e

Browse files
kcarmichael08kcarmichael08
authored
Merge pull request #85350 from DCChadwick/osdocs5074
OSDOCS-5074: Choosing subnets when creating a LoadBalancerService ingress Controller
2 parents de07198 + de27107 commit ceacc5e

File tree

3 files changed

+184
-0
lines changed

3 files changed

+184
-0
lines changed

Diff for: ‎modules/nw-ingress-setting-select-subnet-loadbalancerservice.adoc

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// Modules included in the following assemblies:
2+
//
3+
// * ingress/configure-ingress-operator.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ingress-setting-select-subnet-Loadbalancerservice_{context}"]
7+
= Choosing subnets while creating a LoadBalancerService Ingress Controller
8+
9+
You can manually specify load balancer subnets for Ingress Controllers in an existing cluster. By default, the load balancer subnets are automatically discovered by AWS, but specifying them in the Ingress Controller overrides this, allowing for manual control.
10+
11+
.Prerequisites
12+
* You must have an installed AWS cluster.
13+
* You must know the names or IDs of the subnets to which you intend to map your `IngressController`.
14+
15+
.Procedure
16+
17+
. Create a custom resource (CR) file.
18+
+
19+
Create a YAML file (e.g., `sample-ingress.yaml`) with the following content:
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: operator.openshift.io/v1
24+
kind: IngressController
25+
metadata:
26+
namespace: openshift-ingress-operator
27+
name: <name>
28+
spec:
29+
domain: <domain>
30+
endpointPublishingStrategy:
31+
type: LoadBalancerService
32+
loadBalancer:
33+
scope: External
34+
dnsManagementPolicy: Managed
35+
----
36+
37+
. Create a custom resource (CR) file.
38+
+
39+
Add subnets to your YAML file:
40+
+
41+
--
42+
[source,yaml]
43+
----
44+
apiVersion: operator.openshift.io/v1
45+
kind: IngressController
46+
metadata:
47+
name: <name> <1>
48+
namespace: openshift-ingress-operator
49+
spec:
50+
domain: <domain> <2>
51+
endpointPublishingStrategy:
52+
type: LoadBalancerService
53+
loadBalancer:
54+
scope: External
55+
providerParameters:
56+
type: AWS
57+
aws:
58+
type: Classic
59+
classicLoadBalancer: <3>
60+
subnets:
61+
ids: <4>
62+
- <subnet> <5>
63+
- <subnet>
64+
- <subnet>
65+
dnsManagementPolicy: Managed
66+
----
67+
<1> Replace `<name>` with a name for the `IngressController`.
68+
<2> Replace `<domain>` with the DNS name serviced by the `IngressController`.
69+
<3> You can also use the `networkLoadBalancer` field if using an NLB.
70+
<4> You can optionally specify a subnet by name using the `names` field instead of specifying the subnet by ID.
71+
<5> Specify subnet IDs (or names if you using `names`).
72+
+
73+
[IMPORTANT]
74+
====
75+
You can specify a maximum of one subnet per availability zone. Only provide public subnets for external Ingress Controllers and private subnets for internal Ingress Controllers.
76+
====
77+
--
78+
+
79+
. Apply the CR file.
80+
81+
.. Save the file and apply it using the {oc-first}.
82+
+
83+
[source,terminal]
84+
----
85+
$ oc apply -f sample-ingress.yaml
86+
----
87+
.. Confirm the load balancer was provisioned successfully by checking the `IngressController` conditions.
88+
+
89+
[source,terminal]
90+
----
91+
$ oc get ingresscontroller -n openshift-ingress-operator <name> -o jsonpath="{.status.conditions}" | yq -PC
92+
----

