Skip to content

OWLS-92959: Doc: kubectl port-forward does not allow to access thru WLST in istio-domain for Istio version previous to 1.10 #2713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jan 13, 2022
Merged

OWLS-92959: Doc: kubectl port-forward does not allow to access thru WLST in istio-domain for Istio version previous to 1.10 #2713

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dad7455
Update documentation for port-forward for wlst
lennyphan Jan 12, 2022
62a4d01
Add example snippets for domain home types
lennyphan Jan 12, 2022
4831cc3
first update based on review
lennyphan Jan 13, 2022
b4e92f2
add additional doc updates
lennyphan Jan 13, 2022
81d3e8e
minor edits from review
lennyphan Jan 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 46 additions & 6 deletions ...staging/content/userguide/managing-domains/accessing-the-domain/port-forward.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,20 +62,60 @@ This behavior depends on your version and domain resource configuration:
command or see the domain resource
[schema](https://github.com/oracle/weblogic-kubernetes-operator/blob/main/documentation/domains/Domain.md).

* For Istio-enabled domains running Istio versions prior to 1.10,
the operator already adds a
network channel with a `localhost` listen address for each
existing port. This means that no additional configuration is required
to enable port forwarding when Istio is enabled.
* If WLST access is required for Istio-enabled domains running Istio versions prior to 1.10,
you must add an additional network channel to the WebLogic Administration Server
Copy link
Member

@ankedia ankedia Jan 13, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the additional network channel still needed if user only wants to access console (and not WLST)? I think WLST use-case is not very common and we may want to mention about the additional channel only when WLST access is required.

Copy link
Member Author

@lennyphan lennyphan Jan 13, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, it's not needed if user only wants to access using console. We can update the description to include if online WLST access is required. It is becoming very confusing with all these restrictions so I omitted it as the additional network channel works for both console and online WLST.

Copy link

@tbarnes-us tbarnes-us Jan 13, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer to be very exact - IMO, it's more confusing not to mention that this is only needed for WLST (but happens to work for console too) - especially as it's more convenient for those that just need console access to skip the extra "configure a NAP step". Please do include the extra wording.

configured with the following attributes:
* Protocol defined as `t3`.
* Listen address defined with `localhost`. (Note: Setting the address to localhost is solely
for self-documenting purposes. The address can be set to any value, and the operator will override
it to the required value.)
* Listen port. Note: Choose a port value that does not conflict with any ports defined
in any of the additional network channels created for use with Istio versions prior to v1.10.
For more details, see [Added network channels for Istio versions prior to v1.10]({{< relref "/userguide/istio/istio#added-network-channels-for-istio-versions-prior-to-v110" >}}).
* Enable `HTTP` protocol for this network channel.
* Do _NOT_ set an `external listen address` or `external listen port`.

{{% notice note %}}
For Istio-enabled domains running Istio versions prior to 1.10, if console only access is required,
then it is not necessary to add an additional network channel to the WebLogic Administration Server.
{{% /notice %}}

Copy link
Contributor

@rosemarymarano rosemarymarano Jan 13, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggested re-write:
"For Istio-enabled domains running Istio
versions prior to 1.10, if console only access is required, then it is not necessary to add an additional network channel to the WebLogic Administration Server."

For example, here is a snippet of a WebLogic domain `config.xml` file for channel `PortForward` for the Administration Server.
```xml
<server>
<name>admin-server</name>
<network-access-point>
<name>PortForward</name>
<protocol>t3</protocol>
<listen-address>localhost</listen-address>
<listen-port>7890</listen-port>
<http-enabled-for-this-protocol>true</http-enabled-for-this-protocol>
</network-access-point>
</server>
```
For Model in Image (MII) and Domain in Image (DII), here is a snippet model configuration for channel `PortForward` for the Administration Server.
```yaml
topology:
...
Server:
'admin-server':
ListenPort: 7001
NetworkAccessPoint:
PortForward:
Protocol: 't3'
ListenAddress: 'localhost'
ListenPort: '7890'
HttpEnabledForThisProtocol: true
```

{{% notice note %}}
If your domain is already running, and you have made configuration changes,
then you will need to rerun its introspector job and ensure that the admin pod
restarts for the configuration changes to take effect.
{{% /notice %}}

When administration channel port forwarding is enabled,
If Istio is _not_ enabled on the domain or for Istio enabled domains running
Istio 1.10 and later, when administration channel port forwarding is enabled,
the operator automatically adds the following network channels
(also known as Network Access Points) to the WebLogic Administration Server Pod:

Expand Down