[WIP] OSDOCS-13371-2: Ingress security parameters MicroShift #91560

tedaveryredhat · 2025-04-02T19:57:14Z

Version(s):
4.19+

Issue:
https://issues.redhat.com/browse/OSDOCS-13371

Link to docs preview:
https://91560--ocpdocs-pr.netlify.app/microshift/latest/microshift_configuring/microshift-ingress-controller.html

QE review:

QE has approved this change.

openshift-ci-robot · 2025-04-02T19:57:18Z

@tedaveryredhat: This pull request references OSDOCS-13371 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

Version(s):
4.19

Issue:
https://issues.redhat.com/browse/OSDOCS-13371

Link to docs preview:

QE review:

QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ocpdocs-previewbot · 2025-04-02T20:03:10Z

🤖 Mon May 19 18:32:00 - Prow CI generated the docs preview:

https://91560--ocpdocs-pr.netlify.app/microshift/latest/microshift_configuring/microshift-ingress-controller.html

ocpdocs-vale-bot · 2025-04-02T20:05:15Z

modules/microshift-ingress-controller-config.adoc

+
+If not set, a wildcard certificate is automatically generated and used. The certificate is valid for the Ingress Controller `domain` and `subdomains`, and
+the generated certificate's CA is automatically integrated with the
+cluster's trust store.


🤖 [error] RedHat.TermsErrors: Use 'truststore' rather than 'trust store'. For more information, see RedHat.TermsErrors.

openshift-ci-robot · 2025-04-02T20:05:49Z

@tedaveryredhat: This pull request references OSDOCS-13371 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

Version(s):
4.19

Issue:
https://issues.redhat.com/browse/OSDOCS-13371

Link to docs preview:
https://91560--ocpdocs-pr.netlify.app/microshift/latest/microshift_configuring/microshift-ingress-controller.html

QE review:

QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ocpdocs-vale-bot · 2025-04-10T16:43:06Z

modules/microshift-ingress-controller-config.adoc

+
+`clientTLS` has the required subfields, `spec.clientTLS.clientCertificatePolicy` and `spec.clientTLS.ClientCA`.
+
+The `ClientCertificatePolicy` subfield accepts one of the two values: `Required` or `Optional`. Note that the ingress controller only checks client certificates for edge-terminated and reencrypt TLS routes; it cannot check certificates for cleartext HTTP or passthrough TLS routes. The `ClientCA` subfield specifies a config map that is in the openshift-ingress namespace. The config map should contain a CA certificate bundle. A config map is required for this field.


🤖 [error] RedHat.TermsErrors: Use 'plain text' rather than 'cleartext'. For more information, see RedHat.TermsErrors.

eslutsky · 2025-04-15T14:50:25Z

modules/microshift-ingress-controller-config.adoc

@@ -57,11 +71,31 @@ ingress:
 # ...
 ----
 +
-.Ingress controller configuration fields definitions table
+.Ingress controller operations and performance configuration fields definitions


@tedaveryredhat , if we are going to keep it in the same page , can we separate this into new table called "Ingress controller security configuration fields definitions" , this is not related to operations and performance

eslutsky · 2025-04-15T14:51:38Z

modules/microshift-ingress-controller-config.adoc

 [cols="3a,8a",options="header"]
 |===
 |Parameter |Description

+|`certificateSecret`
+|The `certificateSecret` value is a reference to a secret that contains the default certificate that is served by the Ingress Controller. When Routes do not specify their own certificate, `certificateSecret` is used.atehe Ingress Controller.


Suggested change

|The `certificateSecret` value is a reference to a secret that contains the default certificate that is served by the Ingress Controller. When Routes do not specify their own certificate, `certificateSecret` is used.atehe Ingress Controller.

|The `certificateSecret` value is a reference to a secret that contains the default certificate that is served by the Ingress Controller. When Routes do not specify their own certificate, `certificateSecret` is used.**atehe** Ingress Controller.

typo?

eslutsky · 2025-04-15T14:53:52Z

modules/microshift-ingress-controller-config.adoc

+|`certificateSecret`
+|The `certificateSecret` value is a reference to a secret that contains the default certificate that is served by the Ingress Controller. When Routes do not specify their own certificate, `certificateSecret` is used.atehe Ingress Controller.
+
+For information about creating a secret, see https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/security_and_compliance/configuring-certificates#replacing-default-ingress_replacing-default-ingress [Replacing the default ingress certificate].


this doc is for openshift, the main difference is the namespace name,
we dont use openshift-config namespace, we use openshift-ingress , so the secret has to be created there.

eslutsky · 2025-04-16T10:27:02Z

modules/microshift-ingress-controller-config.adoc

+
+If not set, the default value is based on the `apiservers.config.openshift.io/cluster` resource.
+
+When using the `Old`, `Intermediate`, and `Modern` profile types, the effective profile configuration is subject to change between releases. For example, given a specification to use the `Intermediate` profile deployed on release `X.Y.Z`, an upgrade to release `X.Y.Z+1` may cause a new profile configuration to be applied to the Ingress Controller, resulting in a rollout. `Intermediate` is the default setting.


we dont have a concept of rollouts (its for operators only ) so this upgrade comment is not relevant.

this is resolved

ShaunaDiaz · 2025-04-22T17:57:52Z

modules/microshift-ingress-controller-config.adoc

@@ -57,11 +71,36 @@ ingress:
 # ...
 ----
 +
-.Ingress controller configuration fields definitions table
+.Ingress controller configuration fields definitions


Suggested change

.Ingress controller configuration fields definitions

.Ingress controller configuration fields definitions table

let's leave "table" in for accessibility

openshift-ci-robot · 2025-04-24T11:01:20Z

@tedaveryredhat: This pull request references OSDOCS-13371 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

Version(s):
4.19+

Issue:
https://issues.redhat.com/browse/OSDOCS-13371

Link to docs preview:
https://91560--ocpdocs-pr.netlify.app/microshift/latest/microshift_configuring/microshift-ingress-controller.html

QE review:

QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ShaunaDiaz · 2025-04-24T11:02:00Z

modules/microshift-ingress-controller-config.adoc


 |`logEmptyRequests`
-|Specifies connections for which no request is received and logged. Usually, these empty requests come from load balancer health probes or web browser speculative connections such as preconnects. Logging these types of empty requests can be undesirable. However, network errors and port scans can also create empty requests, so setting this field to `Ignore` can impede detecting or diagnosing problems and also impede the detection of intrusion attempts.
+|'logEmptyRequests` specifies connections for which no request is received and logged. These empty requests come from load balancer health probes or web browser speculative connections (preconnect) and logging these requests can be undesirable. However, these requests can be caused by network errors, in which case logging empty requests can be useful for diagnosing the errors. These requests can be caused by port scans, and logging empty requests can aid in detecting intrusion attempts. Allowed values for this field are `Log` and `Ignore`. The default is `Log`.


Suggested change

|'logEmptyRequests` specifies connections for which no request is received and logged. These empty requests come from load balancer health probes or web browser speculative connections (preconnect) and logging these requests can be undesirable. However, these requests can be caused by network errors, in which case logging empty requests can be useful for diagnosing the errors. These requests can be caused by port scans, and logging empty requests can aid in detecting intrusion attempts. Allowed values for this field are `Log` and `Ignore`. The default is `Log`.

|`logEmptyRequests` specifies connections for which no request is received and logged. These empty requests come from load balancer health probes or web browser speculative connections (preconnect) and logging these requests can be undesirable. However, these requests can be caused by network errors, in which case logging empty requests can be useful for diagnosing the errors. These requests can be caused by port scans, and logging empty requests can aid in detecting intrusion attempts. Allowed values for this field are `Log` and `Ignore`. The default is `Log`.

ocpdocs-vale-bot · 2025-04-24T19:31:02Z

modules/microshift-ingress-controller-create-secret.adoc

+
+. Verify that all certificates which include `-----END CERTIFICATE-----` also end with one carriage return after that line.
+
+. Create a configuration map that includes only the root CA certificate that is used to sign the wildcard certificate:


🤖 [error] Vale.Avoid: Avoid using 'configuration map'.

ocpdocs-vale-bot · 2025-04-24T19:31:03Z

modules/microshift-ingress-controller-create-secret.adoc

+----
+<1> `</path/to/example-ca.crt>` is the path to the root CA certificate file on your local file system. For example, `/etc/pki/ca-trust/source/anchors`.
+
+. Update the cluster-wide proxy configuration with the newly created configuration map:


🤖 [error] Vale.Avoid: Avoid using 'configuration map'.

openshift-ci · 2025-05-19T18:35:31Z

@tedaveryredhat: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/validate-asciidoc	`dce6749`	link	true	`/test validate-asciidoc`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 2, 2025

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 2, 2025

ocpdocs-vale-bot reviewed Apr 2, 2025

View reviewed changes

openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 10, 2025

ocpdocs-vale-bot reviewed Apr 10, 2025

View reviewed changes

tedaveryredhat force-pushed the OSDOCS-13371-2 branch from 5352e9d to fa1d60b Compare April 10, 2025 16:48

eslutsky reviewed Apr 15, 2025

View reviewed changes

eslutsky reviewed Apr 16, 2025

View reviewed changes

tedaveryredhat force-pushed the OSDOCS-13371-2 branch from fa1d60b to 46f5366 Compare April 21, 2025 18:07

ShaunaDiaz changed the title ~~(WIP): OSDOCS-13371-2: Ingress Security Parms~~ (WIP): OSDOCS-13371-2: Ingress security parameters MicroShift Apr 22, 2025

ShaunaDiaz changed the title ~~(WIP): OSDOCS-13371-2: Ingress security parameters MicroShift~~ [WIP] OSDOCS-13371-2: Ingress security parameters MicroShift Apr 22, 2025

ShaunaDiaz reviewed Apr 22, 2025

View reviewed changes

tedaveryredhat force-pushed the OSDOCS-13371-2 branch from 46f5366 to 2f16f99 Compare April 23, 2025 19:35

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 23, 2025

tedaveryredhat force-pushed the OSDOCS-13371-2 branch 2 times, most recently from 772c8f8 to 81efdcf Compare April 23, 2025 20:19

ShaunaDiaz added this to the Planned for 4.19 GA milestone Apr 24, 2025

ShaunaDiaz added the branch/enterprise-4.19 label Apr 24, 2025

ShaunaDiaz reviewed Apr 24, 2025

View reviewed changes

tedaveryredhat force-pushed the OSDOCS-13371-2 branch from 81efdcf to d1610b7 Compare April 24, 2025 19:06

ocpdocs-vale-bot reviewed Apr 24, 2025

View reviewed changes

tedaveryredhat force-pushed the OSDOCS-13371-2 branch from d1610b7 to 6c2d921 Compare May 1, 2025 18:01

tedaveryredhat force-pushed the OSDOCS-13371-2 branch 2 times, most recently from 20d72af to d84f014 Compare May 13, 2025 19:23

tedaveryredhat force-pushed the OSDOCS-13371-2 branch 3 times, most recently from 7aab754 to 3ac01c1 Compare May 19, 2025 17:37

openshift-ci bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 19, 2025

OSDOCS-13371-2:Ingress Controller Parameters

dce6749

tedaveryredhat force-pushed the OSDOCS-13371-2 branch from 3ac01c1 to dce6749 Compare May 19, 2025 18:14

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels May 19, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] OSDOCS-13371-2: Ingress security parameters MicroShift #91560

