https://github.com/nerdingitout/oc-route
Learn how to secure routes on Red Hat OpenShift in different ways
https://github.com/nerdingitout/oc-route
cloud-native networking openshift passthrough-route security
Last synced: 6 months ago
JSON representation
Learn how to secure routes on Red Hat OpenShift in different ways
- Host: GitHub
- URL: https://github.com/nerdingitout/oc-route
- Owner: nerdingitout
- License: apache-2.0
- Created: 2021-01-28T10:38:52.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2021-05-20T05:20:40.000Z (about 5 years ago)
- Last Synced: 2024-12-25T20:19:18.441Z (over 1 year ago)
- Topics: cloud-native, networking, openshift, passthrough-route, security
- Language: Dockerfile
- Homepage:
- Size: 57.6 KB
- Stars: 2
- Watchers: 2
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# oc-route
## Introduction
In OpenShift, there are different types of routes in which you can expose your applications, which are: clear, edge, re-encrypt, pass-through. The clear route is insecure and doesn't require any certifications, as for the rest of the routes, they are encrypted on different levels and require certificates.
In this tutorial, you will learn how to create 3 types of routes for your applications: clear, edge and passthroug and you will learn the difference in creating each type of route.
## Prerequisites
For this tutorial you will need:
- Sign up for your IBM Cloud account –
- Red Hat OpenShift Cluster 4 on IBM Cloud.
- oc CLI (can be downloaded from this link or you can use it at http://shell.cloud.ibm.com/.
## Estimated Time
It will take you around 30 minutes to complete this tutorial.
## Steps
- [Login from the CLI & Create Project](https://github.com/nerdingitout/oc-route#login-from-the-cli--create-project)
- [Setting up](https://github.com/nerdingitout/oc-route#setting-up)
- [Create Application](https://github.com/nerdingitout/oc-route#create-application)
- [Expose the Route](https://github.com/nerdingitout/oc-route#expose-the-route)
- [Extract the SSL Cert Secret](https://github.com/nerdingitout/oc-route#extract-the-ssl-cert-secret)
- [Create Edge Route](https://github.com/nerdingitout/oc-route#create-edge-route)
- [Create Golang Application](https://github.com/nerdingitout/oc-route/blob/main/README.md#create-golang-application)
- [Create Passthrough Route](https://github.com/nerdingitout/oc-route#create-passthrough-route)
## Login from the CLI & Create Project
- Go to the web console and click on your username at the top right then 'Copy Login Command', then display the token and copy the ```oc login``` command in your terminal.
- Create ```my-route-project``` project.
```
oc new-project my-route-project
```
## Setting up
In this section, you will view details about your OpenShift Cluster on IBM Cloud. Details you would be interested in are hostname, SSL Cert Secret Name, and the namespace that holds the secret.
- First, this is the Overview page that shows some details about your cluster like Cluster ID and resource group they can be useful when using ibmcloud CLI to grab some information about your cluster.
- on the top right, click on your profile and select "Log in to CLI and API"
- Copy the IBM Cloud CLI login command and paste it in your CLI
- Select the resource group where your cluster resides (in my case it is default)
```
ibmcloud target -g default
```
- View information about your cluster
```
ibmcloud oc nlb-dns ls --cluster
```
## Create Application
- Create a new deployment resource using the [ibmcom/guestbook:v2](https://hub.docker.com/r/ibmcom/guestbook/tags) docker image in the project we just created.
```
oc expose deployment myguestbook --type="NodePort" --port=3000
```
- This deployment creates the corresponding Pod that's in running state. Use the following command to see the list of pods in your namespace.
```
oc get pods
```
- reate a Kubernetes ClusterIP service for your app deployment. The service provides an internal IP address for the app that the router can send traffic to.
```
oc expose deployment myguestbook --type="NodePort" --port=3000
```
## Expose the route
- To view the service that we need to expose. Use the following command.
```
oc get svc
```
- Notice that the application isn't accessible externally, we have only exposed the deployment internally, to make it externally accessible use the following command
```
oc expose svc myguestbook
```
- Now to get the route using the following command
```
oc get routes
```
- copy and paste the link in your browser, you will be redirected to a web page like the following screenshot. Notice that the webpage is not secure because we haven't used any type of encryption yet.
- Since you will be using the same application to create an edge route, make sure to delete the route before moving to the next step
```
oc delete route myguestbook
```
## Extract the SSL Cert Secret
- Now let's take a look at the secrets in openshift-ingress project. You will need a TLS secret that's generated for your cluster which is of type kubernetes.io/tls.
```
oc get secrets -n openshift-ingress
```
- View the secret values in your command line, notice that the key and certificate pair are saved in PEM encoded files.
```
oc extract secret/ --to - -n openshift-ingress
```
- Save the secret in a temporary directory
```
oc extract secret/ --to=/tmp -n openshift-ingress
```
## Create Edge Route
- Create the edge route using the following command
```
oc create route edge --service myguestbook --key /tmp/tls.key --cert /tmp/tls.crt
```
- Get the route of your application and open it from your browser
```
oc get routes
```
- The application has been deployed successfully
- You can check information about the secured website and certificate from the lock icon at the top left of the browser
## Create Golang Application
In this section, you will be deploying a new application that you will be using for passthrough route, then you will create a secret and mount it to the volume so you can create the routes.
- Create the deployment config and service using oc create command.
```
oc create -f https://raw.githubusercontent.com/nerdingitout/oc-route/main/golang-https.yml
```
- Create TLS secret using the same secret you extracted earlier.
```
oc create secret tls mycert --cert /tmp/tls.crt --key /tmp/tls.key
```
- Mount the secret to your volume.
```
oc set volume dc/golang-https --add -t secret -m /go/src/app/certs --name cert --secret-name mycert
```
## Create Passthrough Route
- Create the passthrough route
```
oc create route passthrough golang-https --service golang-https
```
- Get the URL, notice that the termination type is passthrough
```
oc get routes
```
- Access the application and view the certificate
## Resources
You can learn more using the following resources:
- [OpenShift Routes on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_routes)
- [OpenSSL](https://www.digicert.com/kb/ssl-support/openssl-quick-reference-guide.htm)
- [Self-Serviced End-to-end Encryption Approaches for Applications Deployed in OpenShift](https://www.openshift.com/blog/self-serviced-end-to-end-encryption-approaches-for-applications-deployed-in-openshift)
- [Secured Routes](https://docs.openshift.com/container-platform/4.5/networking/routes/secured-routes.html)
- [End to End Encryption with OpenShift: Part 1](https://developers.redhat.com/blog/2017/01/24/end-to-end-encryption-with-openshift-part-1-two-way-ssl/)
- [End to End Encryption with OpenShift: Part 2](https://www.openshift.com/blog/self-serviced-end-to-end-encryption-for-kubernetes-applications-part-2-a-practical-example)