Diff for: ‎modules/nw-ingress-setting-update-subnet-loadbalancerservice.adoc

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
// Modules included in the following assemblies:
2+
//
3+
// * ingress/configure-ingress-operator.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ingress-setting-update-subnet-Loadbalancerservice_{context}"]
7+
= Updating the subnets on an existing Ingress Controller
8+
9+
You can update an `IngressController` with manually specified load balancer subnets in {product-title} to avoid any disruptions, to maintain the stability of your services, and to ensure that your network configuration aligns with your specific requirements. The following procedures show you how to select and apply new subnets, verify the configuration changes, and confirm successful load balancer provisioning.
10+
11+
[WARNING]
12+
====
13+
This procedure may cause an outage that can last several minutes due to new DNS records propagation, new load balancers provisioning, and other factors. IP addresses and canonical names of the Ingress Controller load balancer might change after applying this procedure.
14+
====
15+
16+
.Procedure
17+
To update an `IngressController` with manually specified load balancer subnets, you can follow these steps:
18+
19+
. Modify the existing IngressController to update to the new subnets.
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: operator.openshift.io/v1
24+
kind: IngressController
25+
metadata:
26+
name: <name> <1>
27+
namespace: openshift-ingress-operator
28+
spec:
29+
domain: <domain> <2>
30+
endpointPublishingStrategy:
31+
type: LoadBalancerService
32+
loadBalancer:
33+
scope: External
34+
providerParameters:
35+
type: AWS
36+
aws:
37+
type: Classic <3>
38+
classicLoadBalancer: <4>
39+
subnets:
40+
ids: <5>
41+
- <updated_subnet> <6>
42+
- <updated_subnet>
43+
- <updated_subnet>
44+
----
45+
<1> Replace `<name>` with a name for the `IngressController`.
46+
<2> Replace `<domain>` with the DNS name serviced by the `IngressController`.
47+
<3> Specify updated subnet IDs (or names if you using `names`).
48+
<4> You can also use the `networkLoadBalancer` field if using an NLB.
49+
<5> You can optionally specify a subnet by name using the `names` field instead of specifying the subnet by ID.
50+
<6> Update subnet IDs (or names if you are using `names`).
51+
+
52+
[IMPORTANT]
53+
====
54+
You can specify a maximum of one subnet per availability zone. Only provide public subnets for external Ingress Controllers and private subnets for internal Ingress Controllers.
55+
====
56+
57+
. Examine the `Progressing` condition on the `IngressController` for instructions on how to apply the subnet updates by running the following command:
58+
+
59+
[source,terminal]
60+
----
61+
$ oc get ingresscontroller -n openshift-ingress-operator subnets -o jsonpath="{.status.conditions[?(@.type==\"Progressing\")]}" | yq -PC
62+
----
63+
+
64+
.Example output
65+
[source,terminal]
66+
----
67+
lastTransitionTime: "2024-11-25T20:19:31Z"
68+
message: 'One or more status conditions indicate progressing: LoadBalancerProgressing=True (OperandsProgressing: One or more managed resources are progressing: The IngressController subnets were changed from [...] to [...]. To effectuate this change, you must delete the service: `oc -n openshift-ingress delete svc/router-<name>`; the service load-balancer will then be deprovisioned and a new one created. This will most likely cause the new load-balancer to have a different host name and IP address and cause disruption. To return to the previous state, you can revert the change to the IngressController: [...]'
69+
reason: IngressControllerProgressing
70+
status: "True"
71+
type: Progressing
72+
----
73+
74+
. To apply the update, delete the service associated with the Ingress controller by running the following command:
75+
76+
[source,terminal]
77+
----
78+
$ oc -n openshift-ingress delete svc/router-<name>
79+
----
80+
81+
.Verification
82+
83+
* To confirm that the load balancer was provisioned successfully, check the `IngressController` conditions by running the following command:
84+
+
85+
[source,terminal]
86+
----
87+
$ oc get ingresscontroller -n openshift-ingress-operator <name> -o jsonpath="{.status.conditions}" | yq -PC
88+
----

Diff for: ‎networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws.adoc

+4
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@ Before you can configure an Ingress Controller NLB on a new AWS cluster, you mus
4040

4141
include::modules/nw-aws-nlb-new-cluster.adoc[leveloffset=+2]
4242

43+
include::modules/nw-ingress-setting-select-subnet-loadbalancerservice.adoc[leveloffset=+2]
44+
45+
include::modules/nw-ingress-setting-update-subnet-loadbalancerservice.adoc[leveloffset=+2]
46+
4347
[role="_additional-resources"]
4448
[id="additional-resources_configuring-ingress-cluster-traffic-aws"]
4549
== Additional resources

0 commit comments

Comments
 (0)