Example usage of resource rhcs_default_ingress

[am90670]

Is there an example how to use rhcs_default_ingress? Specifically cluster_routes_hostname, cluster_routes_tls_secret_ref amd component_routes ? Which namespace should the tls secret(s) be created in?

[gdbranco]

Hello there, cluster_routes_hostname and cluster_routes_tls_secret_ref are being deprecated in favor of component_routes

component_routes was merged by #568 and is expected to land in release 1.6.3 which is currently under review. Albeit, no specific release date to share at the moment.

Here's a small example of how to work with the component_routes when 1.6.3 lands. Official docs will be available later on on https://docs.openshift.com/

You'll need to generate certificates for each of the routes you wish to modify in component_routes being Downloads, Console and Oauth. Consult your certificate authority to understand how to create a certificate with similar attributes for your production workloads.

Here's an example that is not intended for production

$ openssl req -newkey rsa:2048 -new -nodes -x509 -days 365 -keyout console-key-my-new-domain.pem -out console-cert-my-new-domain.pem -subj "/CN=*.my-new-domain.dev" -addext "subjectAltName = DNS:console.my-new-domain.dev"

You may then add the secret to your cluster within openshift-config namespace

$ oc create secret tls console-tls-secret --cert=console-cert-my-new-domain.pem --key=console-key-my-new-domain.pem -n openshift-config

By executing

$ oc get svc -n openshift-ingress

There will be an output for a field called EXTERNAL-IP. In your hosting provider, add DNS records that map the CNAME of your new component route hostnames to the load balancer EXTERNAL-IP found in the previous command.

You'll then be ready to modify the component-routes attribute of the ingress resource

resource "rhcs_default_ingress" "default" {
  cluster = rhcs_cluster_wait.cluster.cluster

  component_routes = {
    "console" = {
      hostname       = "tconsole.my-new-domain.dev"
      tls_secret_ref = "console-tls-secret"
    }
  }
}

You may include similar steps for the other two routes