Skip to content

openshift-route.md

Latest commit

 

History

History
183 lines (133 loc) · 5.4 KB

openshift-route.md

File metadata and controls

183 lines (133 loc) · 5.4 KB

Deployment Strategy with OpenShift Route

Application Deployment

Deploy 2 version of frontend app. Each deployment and service use label app and version for select each version. Initial Route will routing all traffic to v1.

  • Deploy frontend v1 and v2 and create route frontend.yaml

    oc apply -f manifests/frontend.yaml -n project1

Blue/Green Deployment

  • Test Route

    FRONTEND_URL=https://$(oc get route frontend -n project1 -o jsonpath='{.spec.host}')
while [ 1 ];
do
   curl -k $FRONTEND_URL/version
   echo
   sleep 1
done

  • Use another terminal to patch route to frontend v2

    oc patch route frontend  -p '{"spec":{"to":{"name":"frontend-v2"}}}' -n project1

  • Check output from cURL that response is from frontend-v2

  • Set route back to v1

    oc patch route frontend  -p '{"spec":{"to":{"name":"frontend-v1"}}}' -n project1

  • Check output from cURL that response is from frontend-v1

Canary Deployment

  • Apply route for Canary deployment to v1 and v2 with 80% and 20% ratio route-with-alternate-backend.yaml

    oc apply -f manifests/route-with-alternate-backend.yaml -n project1

  • Call frontend for 10 times. You will get 8 responses from v1 and 2 responses from v2

    FRONTEND_URL=https://$(oc get route frontend -n project1 -o jsonpath='{.spec.host}')
COUNT=0
while [ $COUNT -lt 10 ];
do
  curl -k $FRONTEND_URL/version
  echo
  sleep .2
  COUNT=$(expr $COUNT + 1)
done

  • Update weight to 60% and 40%

    oc patch route frontend  -p '{"spec":{"to":{"weight":60}}}' -n project1 
oc patch route frontend --type='json' -p='[{"op":"replace","path":"/spec/alternateBackends/0/weight","value":40}]' -n project1

  • Re-run previous bash script to loop frontend. This times you will get 6 responses from v1 and 4 responses from v2

Restrict TLS to v1.2

  • Check default ingresscontroller by run command or use OpenShift Web Admin Console
oc edit ingresscontroller default -n openshift-ingress-operator

Use Web Admin Console to search for ingressscontroller and select default

  • Minimum TLS version can be specified by attribute minTLSVersion

  • Also test with custom profile, edit tlsProfile: and click Save
spec:
  replicas: 2
  tlsSecurityProfile:
    type: Custom
    custom:
      ciphers:
        - ECDHE-ECDSA-AES128-GCM-SHA256
        - ECDHE-RSA-AES128-GCM-SHA256
      minTLSVersion: VersionTLS12

Test TLS/SSL

To test TLS/SSL encryption enabled on OpenShift ingresscontroller, use https://testssl.sh/ testssl.ssh tool to run report for Ingress VIP support of TLS/SSL ciphers and protocols

Run the test

docker run --rm -ti drwetter/testssl.sh https://frontend-project1.apps.ocp01.example.com

Sample results

mTLS

WIP

Route Sharding

Access Log

Router's access log can be enabled to syslog or sidecar container of router's pods. This can be done by add spec.logging.acess.destination.type to IngressController in openshift-ingress-operator namespace with syslog or Container respectively.

Following set default IngressController with access log in container.

  oc patch IngressController default -n openshift-ingress-operator \
   -p '{"spec":{"logging":{"access":{"destination":{"type":"Container"}}}}}' --type=merge
  oc patch IngressController default -n openshift-ingress-operator \
  -p '{"spec":{"logging":{"access":{"httpLogFormat":"%ci:%cp [%t] %ft %b/%s %B %bq %HM %HU %HV"}}}}' --type=merge
  oc get pods -n openshift-ingress

Check output that existing router pods are terminated and new router pods contains 2 containers

NAME                              READY   STATUS        RESTARTS   AGE
router-default-64bb598c79-78lks   1/1     Running       0          18m
router-default-64bb598c79-w4mgl   1/1     Terminating   0          18m
router-default-66d57c45c8-2lsvq   2/2     Running       0          15s
router-default-66d57c45c8-hh4n5   2/2     Running       0          15s

Verify Access Log

Sidecar

View log from container logs

ROUTER_POD=$(oc get pods -n openshift-ingress -o 'custom-columns=Name:.metadata.name' --no-headers | head -n 1)
oc log -f $ROUTER_POD -n openshift-ingress -c logs

Sample out acesslog

.226:51394 [09/Mar/2022:02:49:20.812] fe_sni~ be_edge_http:project1:frontend/pod:frontend-v2-868959894b-mlld2:frontend:http:10.X.X.X:8080 532 0 GET / HTTP/1.1

Kibana

Login to Kibana and filter for namespace openshift-logging and container name logs

Sample of message