[WIP] OSDOCS-13371-2: Ingress security parameters MicroShift #91560

tedaveryredhat commented Apr 2, 2025 •

edited by ShaunaDiaz

Loading

openshift-ci-robot commented Apr 2, 2025 •

edited by openshift-ci bot

Loading

ocpdocs-previewbot commented Apr 2, 2025 •

edited

Loading

ocpdocs-vale-bot Apr 2, 2025

openshift-ci-robot commented Apr 2, 2025 •

edited by openshift-ci bot

Loading

ocpdocs-vale-bot Apr 10, 2025

eslutsky Apr 15, 2025

eslutsky Apr 15, 2025 •

edited

Loading

eslutsky Apr 15, 2025

eslutsky Apr 24, 2025

eslutsky Apr 16, 2025 •

edited

Loading

eslutsky Apr 22, 2025

ShaunaDiaz Apr 22, 2025

openshift-ci-robot commented Apr 24, 2025 •

edited by openshift-ci bot

Loading

ShaunaDiaz Apr 24, 2025

ocpdocs-vale-bot Apr 24, 2025

ocpdocs-vale-bot Apr 24, 2025

openshift-ci bot commented May 19, 2025


		`clientTLS` has the required subfields, `spec.clientTLS.clientCertificatePolicy` and `spec.clientTLS.ClientCA`.

		The `ClientCertificatePolicy` subfield accepts one of the two values: `Required` or `Optional`. Note that the ingress controller only checks client certificates for edge-terminated and reencrypt TLS routes; it cannot check certificates for cleartext HTTP or passthrough TLS routes. The `ClientCA` subfield specifies a config map that is in the openshift-ingress namespace. The config map should contain a CA certificate bundle. A config map is required for this field.

	\|The `certificateSecret` value is a reference to a secret that contains the default certificate that is served by the Ingress Controller. When Routes do not specify their own certificate, `certificateSecret` is used.atehe Ingress Controller.
	\|The `certificateSecret` value is a reference to a secret that contains the default certificate that is served by the Ingress Controller. When Routes do not specify their own certificate, `certificateSecret` is used.atehe Ingress Controller.


		If not set, the default value is based on the `apiservers.config.openshift.io/cluster` resource.

		When using the `Old`, `Intermediate`, and `Modern` profile types, the effective profile configuration is subject to change between releases. For example, given a specification to use the `Intermediate` profile deployed on release `X.Y.Z`, an upgrade to release `X.Y.Z+1` may cause a new profile configuration to be applied to the Ingress Controller, resulting in a rollout. `Intermediate` is the default setting.

	.Ingress controller configuration fields definitions
	.Ingress controller configuration fields definitions table


		. Verify that all certificates which include `-----END CERTIFICATE-----` also end with one carriage return after that line.

		. Create a configuration map that includes only the root CA certificate that is used to sign the wildcard certificate:

[WIP] OSDOCS-13371-2: Ingress security parameters MicroShift #91560

Are you sure you want to change the base?

[WIP] OSDOCS-13371-2: Ingress security parameters MicroShift #91560

Conversation

tedaveryredhat commented Apr 2, 2025 • edited by ShaunaDiaz Loading

openshift-ci-robot commented Apr 2, 2025 • edited by openshift-ci bot Loading

ocpdocs-previewbot commented Apr 2, 2025 • edited Loading

Choose a reason for hiding this comment

openshift-ci-robot commented Apr 2, 2025 • edited by openshift-ci bot Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eslutsky Apr 15, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eslutsky Apr 16, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci-robot commented Apr 24, 2025 • edited by openshift-ci bot Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci bot commented May 19, 2025

tedaveryredhat commented Apr 2, 2025 •

edited by ShaunaDiaz

Loading

openshift-ci-robot commented Apr 2, 2025 •

edited by openshift-ci bot

Loading

ocpdocs-previewbot commented Apr 2, 2025 •

edited

Loading

openshift-ci-robot commented Apr 2, 2025 •

edited by openshift-ci bot

Loading

eslutsky Apr 15, 2025 •

edited

Loading

eslutsky Apr 16, 2025 •

edited

Loading

openshift-ci-robot commented Apr 24, 2025 •

edited by openshift-ci bot

Loading