origin: Unable to create HTTP and HTTPS routes that point to the same host but different services or backend ports
It looks like the new route uniqueness code that went in recently may be preventing the valid use case of having a secure and unsecure route for the same host.
Testing with unsecure and edge route:
[vagrant@openshiftdev openshift]$ oadm router --credentials="$KUBECONFIG" --service-account="default"
password for stats user admin has been set to skr6DjtK3G
deploymentconfigs/router
services/router
[vagrant@openshiftdev ~]$ git clone https://github.com/pweil-/hello-nginx-docker
[vagrant@openshiftdev ~]$ oc create -f hello-nginx-docker/openshift/nginx_pod.json
pod "hello-nginx-docker" created
[vagrant@openshiftdev ~]$ oc create -f hello-nginx-docker/openshift/unsecure/service.json
service "hello-nginx-http" created
[vagrant@openshiftdev ~]$ oc create -f hello-nginx-docker/openshift/unsecure/route.json
route "route-unsecure" created
[vagrant@openshiftdev ~]$ curl -H Host:www.example.com 0.0.0.0
Hello World
[vagrant@openshiftdev ~]$ oc create -f hello-nginx-docker/openshift/edge/route.json
[vagrant@openshiftdev ~]$ oc exec router-1-fexe1 -- cat /var/lib/haproxy/conf/os_edge_http_be.map
[vagrant@openshiftdev ~]$ oc exec router-1-fexe1 -- cat /var/lib/haproxy/conf/os_http_be.map
www.example.com default_route-unsecure
[vagrant@openshiftdev ~]$ oc exec router-1-fexe1 -- cat /var/lib/haproxy/conf/haproxy.config
<snip>
##-------------- app level backends ----------------
backend be_http_default_route-unsecure
mode http
option redispatch
option forwardfor
balance leastconn
timeout check 5000ms
http-request set-header X-Forwarded-Host %[req.hdr(host)]
http-request set-header X-Forwarded-Port %[dst_port]
http-request set-header X-Forwarded-Proto https if { ssl_fc }
cookie OPENSHIFT_default_route-unsecure_SERVERID insert indirect nocache httponly
http-request set-header X-Forwarded-Proto http
http-request set-header Forwarded for=%[src],host=%[req.hdr(host)],proto=%[req.hdr(X-Forwarded-Proto)]
server 172.17.0.5:80 172.17.0.5:80 check inter 5000ms cookie 172.17.0.5:80
``
About this issue
- Original URL
- State: closed
- Created 9 years ago
- Reactions: 1
- Comments: 27 (22 by maintainers)
Use case is defining both
http://mysite.comandhttps://mysite.comwhere I allow a portion of my site to be unsecure. For instance a web app that allows you to go to their marketing area without https but uses https for the actual app itself.The alternative here is to make the whole app secure if you need portion of the app secure. Not terrible but a bit inconvenient. Might be able to get around it by using path based routes.