Task:
Setup external cluster access for Domino container. Performed after the domino ConfigMap has been run to create the deployment.
Notes:
- ExternalIP administrative set-up must be performed first: docs.okd.io/latest/networking/ingress_load_balancing/configuring_ingress_cluster_traffic/configuring-externalip.html
- Domino services deployed based on ConfigMap and run based on github.com/HCL-TECH-SOFTWARE/domino-container files. Examples at bottom of this document for convenience.
Overview:
- Create Ingress
- Create NRPC service
- Create HTTP and HTTPS services
Notes:
- Project: mwdom
- Administrators Account: domino-admin
- Domino server: mwdom01
- Domino server tagged: mwdom01
- Domino deployed via custom mwdom01-configmap.yml and mwdom01-autoconfig.yml
Tagging of Domino via label:
...
metadata:
name: mwdom01
namespace: mwdom
labels:
app: mwdom01
...
Steps:
1. Login to OCK/OCP 4:
$ $ oc login -u mwadminid <host>
<enter password>
2. Create Ingress:
- Update host FQDN and port if necessary:
$ vi mwdom01-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mwdom01-http
namespace: mwdom
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
rules:
- host: mwdom01.mindwatering.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: mwdom01-http
port:
number: 80
- Create ingress:
$ oc apply -f mwdom01-ingress.yaml
<confirm created>
2. Create HTTP (Port 80) Service:
- Update app selector, and port if necessary:
$ vi mwdom01-service-http.yaml
apiVersion: v1
kind: Service
metadata:
name: mwdom01-http
namespace: mwdom
spec:
selector:
app: mwdom01
ports:
- protocol: TCP
port: 80
targetPort: 80
- Create HTTP service:
$ oc apply -f mwdom01-service-http.yaml
<confirm created>
3. Create HTTPS (Port 443) Service:
Note:
- For the external IP, it will depend on how your cluster is configured.
- - The cluster will convert the internal pod network isolated NAT to a host IP and available non standard HTTP port, or handoff to a reverse proxy provider (plugin)
- - When using OKD/OCP 4, the ExternalIPs must be already configured, assignment of the IP will be out of the available pool if the spec.externalIP is left out. If specifying it, like below, ensure the IP is not already taken by another app service.
- - If the cluster is behind a reverse proxy and NRPC is internal only, or being route through another Domino passthrough server, use the reverse proxy's internal IP set-up.
- Update app selector, the external IP, and port if necessary:
$ vi mwdom01-service-https.yaml
apiVersion: v1
kind: Service
metadata:
name: mwdom01-https
namespace: mwdom
spec:
type: ClusterIP
selector:
app: mwdom01
ports:
- name: https
protocol: TCP
port: 443
targetPort: 443
externalIPs:
- 12.23.34.45
- Create HTTPS service:
$ oc apply -f mwdom01-service-https.yaml
<confirm created>
4. Create NRPC (Port 1352) Service:
Note:
- For the external IP, it will depend on how your cluster is configured.
- - A typical TCP reverse proxy cannot handle RPC correctly, typically a form of NAT is used for NRPC
- - When using OKD/OCP 4, the ExternalIPs must be already configured, assignment of the IP will be out of the available pool if the spec.externalIP is left out. If specifying it, like below, ensure the IP is not already taken by another app service.
- Update app selector, the external IP, and port if necessary:
$ vi mwdom01-service-nrpc.yaml
apiVersion: v1
kind: Service
metadata:
name: mwdom01-nrpc
spec:
selector:
app: mwdom01
ports:
- name: nrpc
protocol: TCP
port: 1352
externalIPs:
- 12.23.34.45
- Create NRPC service:
$ oc apply -f mwdom01-service-nrpc.yaml
<confirm created>
---
Domino ConfigMap and Deployment Run Example:
Notes:
- Anything that is individual to the business, or the server that is unique must be updated/customized in the example below
- The Domino organization and the Domino domain do not have to be the same (e.g. MWNet)
