-
Notifications
You must be signed in to change notification settings - Fork 234
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
How to access CRC or apps deployed on CRC remotely #705
Comments
This was the same for Minishift unless you used the 'generic driver' to deploy this without a VM. This is by design as your are running this on a virtual network. The intended use-case is to use this for development and any unauthorized reote access would not be a wanted situation. However, there are ways around this, but they are for now outside the scope of CRC. You could for instance allow the use of |
@gbraad What does “the 'generic driver' to deploy this without a VM” mean? Is that also supported by crc? It looks I couldn't find that from crc docs. Also, I found this issue on Minishift which is similar and you are in the loop as well :-) It looks Minishift supports However, it looks crc does not has similar feature yet, the host/domain name seems to be fixed (crc.testing, apps-crc.testing) and not changeable. Please correct me if I'm wrong. |
No, not supported by CRC as we need to run on RHEL CoreOS, and therefore a VMM is needed. We are currently getting ready for the GA and after this will continue with looking into some of the networking issue related to CRC, like proxy, etc. We have purposely made very opinionated choices, very different from Minishift, that guarantees a consistent deployment and predictable cluster deployment, and therefore you are not able to modify some of the names and domains. This also prevents people consider this a production-ready setup and deploy CRC as a headless environment, like a server. Sure, they can, but the constraints are the same. The way aroudn this would be to use the snc repo, but at the moment the customization experience is far from ideal since it needs at least 24hours to generate an image (to force the initial certificate rotation: #11). |
@gbraad Please correct me if any. The major problem is that, usually, we may have routes that are all mapped to the same IP, with just different subdomains. e.g. $ oc get routes -n istio-system
NAMESPACE NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
istio-system grafana grafana-istio-system.apps-crc.testing grafana http None
istio-system jaeger-query jaeger-query-istio-system.apps-crc.testing jaeger-query query-http None
istio-system kiali kiali-istio-system.apps-crc.testing kiali http-kiali None
istio-system prometheus prometheus-istio-system.apps-crc.testing prometheus http-prometheus None They all point to the CRC VM IP. With that, I couldn't use tricks such as IP forwarding or port forwarding, but instead may have to leverage reverse proxy which supports name-based forwarding, e.g. virtual host w/ Apache, or subdomain w/ nginx, and so on. Any better ideas or suggestions? |
After investigated for a few hours, it looks to use proxy is also not very straightforward as I thought originally. Because of the requirement of name-based forwarding, I chose nginx as example: First, it's easy to expose route for HTTP service, and configure proxy. Here's an example:
I just forward the request from client to the host machine (192.168.10.100), then to the VM (apps-crc.testing). The tricky part is HTTPS, typically, the OpenShift web console. Ideally, to keep it simple, I would have my reverse proxy running using SSL passthrough rather than SSL termination, so, run at TCP level:
However, because lack of the
This is inconvenient. Otherwise, I have to use tricks such as Essentially, I'd think that's why we may still need |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
Any update? Will this be in the plan? @gbraad |
This is definitely not one of the supported usecases for crc. However this request comes up regularly. We could look into making it easier to do this manually, but I don't think we want to support it out of the box. |
Understood and that should be greatly helpful if it can be made easier when do it manually. That's enough for me. And, I'd think that can also get more people to use CRC. I'd be interested to be involved if there's somewhere on this under discussion now or later. Thanks! |
This is our use case. Here's the problem we have: based on what we were told we cannot install crc on ubuntu 16.04 because libvirt is old. and then try connecting. We get this:
|
Based on my CRC use experience, I'd suggest you need a proxy installed along w/ CRC instance on the same machine, in your case, that's the WIndows system. I usually deploy CRC on a remote virtual machine, then install nginx on that machine as a reverse proxy and config the proxy to expose the CRC local network to others in the same LAN. My understanding is that, CRC uses NetworkManager for linux OS, or etc/hosts in MacOS, and probably Windows(I haven't tried on Windows) to config a local network w/ hostname, IP mapping, i.e. api.crc.testing <local_crc_ip>, this is the IP pointing to the CRC VM, not the host machine. Another thing to note is, api.crc.testing is the fixed hostname you have to use when you connect to the remote CRC instance from other machine. Because of that, I previously add the mapping manually in etc/hosts on my MacOS, which is a bit inconvenience. But recently, I found that can be changed by creating additional route in OCP (that's running in CRC), which is cool. Here's a simple flow to demonstrate how I did it:
And, on that remote VM:
|
@morningspace
On the ubuntu16 machine:
