You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* xref:../microshift_configuring/microshift-ingress-controller.adoc#microshift-ingress-controller[Using ingress control for a {microshift-short} cluster]
Copy file name to clipboardExpand all lines: modules/microshift-config-parameters-table.adoc
+67-11Lines changed: 67 additions & 11 deletions
Original file line number
Diff line number
Diff line change
@@ -63,7 +63,7 @@ The following table explains {microshift-short} configuration YAML parameters an
63
63
64
64
|`tls.minVersion`
65
65
|`VersionTLS12` or `VersionTLS13`
66
-
|Specifies the minimum version of TLS to serve from the API serve. Default is value is `VersionTLS12`. TLS 1.3 ciphers are preset and not configurable.
66
+
|Specifies the minimum version of TLS to serve from the API server. Default is value is `VersionTLS12`. TLS 1.3 ciphers are preset and not configurable.
67
67
68
68
|`debugging.logLevel`
69
69
|`Normal`, `Debug`, `Trace`, or `TraceAll`
@@ -77,25 +77,46 @@ The following table explains {microshift-short} configuration YAML parameters an
77
77
|`number`
78
78
|By default, `etcd` uses as much memory as needed to handle the load on the system. However, in memory constrained systems, it might be preferred or necessary to limit the amount of memory `etcd` can to use at a given time.
79
79
80
+
|`ingress.certificate.Secret`
81
+
|`string`
82
+
|A string that is a reference to a secret that contains the default certificate that is served by the ingress controller. When Routes do not specify their own certificate, `certificateSecret` is used.
83
+
84
+
The secret must contain the following keys and data:
85
+
86
+
* `tls.crt`: certificate file contents
87
+
* `tls.key`: key file contents
88
+
89
+
If you do not set one, a wildcard certificate is automatically generated and used. The certificate is valid for the ingress controller `domain` and `subdomains`, and the generated certificate's CA is automatically integrated with the cluster's truststore.
90
+
91
+
Any certificate in use is automatically integrated in the {microshift-short} OAth server.
|`clientTLS` authenticates client access to the cluster and services; as a result, mutual TLS authentication is enabled. If you do not set one, then client TLS is not enabled. `clientTLS` has the required subfields, `spec.clientTLS.clientCertificatePolicy` and `spec.clientTLS.ClientCA`.
96
+
97
+
The `ClientCertificatePolicy` subfield accepts one of the two values: `Required` or `Optional`. Note that the ingress controller only checks client certificates for edge-terminated and reencrypt TLS routes; it cannot check certificates for cleartext HTTP or passthrough TLS routes. The `ClientCA` subfield specifies a config map that is in the openshift-ingress namespace. The config map should contain a CA certificate bundle. A config map is required for this field.
98
+
99
+
The `AllowedSubjectPatterns` is an optional value that specifies a list of regular expressions, which are matched against the distinguished name on a valid client certificate to filter requests. The regular expressions must use PCRE syntax. This field must contain a valid expression or the MicroShift service will fail. At least one pattern must match a client certificate's distinguished name; otherwise, the ingress controller rejects the certificate and denies the connection. If you do not specify a value, the ingress controller does not reject certificates based on the distinguished name.
100
+
80
101
|`ingress.defaultHTTPVersion`
81
102
|`number`
82
103
|Determines the default HTTP version to be used for ingress. Default value is `1`, which is the HTTP/1.1 protocol.
83
104
84
105
|`ingress.forwardedHeaderPolicy`
85
106
|`Append`, `Replace`, `IfNone`, `Never`
86
-
|Specifies when and how the ingress router sets the `Forwarded`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, and `X-Forwarded-Proto-Version` HTTP headers.
107
+
|Specifies when and how the ingress controller sets the `Forwarded`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, and `X-Forwarded-Proto-Version` HTTP headers. The default value is `Append`.
87
108
88
-
* `Append` specifies that the ingress router appends existing headers. `Append` is the default value.
109
+
* `Append` specifies that the ingress controller appends existing headers.
89
110
90
-
* `Replace` specifies that the ingress router sets the headers and replaces any existing `Forwarded` or `X-Forwarded-*` headers.
111
+
* `Replace` specifies that the ingress controller sets the headers and replaces any existing `Forwarded` or `X-Forwarded-*` headers.
91
112
92
-
* `IfNone` specifies that the ingress router sets headers if they are not already set.
113
+
* `IfNone` specifies that the ingress controller sets headers if they are not already set.
93
114
94
-
* `Never` specifies that ingress router never sets the headers, preserving any existing headers.
115
+
* `Never` specifies that ingress controller never sets the headers, preserving any existing headers.
95
116
96
117
|`ingress.httpCompression`
97
118
|`object`
98
-
|`httpCompression` defines a policy for HTTP traffic compression. There is no HTTP compression by default.
119
+
|Defines a policy for HTTP traffic compression. There is no HTTP compression by default.
