---
# System prepended metadata

title: Untitled

---

## Handling Ingress and DNS

Every OpenShift cluster comes set up with a default application ingress
controller, which is expected have an external DNS record associated with it.

For example, if a HyperShift cluster named `my-cluster` with the base domain
`example.com` is created, then the wildcard domain
`*apps.my-cluster.example.com` is expected to be routable.

### Set up a LoadBalancer and wildcard DNS record for the `*.apps`.

This option requires deploying MetalLB, configuring a new LoadBalancer service that routes to the ingress deployment, as well as assigning a wildcard DNS entry to the LoadBalancer's IP address.

* Step 1
Set up [MetalLB](https://docs.openshift.com/container-platform/4.10/networking/metallb/about-metallb.html) so that when you create a service of type LoadBalancer, MetalLB will add an external IP address for the service.

```
cat << EOF > metallb-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: metallb
  labels:
    openshift.io/cluster-monitoring: "true"
  annotations:
    workload.openshift.io/allowed: management
EOF

cat << EOF > metallb-operator-group.yaml
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: metallb-operator-operatorgroup
  namespace: metallb
spec:
  targetNamespaces:
  - metallb
EOF

cat << EOF > metallb-subscription.yaml
kind: Subscription
metadata:
  name: metallb-operator
  namespace: metallb
spec:
  channel: "stable"
  name: metallb-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
EOF

cat << EOF > metallb-cr.yaml
apiVersion: metallb.io/v1beta1
kind: MetalLB
metadata:
  name: metallb
  namespace: metallb
EOF

hypershift create kubeconfig > hosted0-kubeconfig

oc --kubeconfig hosted0-kubeconfig create -f metallb-namespace.yaml
oc --kubeconfig hosted0-kubeconfig create -f metallb-operator-group.yaml
oc --kubeconfig hosted0-kubeconfig create -f metallb-subscription.yaml
oc --kubeconfig hosted0-kubeconfig create -f metallb-cr.yaml
```


Create an AddressPool with a single IP adress
##### Note the IP address assigned to the service must be on the same subnet as the network used by the cluster nodes.   

Change the INGRESS_IP variable to fit your environment.
```
export INGRESS_IP=192.168.127.77

cat << EOF > address-pool.yaml
apiVersion: metallb.io/v1alpha1
kind: AddressPool
metadata:
  name: ingress-public-ip
  namespace: metallb
spec:
  protocol: layer2
  autoAssign: false
  addresses:
    - ${INGRESS_IP}-${INGRESS_IP}
EOF

oc --kubeconfig hosted0-kubeconfig create -f address-pool.yaml
```

* Step 2
Set up the LoadBalancer Service that routes ingress traffic to the ingress deployment.

```
cat << EOF > metallb-ingress-svc.yaml
kind: Service
apiVersion: v1
metadata:
  annotations:
    metallb.universe.tf/address-pool: ingress-public-ip
  name: metallb-ingress
  namespace: openshift-ingress
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
    - name: https
      protocol: TCP
      port: 443
      targetPort: 443
  selector:
    ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
  type: LoadBalancer
EOF

oc --kubeconfig hosted0-kubeconfig create -f metallb-ingress-svc.yaml
```

* Step 3
Configure wildcard DNS A record or CNAME that references the LoadBalancer Service's external IP.
Configure a wildcard *.apps.<cluster_name>.<base_domain>. DNS entry referencing the IP stored in $INGRESS_IP that is routable both internally and externally to the cluster.