diff --git a/architecture/core_concepts/routes.adoc b/architecture/core_concepts/routes.adoc index 19edb46eb232..4eca7b75f5a9 100644 --- a/architecture/core_concepts/routes.adoc +++ b/architecture/core_concepts/routes.adoc @@ -125,6 +125,14 @@ WebSocket traffic uses the same route conventions and supports the same TLS termination types as other traffic. ==== +For a secure connection to be established a cipher common to the client and sever +must be nogotiated. As time goes on new more secure +link:https://wiki.mozilla.org/Security/Server_Side_TLS[ciphers] become available and +are integrated into client software. As older clients become obsolete, the older less +secure ciphers can be dropped. The router by default, supports a broad range of commonly +available clients. The router can be configured to use a selected set of xref:ciphers[ciphers] +that support desired clients and don't include the less secure ciphers. + [[routes-template-routers]] === Template Routers @@ -287,14 +295,9 @@ will "linger" around for that period. xref:time-units[(TimeUnits)] |`*ROUTER_ALLOW_WILDCARD_ROUTES*`| | When set to `true` or `TRUE`, any routes with a wildcard policy of `Subdomain` that pass the router admission checks will be serviced by the HAProxy router. |`*ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK*` | | Set to `true` to relax the namespace ownership policy. |`*ROUTER_STRICT_SNI*` | | xref:strict-sni[strict-sni] +|`*ROUTER_CIPHERS*` | intermediate | Specify the set of xref:ciphers[ciphers] supported by bind. |=== -[[time-units]] -*TimeUnits* are represented by a number followed by the unit: `us` -*(microseconds), `ms` (milliseconds, default), `s` (seconds), `m` (minutes), `h` -*(hours), `d` (days). The regular expression is: -[1-9][0-9]*(us\|ms\|s\|m\|h\|d) - [NOTE] ==== If you want to run multiple routers on the same machine, you must change the @@ -303,6 +306,13 @@ ports that the router is listening on, `ROUTER_SERVICE_SNI_PORT` and they are unique on the machine. These ports will not be exposed externally. ==== +[[time-units]] +== Timeouts +*TimeUnits* are represented by a number followed by the unit: +`us` (microseconds), `ms` (milliseconds, default), `s` (seconds), `m` (minutes), `h` +(hours), `d` (days). +The regular expression is: [1-9][0-9]*(us\|ms\|s\|m\|h\|d) + [[strict-sni]] == HAProxy Strict SNI @@ -324,6 +334,33 @@ $ oc adm router --strict-sni This sets `ROUTER_STRICT_SNI=true`. +[[ciphers]] +== Router Cipher Suite + +Each client, e.g., Chrome 30, Java8, includes a suite of ciphers that it can use to securely connect with the router. +The router must have at least one of the ciphers for the connection to complete. The +link:https://wiki.mozilla.org/Security/Server_Side_TLS[Security/Server Side TLS] reference guide provides +three reference profiles that support various clients. + +.Router Cipher Profiles +[cols="2,6", options="header"] +|=== +|Profile | Oldest compatible client +|modern| Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, Java 8 +|intermediate|Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7 +|old|Windows XP IE6, Java 6 +|=== + +The router defaults to the "intermediate" profile. A different profile may be selected when the router is created +by using the --ciphers option, or after the router is created by changing the `ROUTER_CIPHERS` environment variable. +The values are: modern, intermediate, or old. Alternatively, a set of ":" separated ciphers may be provided. The ciphers +must be from the set displayed by: + +---- +openssl ciphers +---- + + [[route-hostnames]] == Route Host Names @@ -968,7 +1005,7 @@ For example, to deny the `[{asterisk}.]open.header.test`, `[{asterisk}.]openshif `[{asterisk}.]block.it` routes for the `myrouter` route: ---- -$ oadm router myrouter ... +$ oc adm router myrouter ... $ oc set env dc/myrouter ROUTER_DENIED_DOMAINS="open.header.test, openshift.org, block.it" ---- @@ -994,7 +1031,7 @@ $ oc expose service/ --hostname="api.openshift.org" Alternatively, to block any routes where the host name is _not_ set to `[{asterisk}.]stickshift.org` or `[{asterisk}.]kates.net`: ---- -$ oadm router myrouter ... +$ oc adm router myrouter ... $ oc set env dc/myrouter ROUTER_ALLOWED_DOMAINS="stickshift.org, kates.net" ---- @@ -1020,7 +1057,7 @@ $ oc expose service/ --hostname="www.deny.it" To implement both scenarios, run: ---- -$ oadm router adrouter ... +$ oc adm router adrouter ... $ oc env dc/adrouter ROUTER_ALLOWED_DOMAINS="openshift.org, kates.net" \ ROUTER_DENIED_DOMAINS="ops.openshift.org, metrics.kates.net" ---- @@ -1114,7 +1151,7 @@ This feature can be set during router creation or by setting an environment variable in the router's deployment configuration. ---- -$ oadm router ... --disable-namespace-ownership-check=true +$ oc adm router ... --disable-namespace-ownership-check=true ---- ---- diff --git a/install_config/router/default_haproxy_router.adoc b/install_config/router/default_haproxy_router.adoc index 99b970ddc8c6..4c755ef10478 100644 --- a/install_config/router/default_haproxy_router.adoc +++ b/install_config/router/default_haproxy_router.adoc @@ -13,10 +13,10 @@ toc::[] == Overview -The `oadm router` command is provided with the administrator CLI to simplify the +The `oc adm router` command is provided with the administrator CLI to simplify the tasks of setting up routers in a new installation. If you followed the xref:../../install_config/install/quick_install.adoc#install-config-install-quick-install[quick installation], then -a default router was automatically created for you. The `oadm router` command +a default router was automatically created for you. The `oc adm router` command creates the service and deployment configuration objects. Just about every form of communication between {product-title} components is secured by TLS and uses various certificates and authentication methods. Use the `--service-account` option @@ -36,16 +36,16 @@ achieve this by dedicating infrastructure nodes to run services such as routers. ==== It is recommended to use separate distinct *openshift-router* service account with your router. This can be provided using the `--service-account` flag to the -`oadm router` command. +`oc adm router` command. ifdef::openshift-enterprise[] ---- -$ oadm router --dry-run --service-account=router //<1> +$ oc adm router --dry-run --service-account=router //<1> ---- endif::[] ifdef::openshift-origin[] ---- -$ oadm router --dry-run --service-account=router //<1> +$ oc adm router --dry-run --service-account=router //<1> ---- endif::[] <1> `--service-account` is the name of a xref:../../admin_guide/service_accounts.adoc#admin-guide-service-accounts[service account] @@ -58,7 +58,7 @@ endif::[] [IMPORTANT] ==== -Router pods created using `oadm router` have default resource requests +Router pods created using `oc adm router` have default resource requests that a node must satisfy for the router pod to be deployed. In an effort to increase the reliability of infrastructure components, the default resource requests are used to increase the QoS tier of the router pods above @@ -78,12 +78,12 @@ not exist, run the following to create a router: ifdef::openshift-enterprise[] ---- -$ oadm router --replicas= --service-account=router +$ oc adm router --replicas= --service-account=router ---- endif::[] ifdef::openshift-origin[] ---- -$ oadm router --replicas= --service-account=router +$ oc adm router --replicas= --service-account=router ---- endif::[] @@ -110,12 +110,12 @@ endif::[] ifdef::openshift-enterprise[] ---- -$ oadm router --dry-run --service-account=router +$ oc adm router --dry-run --service-account=router ---- endif::[] ifdef::openshift-origin[] ---- -$ oadm router --dry-run --service-account=router +$ oc adm router --dry-run --service-account=router ---- endif::[] @@ -126,12 +126,12 @@ To see what the default router would look like if created: ifdef::openshift-enterprise[] ---- -$ oadm router -o yaml --service-account=router +$ oc adm router -o yaml --service-account=router ---- endif::[] ifdef::openshift-origin[] ---- -$ oadm router -o yaml --service-account=router +$ oc adm router -o yaml --service-account=router ---- endif::[] @@ -143,25 +143,25 @@ xref:../../admin_guide/manage_nodes.adoc#updating-labels-on-nodes[node label]: ifdef::openshift-enterprise[] ---- -$ oadm router --replicas= --selector=