99
120
100
121
|`ingress.httpCompression.mimeTypes`
101
122
|`array` or null
@@ -129,7 +150,7 @@ Not all MIME types benefit from compression, but `HAProxy` uses resources to try
129
150
130
151
|`ingress.logEmptyRequests`
131
152
|`Log` or `Ignore`
132
-
|Default value is `Log`. Specifies how connections on which empty requests are received are logged. These connections typically come from the health probes of a load balancer service health or a web browser's speculative connections, such as a `preconnect`. Logging typical requests might be undesirable, but requests can also be caused by network errors or port scans, in which case logging can be useful for diagnosing errors and detecting intrusion attempts.
153
+
|The default value is `Log`. Specifies how connections on which empty requests are received are logged. These connections typically come from the health probes of a load balancer service health or a web browser's speculative connections, such as a `preconnect`. Logging typical requests might be undesirable, but requests can also be caused by network errors or port scans, in which case logging can be useful for diagnosing errors and detecting intrusion attempts.
133
154
134
155
|`ingress.ports.http`
135
156
|`80`
@@ -139,14 +160,49 @@ Not all MIME types benefit from compression, but `HAProxy` uses resources to try
139
160
|`443`
140
161
|Default port shown. Configurable. Valid value is a single, unique port in the `1-65535` range. The values of the `ports.http` and `ports.https` fields cannot be the same.
|Describes how hostname claims across namespaces are handled. By default, allows routes to claim different paths of the same hostname across namespaces. Specifying `Strict` prevents routes in different namespaces from claiming the same hostname. If the value is deleted in a customized {microshift-short}`config.yaml`, the `InterNamespaceAllowed` value is automatically set.
165
+
|Defines a policy for handling new route claims, such as allowing or denying claims across namespaces. By default, allows routes to claim different paths of the same hostname across namespaces. Specifying `Strict` prevents routes in different namespaces from claiming the same hostname. If the value is deleted in a customized {microshift-short}`config.yaml`, the `InterNamespaceAllowed` value is automatically set.
|Describes how hostname claims across namespaces should be handled. The default value is `Strict`.
170
+
171
+
* `Strict`: does not allow routes to claim the same hostname across namespaces.
172
+
* `InterNamespaceAllowed`: allows routes to claim different paths of the same hostname across namespaces.
173
+
174
+
|`ingress.routeAdmissionPolicy.wildcardPolicy`
175
+
|`WildcardsAllowed`, `WildcardsDisallowed`
176
+
|Describes how routes with wildcard policies are handled by the ingress controller.
177
+
178
+
* `WildcardsAllowed`: Indicates routes with any wildcard policy are admitted by the ingress controller.
179
+
180
+
* `WildcardsDisallowed`: Indicates only routes with a wildcard policy of `None` are admitted by the Ingress Controller. Updating `wildcardPolicy` from `WildcardsAllowed` to `WildcardsDisallowed` causes admitted routes with a wildcard policy of `Subdomain` to stop working. These routes must be recreated to a wildcard policy of `None` to be readmitted by the Ingress Controller. `WildcardsDisallowed` is the default setting.
145
181
146
182
|`ingress.status`
147
183
|`Managed` or `Removed`
148
184
|Router status. Default is `Managed`.
149
185
186
+
|`ingress.tlsSecurityProfile`
187
+
|`object`
188
+
|Specifies settings for TLS connections for ingress controllers. If you do not set one, the default value is based on the `apiservers.config.openshift.io/cluster` resource.
189
+
190
+
|`ingress.tlsSecurityProfile.type`
191
+
|`Old`, `Intermediate`, `Modern`, 'Custom'
192
+
|Specifies the profile type for the TLS Security. The default value is `Intermediate`.
193
+
194
+
When using the `Old`, `Intermediate`, and `Modern` profile types, the effective profile configuration is subject to change between releases. For example, given a specification to use the `Intermediate` profile deployed on release `X.Y.Z`, an upgrade to release `X.Y.Z+1` may cause a new profile configuration to be applied to the ingress controller, resulting in a rollout.
195
+
196
+
|`ingress.tlsSecurityProfile.minTLSVersion`
197
+
|`number`
198
+
|Specifies the TLS version for ingress controllers.
199
+
200
+
The minimum TLS version is `1.1`, and the maximum TLS version is `1.3`.
201
+
202
+
* Ciphers and the minimum TLS version of the configured security profile are reflected in the `TLSProfile` status.
203
+
204
+
* The ingress controller converts the TLS `1.0` of an `Old` or `Custom` profile to `1.1`.
205
+
150
206
|`ingress.tuningOptions`
151
207
|Objects
152
208
|Specifies options for tuning the performance of ingress controller pods.
|The port range allowed for Kubernetes services of type `NodePort`. If not specified, the default range of 30000-32767 is used. Services without a `NodePort` specified are automatically allocated one from this range. This parameter can be updated after {microshift-short} starts.
318
+
|The port range allowed for Kubernetes services of type `NodePort`. If you do not specify the range, the default range of 30000-32767 is used. Services without a `NodePort` specified are automatically allocated one from this range. This parameter can be updated after {microshift-short} starts.
0 commit comments