Private ingresscontroller demo

app.yaml

kind: Namespace
apiVersion: v1
metadata:
  name: private-hello

---

kind: Deployment
apiVersion: apps/v1
metadata:
  name: hello
  namespace: private-hello
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      containers:
      - name: hello
        image: openshift/hello-openshift

---

kind: Service
apiVersion: v1
metadata:
  name: hello
  namespace: private-hello
spec:
  selector:
    app: hello
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080

---

apiVersion: v1
kind: Route
metadata:
  name: public
  namespace: private-hello
spec:
  host: hello.public.dmace.devcluster.openshift.com
  to:
    kind: Service
    name: hello

---

apiVersion: v1
kind: Route
metadata:
  name: private
  namespace: private-hello
  labels:
    scope: internal
spec:
  host: hello.private.dmace.devcluster.openshift.com
  to:
    kind: Service
    name: hello

ingresscontrollers.yaml

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
  namespace: openshift-ingress-operator
  name: public
spec:
  domain: public.dmace.devcluster.openshift.com
  endpointPublishingStrategy:
    type: LoadBalancerService
  routeSelector:
    matchExpressions:
    - {key: scope, operator: NotIn, values: [internal]}

---

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
  namespace: openshift-ingress-operator
  name: private
spec:
  domain: private.dmace.devcluster.openshift.com
  endpointPublishingStrategy:
    type: LoadBalancerService
    loadBalancer:
      scope: Internal
  routeSelector:
    matchLabels:
      scope: internal

install.sh

#!/bin/bash
set -euo pipefail

oc apply -f ingresscontrollers.yaml
oc apply -f app.yaml

output.txt

From a host outside the cluster on the internet:

$ dig +short hello.public.dmace.devcluster.openshift.com
3.13.23.237
3.130.125.169

$ dig +short hello.private.dmace.devcluster.openshift.com

$ curl -s http://hello.public.dmace.devcluster.openshift.com
Hello OpenShift!

$ curl -s http://hello.private.dmace.devcluster.openshift.com
<host not found>

From a pod in the cluster:

$ oc run --rm -i network-utils --image=amouat/network-utils --restart=Never --generator run-pod/v1 -- dig +short hello.public.dmace.devcluster.openshift.com
3.13.23.237
3.130.125.169

$ oc run --rm -i network-utils --image=amouat/network-utils --restart=Never --generator run-pod/v1 -- dig +short hello.private.dmace.devcluster.openshift.com
10.0.163.44
10.0.154.9

$ oc run --rm -i network-utils --image=amouat/network-utils --restart=Never --generator run-pod/v1 -- curl -s http://hello.public.dmace.devcluster.openshift.com
Hello OpenShift!

$ oc run --rm -i network-utils --image=amouat/network-utils --restart=Never --generator run-pod/v1 -- curl -s http://hello.private.dmace.devcluster.openshift.com
Hello OpenShift!

verify.sh

#!/bin/bash
set -x

dig +short hello.public.dmace.devcluster.openshift.com

dig +short hello.private.dmace.devcluster.openshift.com

curl -s http://hello.public.dmace.devcluster.openshift.com

curl -s http://hello.private.dmace.devcluster.openshift.com