- Customize ConfigMap:
$ vi mwdom01-configmap.yml
apiVersion: v1
kind: ConfigMap
metadata:
name: mwdom01-cfg
namespace: mwdom
data:
auto_config.json: |
{
"serverSetup": {
"server": {
"type": "first",
"name": "mwdom01.mindwatering.net",
"domainName": "MWNet",
"title": "MW Domino 01 Server",
"password": null,
"minPasswordLength": 0,
"serverTasks": "replica,router,update,amgr,adminp,http,ca,certmgr"
},
"network": {
"hostName": "mwdom01.mindwatering.net",
"enablePortEncryption": true,
"enablePortCompression": true
},
"org": {
"orgName": "MWNet",
"certifierPassword": "1ReallyHardCertPassword4U"
},
"admin": {
"firstName": "Admin",
"lastName": "MWNet",
"password": "4PrettyHardPassword4HimOrHerAndU",
"IDFilePath": "/local/notesdata/domino/html/admin.id"
},
"notesINI": {
"Create_R85_log": "1",
"Create_R12_Databases": "1",
"LOG_REPLICATION": "0",
"LOG_SESSIONS": "0",
"HTTPPublicURLs": "/iwaredir.nsf/*:/.well-known*",
"ENABLE_SNI": "1",
"HTTPEnableMethods": "GET,POST,PUT,DELETE,HEAD",
"ADMIN_CLIENT_SKIP_DOMINO": "1",
"COMPRESS_LZ1_CREATE": "1",
"CREATE_NIFNSF_DATABASES": "1",
"NIFNSFENABLE": "1",
"NIFBASEPATH": "/local/nif",
"FTBASEPATH": "/local/ft",
"DAOS_ENCRYPT_NLO": "0",
"DAOS_MAX_FILES_PER_SUBCONTAINER": "10000",
"EVENT_POOL_SIZE": "41943040",
"SETUPLEAVESERVERTASKS": "1",
"SSL_DISABLE_EXTENDED_MASTER_SECRET": "1",
"Server_MinPossibleTransTime": "1500",
"Server_MaxPossibleTransTime": "20000000",
"NSF_BUFFER_POOL_SIZE_MB": "256",
"FT_FLY_INDEX_OFF": "1",
"UPDATE_FULLTEXT_THREAD": "1",
"FTG_USE_SYS_MEMORY": "1"
},
"security": {
"ACL": {
"prohibitAnonymousAccess": true,
"addLocalDomainAdmins": true
}
}
},
"autoConfigPreferences": {
"startServerAfterConfiguration": true
},
"IDVault": {
"name": "O=mwnet_vault",
"description": "MWNET Vault",
"IDFile": "vault.id",
"IDPassword": "domino4ever8",
"path": "IBM_ID_VAULT/mwnet_vault.nsf",
"passwordReset": {
"helpText": "Contact Mindwatering support for any assistance needed during password resets. Thank you."
},
"securitySettingsPolicy": {
"name": "MWNet Vault Security Settings Policy",
"description": "MWNet Vault Security Settings"
},
"masterPolicy": {
"description": "MWNet Vault Master Policy Description"
}
},
"appConfiguration": {
"databases": [
{
"filePath": "names.nsf",
"action": "update",
"documents": [
{
"action": "update",
"findDocument": {
"Type": "Server",
"ServerName": "CN=mwdom01.mindwatering.net/O=MWNet"
},
"items": {
"HTTP_SSLKeyFile": "mwdom01.mindwatering.net",
"TRANSLOG_AutoFixup": "",
"TRANSLOG_MaxSize": 1024,
"TRANSLOG_Path": "/local/translog",
"TRANSLOG_Performance": "2",
"TRANSLOG_Status": "1",
"TRANSLOG_Style": "0",
"TRANSLOG_UseAll": "0",
"QtaMthd": "1",
"DAOSEnable": "1",
"DAOSBasePath": "/local/daos",
"DAOSMinObjSize": "256000",
"DAOS_ENCRYPT_NLO": "0",
"HTTP_HomeURL": "homepage.nsf",
"FullAdmin": "LocalDomainAdmins",
"CreateAccess": "LocalDomainAdmins",
"ReplicaAccess": "LocalDomainAdmins",
"UnrestrictedList": "LocalDomainAdmins",
"OnBehalfOfLst": "LocalDomainAdmins",
"RestrictedList": "LocalDomainAdmins",
"HTTP_EnableSessionAuth": "1",
"HTTP_TCPNP": "1",
"HTTP_AllowAnonymous": "0",
"HTTP_NormalMode": "1",
"HTTP_SSLMode": "1",
"HTTP_SSLAnonymous": "0",
"NSDEnbld": "1",
"FREnbld": "1",
"FltRcvryNot": "LocalDomainAdmins",
"ServerBuildNumber": "12.0",
"MajVer": 12,
"SSLCipherList": [
"C030",
"9F",
"C02F",
"9E",
"C028",
"6B",
"C027",
"67"
],
"SSLCipherSupportedList": [
"C030",
"9F",
"C02F",
"9E",
"C028",
"6B",
"C027",
"67"
]
}
},
{
"action": "create",
"computeWithForm": true,
"items": {
"Form": "ServerConfig",
"UseAsDefault": "1",
"ServerName": "*",
"ILEnforce": "1",
"ILLockIP": "0",
"ILCountAgainstIP": "0",
"ILLogLockouts": "1",
"ILLogFailures": "1",
"ILMaxTries": 7,
"ILExpMinutes": 10,
"ILExpNum": 10,
"ILTimeFormat": ",minutes",
"ILClearNum": 10,
"ILClearMinutes": 10,
"ILTimeFormat2": ",minutes",
"PwdCheckInVault": "2",
"DCLoc": "CN=HCL Notes/O=Domino Fault Reports",
"DCMsgSize": 50,
"DCNSDSize": 40,
"DCDO": 10000,
"FAEnabled": "1",
"FADBs": "1"
}
}
]
},
{
"action": "create",
"filePath": "domcfg.nsf",
"title": "Domino Web Server Configuration",
"templatePath": "domcfg5.ntf",
"signUsingAdminp": true,
"documents": [
{
"action": "create",
"items": {
"Form": "LoginMap",
"LF_LoginForm": "DWALoginForm",
"LF_LoginFormDB": "iwaredir.nsf",
"LF_ServerType": "0",
"LF_IP": "",
"$PublicAccess": "1"
}
}
]
},
{
"action": "create",
"filePath": "iwaredir.nsf",
"title": "Redirect",
"templatePath": "iwaredir.ntf",
"signUsingAdminp": true,
"documents": [
{
"action": "create",
"computeWithForm": true,
"items": {
"Form": "AutoLogin",
"ServerNameSelect": "1",
"RedirectMessageWebView": "Redirecting...",
"$LANGUAGE": "en",
"$ServerSettingsTable": "Select",
"EnableUltraliteRadioButton": "0",
"MobileAgentKeywords": "ipod,iphone,android,ipad",
"SSLPort": "443",
"RedirectionTime": "1",
"RedirectionMessageText": "Redirecting...",
"WMRGlobalProfileURL": "/",
"ServerNameChange": "0",
"ForceSSL": "1",
"OmitProtocol": "0",
"UseHomeMailServer": "0",
"LoginOptions": "0",
"EncryptPassword": "0",
"WebMailRedirectEnableDebug": "0",
"WebMailRedirectProfileEnable": "0",
"WMRVersion": "650",
"WMRAttachmentNames": "BLANK",
"MailServerDomainName": "",
"RevProxyServerName": "",
"ForcePath": ""
}
}
]
}
]
}
}
- Apply the ConfigMap:
$ oc apply -f mwdom01-configmap.yml
<confirm successful>
Reminders:
- The name of the ConfigMap must be the same as customized above (e.g. mwdom01-cfg)
- The name of the pod must be the same as the services to be created (e.g. mwdom01)
- The app label must be the same as the services to be created (e.g. mwdom01)
- The storage PVC should already be set-up (e.g. mwdom01-local-path-pvc)
- Registry is the local OKD/OCP 4 registry and the image name, (e.g. image-registry.openshift-image-registry.svc:5000/mwdom/dom140)
- The pull secret is not required since we're using the local registry.
- If you need the public URL for OKD/OCP 4, you can confirm registry URL:
(However, the internal OKD/OCP 4 svc:5000 URL above is the one to use.)
$ OCPRegHost=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')
$ echo $OCPRegHost
- Customize the deployment file:
$ vi mwdom01-autoconfig.yml
apiVersion: v1
kind: Pod
metadata:
name: mwdom01
namespace: mwdom
labels:
app: mwdom01
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
fsGroupChangePolicy: "OnRootMismatch"
containers:
- env:
- name: LANG
value: "en_US.UTF-8"
- name: SetupAutoConfigure
value: "1"
- name: SetupAutoConfigureParams
value: "/etc/mwdom01-cfg/auto_config.json"
- name: DominoConfigRestartWaitTime
value: "30"
- name: DominoConfigRestartWaitString
value: "Server started on physical node"
name: dom140
image: image-registry.openshift-image-registry.svc:5000/mwdom/dom140:latest
securityContext:
capabilities:
add: ["SYS_PTRACE"]
runAsNonRoot: true
runAsUser: 1000
volumeMounts:
- name: domino-data
mountPath: /local
- name: mwdom01-cfg
mountPath: /etc/mwdom01-cfg
ports:
- containerPort: 1352
protocol: TCP
- containerPort: 80
protocol: TCP
- containerPort: 443
protocol: TCP
livenessProbe:
exec:
command:
- /healthcheck.sh
initialDelaySeconds: 60
periodSeconds: 20
readinessProbe:
exec:
command:
- /healthcheck.sh
- ready
initialDelaySeconds: 60
periodSeconds: 20
# this init container is a work-around to change file-system permissions for some local storage providers
initContainers:
- name: domino-startup
image: busybox:latest
command: [ 'sh', '-c', 'chmod 777 /local' ]
securityContext:
runAsNonRoot: false
runAsUser: 0
volumeMounts:
- name: domino-data
mountPath: /local
volumes:
- name: domino-data
persistentVolumeClaim:
claimName: mwdom01-local-path-pvc
- name: mwdom01-cfg
configMap:
name: mwdom01-cfg
- Run the Deployment:
$ oc apply -f mwdom01-autoconfig.yml
<confirm successful>
previous page
|