(not the IP address is the one for the Windows and not oc vm)
** server can't find crc.testing: NXDOMAIN
$ grep dns /var/log/syslog
|
@morningspace
it works perfectly. I don't need the nginx this way! |
@morningspace
and in /usr/local/etc/hosts I added: NOTE: no nginx needed anywhere
|
Interestingly, @jeffsaremi trying to understand what you did... so: In this comment, I'm assuming you are working on your Ubuntu machine, and what's the In this comment, it's also the Ubuntu machine right? And you are using NetworkManager w/ dnsmasq plugin, that points to the /usr/loca/etc/hosts, w/ the manually added host, IP mapping, right? Lastly, I'd like to know how you configured on your Windows machine. Since CRC is a VM sitting inside Windows as its host machine, how the request can go into the VM via the host machine? (I haven't tried CRC deployment on Windows yet) |
@morningspace I tried accessing this from a ubuntu 16.04 machine with the oc command line. So I decided to configure dnsmasq with the hosts file option. And the line that you had mentioned in the hosts file worked perfectly for me with just the OC vm ip address. |
@jeffsaremi The only thing remained that I wonder is how people deal w/ multiple CRC instances running in the same network. Have you tried to use a different hostname other than But for the web console, what I learned is that I need to create OCP route, otherwise, I will have to create multiple IPs pointing to the same sort of hostnames, |
@morningspace
I have not used oc route and didn't know this existed. If you have more instructions let me know and I'll try. thanks |
@jeffsaremi I tried curl apiserver using hostname other than curl -kL https://<your_host_running_crc>:6443 But for
Just clone them and create your own by using your own hostname, it will work. |
@morningspace |
For what it's worth … I just came across this Red Hat blog entry that might also help: |
@ahaerpfer thanks for the article. Such elaborate set steps! It looks like we need another crc-like program just to access crc! |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
@tmckayus would you be able to assist @kowen in getting this document properly? (In reference to: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a) |
@gbraad sure I can help. Not sure what we've got in mind. |
@robin-owen ping on this ^^, is there something I can help with? |
@tmckayus Hi there! Apologies for the late response. I've been working on getting this particular story documented, but have no way to verify the steps that I've been documenting -- as such, we can't reasonably include this in the docs yet. Would you mind taking our conversation to email so that we can go through the steps you've outlined in your gist and convert that into documentation? |
for history, taking to email :)
|
This is based on the work of Trevor McKay published as a Gist: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a
This is based on the work of Trevor McKay published as a Gist: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a
This is based on the work of Trevor McKay published as a Gist: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a
This is based on the work of Trevor McKay published as a Gist: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a
This is based on the work of Trevor McKay published as a Gist: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a
This is based on the work of Trevor McKay published as a Gist: https://gist.github.com/tmckayus/8e843f90c44ac841d0673434c7de0c6a
Not working on CentOS 7 and haproxy-1.5.18-9.el7.x86_64. |
@morningspace How can apps-crc.testing be changed? Say, I want the URL to be openshift.example.com, how do I do that? Assuming openshift.example.com is already pointing to the machine that is running crc. |
@imperialguy crc's wiki has https://github.com/crc-org/crc/wiki/Change-the-domain-for-CRC but I don't know if these instructions are still current. |
I wrapped everything around an automated script to setup everything. Feel free to check it out: https://github.com/iLLeniumStudios/remote-crc-setup Aiming to make it more configurable via vars soon |
General information
crc setup
before starting it (Yes)?CRC version
CRC status
# Put the output of `crc status` CRC VM: Running OpenShift: Running (v4.x) Disk Usage: 13.68GB of 16.09GB (Inside the CRC VM) Cache Usage: 14.99GB Cache Directory: /home/morningspace/.crc/cache
Host Operating System
Steps to reproduce
After I deploy CRC on a linux server running in LAN. How can I access CRC web console, or apps deployed onto it (if any), from another machine in the same network?
It looks the current CRC is designed to be used on local machine. So, it has ways such as Network Manager for Linux or
/etc/hosts
+/etc/resolver/testing
for Mac to route requests outside to OpenShift running inside a VM. But it seems all happen on the same machine.On the other hand, the original
oc cluster up
has the ability to support cross-machine access, because it runs on the machine directly (w/o VM) and it depends on the simple public DNS servicenip.io
(by default).This seems to be the missing part in CRC? Or, if there's anything I missed.
I'd think this is a common usage scenario for dev/test/demo purpose at team level.
Expected
I can access CRC or apps deployed on CRC from another machine
Actual
I can only access it on the machine which is deployed CRC.
The text was updated successfully, but these errors were encountered: