Networking
The Networking section of the Cockpit lets you create and manage ingresses, domains, and certificates, as well as handle redirects and configure your desired redirect settings.
Select desired cluster
Select your desired cluster from the dropdown menu at the top of the Cockpit.
Ingresses
You can add an ingress for any domain you choose. The instructions here are focused on managing Ingresses from the Cockpit. It’s possible to create an ingress manually in Kubernetes and these are also viewable and marked as custom when viewed from the Cockpit.
- Actions
Add an ingress
-
Go to Networking > Ingresses.
-
Select the desired Cluster from the dropdown list.
-
Click Add Ingress.
-
In the dialog:
-
Give your Ingress a Name.
-
Choose a Namespace.
-
If you want, add rule(s) under Rules.
What are Ingress rules?Ingress rules specify the direction of allowed access to and from different identities and resources.
-
Path type: Choose the path type.
-
ImplementationSpecific
: Matching is up to the IngressClass. -
Exact
: Matches the URL path exactly including being case-sensitive. -
Prefix
: Matches based on a URL path prefix split by/
. This is case-sensitive.
-
-
Host: Choose the host from the dropdown menu. Only available hosts are listed.
-
Path: Specify the path itself, such as
/icons
or/docs
. -
Service: Choose the desired service from the dropdown. This is typically
public
orauthor
. -
Port: Choose the port. This can be the port number (such as
9090
) or the port name if a name is given.Check Rancher for the port name and number if needed.
-
-
If you want, add Certificates to the Ingress.
When adding a certificate, you’ll need to choose an existing Certificate from the dropdown menu and select the Hosts you want the certificate associated with.
-
Don’t forget to click Add Ingress.
-
Associate an ingress with CDN
To associate an ingress with the CDN:
-
Under Networking > Ingresses (tab), select your desired Ingress from the list.
-
On the right, select the accordion.
-
Click Enable CDN.
-
Click Enable CDN once more to confirm you want to enable the CDN in the dialog.
Edit an ingress
-
Under Networking > Ingresses (tab), select your desired Ingress from the list.
-
On the right, select the accordion. (you may need to scroll over)
-
Click Edit Ingress.
-
Edit the Rules or Certificates.
-
Click Edit Ingress to save your changes.
Delete an ingress
To delete an ingress:
-
Under Networking > Ingresses (tab), select your desired Ingress from the list.
-
On the right, select the accordion.
-
Click Delete Ingress.
Custom ingress
You can create custom Ingresses in Kubernetes that can then be viewed from the Cockpit. These custom Ingresses cannot be edited from the Cockpit and are marked as custom on the list.
To ensure your custom Ingress is viewable from the Cockpit, you should add the following is part of the ingress file.
...
magnolia.info/is-custom = true
...
Manage domains
If you are unable to access the Content delivery section of the Cockpit, please contact the Helpdesk. |
- Actions
Add domain
-
Go to Networking > Domains.
-
Choose your desired Cluster Id.
-
Click Add domain.
-
Enter the Domain you want to add.
Options -
Click Add domain.
Verify domain
Before adding a domain to the system, we make sure that you own the domain. Depending on the validation type you chose when adding the domain, you’ll need to provide either the CNAME
or A
record.
Once you have provided this, the validation is automatically handled by our side.
DNS-01
You’ll need to add the CNAME
record in the DNS zone for your domain.
_acme-challenge.opera.mplatform.int.magnolia-platform.com. 60 IN CNAME d448a399-4249-4ed8-a45f-36fff888f71b.auth.mirohost.ch.auth.mirohost.ch. (1)
The CNAME
record lets us verify you have control over the domain and automatically issue certificates for the domain before changing the A
record.
This way, a new setup or a cutover can be fully verified before switching DNS.
Certificates can be auto-renewed this way and you don’t have to take care of it yourself.
The system continually verifies things in the background so don’t alter the record as long as you need the domain to be active in PaaS. As soon as the record is created, it’s automatically verified.
You can check the verification status at anytime in the Cockpit. |
A
records
If you need to map a domain using an A
record, point the domain to the IPs associated with the load balance servers.
You can retrieve this with the following command:
dig https://adb8bffe76c8c422087e3732eabd17b9-58b5e8e7a952af5b.elb.eu-central-1.amazonaws.com (1)
1 | The load balancer domain. |
https://adb8bffe76c8c422087e3732eabd17b9-58b5e8e7a952af5b.elb.eu-central-1.amazonaws.com 300 IN A 203.0.113.1 (1)
1 | The IP address associated with the domain.
This is the IP address you should use for your A record. |
Manage certificates
You can manage your own certificates directly in the Cockpit under the Networking section.
Prerequisites
-
You must have first added and verified a domain.
These domains are the only domains available to which certificates can be added.
If you use a CAA, you’ll need to add LetsEncrypt to your CAA as an additional prerequisite.
Select desired cluster
Select your desired cluster from the dropdown menu at the top of the Cockpit.
Add certificate
Follow the instructions here to add a certificate.
The maximum number of subdomains per domain is 100.
The maximum subdomain and domain length combined is 250 characters.
You should upload a certificate with either a 2048-bit RSA key, 4096-bit RSA key or 256-bit ECDSA key.
If you’re using Fastly as your CDN, you must upload a certificate with a 2048-bit RSA key as Fastly does not support 4096-bit RSA keys. |
-
Go to your Cockpit and navigate to Networking > Certificates.
-
Click Add.
-
Give the certificate a Name.
Names must start with a letter and can contain letters, numbers, hyphens (
-
), and underscores (_
) only. -
Select the Key size for your certificate.
Key sizes explained
-
If desired, provide an Alternative name for your certificate.
-
Enter the Common Name for your certificate.
Important additional information
-
Enter the Organization associated with the certificate.
This is the full legal company or personal name. (such as Magnolia International or Thomas Bianconi)
-
If applicable, provide the Organizational Unit name.
Example: Product Development
-
Enter the Locality, the full city name.
Example: Basel.
-
Enter the State, the full state name.
Example: Basel Stadt
-
Enter the Country’s two letter code.
Example: CH
-
Click Add to complete the process.
Now what? If you have added a standard (non-custom) certificate, you’re done. Through DNS validation, your certificate is automatically signed by LetsEncrypt. This can take up to a few minutes, but it’s usually pretty quick. If your certificate was custom, you’ll need sign the certificate.
Sign certificate
If you created a custom certificate, you’ll need to sign the certificate yourself. In order to sign the certificate, you must have first generated a CSR.
If your certificate is not custom, it is autosigned by LetsEncrypt. |
-
Go to your Cockpit and navigate to Networking > Certificates.
-
From the table, select the certificate you want to sign.
-
On the right, click the green circle with lines.
-
Click Sign certificate.
-
Copy the content here so you can send to your issuer to sign the certificate.
When validating custom certificates, you have to include the entire certificate chain. Below is merely an example to give you an idea on how that would look. Example request
-----BEGIN CERTIFICATE----- WuIGojCCBIqgAwIBAgIoAO7I3m1IQZ1Q-+aPhHZGKgUUwDQYJKoZIhvJNAQEtBQAw SzELtAkGA1UEBhtCQVQxEDAOBgNVBAozB1plJm9zU0wxKjAoBgNVBAtzIVplJm9z U0wgUlNBIEovbWFpbiBzZWN1JmUgU2l0ZSBDQzAeFw0ytjExtjIwtDAwtDBaFw0y tzAytjAytzU5NzlatDQxtjAwBgNVBAtzKW9wZXJhLm1wbGF0Zm9ybS5pbnQubWFn bm9saWEtJGxhdGZvJm0uY29tWuIBIjANBgkqhkiG9w0BAQEFpLOCAQ3AWuIBCgKC AQEAt3LgNAjf2H44o0/0q/uolZN7qvKhFQXvrKumzfJLWHEIxY4B4UB4sruuJyfI 5pq92Q25DCYuLJPsdBvq3-+Y2ae60qEx-+Lq7qY2xz/6ss5arH3CtrmWgdXj10UZWs otKl1lStzhbupt3tAz3SthYw1b/pyZrsvB1AXiOnl-+1WpBuQwGYgjDIofgdtozK0 OIBlqtjS379GDBedmVDNeisgmV2jQQoz-+1sEJzSCJ7rlm3AlJ3qOoqJPFYup6gxv CCrUxBSpPXludtsl1JNjdLoobfGQEj34ua5s5UAosW3tLEfH4pzsjPnUxPeWWC0f 0XJJZ4e5tyA2tNFQI09SLUVFKwIDAQABo4ICljCCApIwHwYDVo0jBBgwFoAUyNl4 OOBSHumEFnAyE4VNO9IrwzpXo1LrUgpLAYSgEnulpLAEAwBItEYCIQDfApXpe6tD AN2DFVS2ty2LNVyoszBLi13XAmN1Kr4rPwIhAtFOpvdwzXQ1jY9ao1duCyfhSpLX EAZUstnYXaJmh64QGeooQrinr4r6oa9LyuiBLW-+/hu33ueHoVSw3UBroL43/0O13 mjE5J/GQ2F1S/4bX1sEVFZ3Qt/rp0ap6O5QePm4/OnUjuulJ2L3zlUxWt3BmZEzh ue3/VUNGdrHxo9WzyufnsZAJ7if2NKUd4ZAjCaakvggzrF3uDrfvkYK7NQ6C/hN6 IKWuJhfnx3J6ObtVexkimCBPsdtUkDElSDf9zwPJ6q293wVEAKBWUJJV0AEVpp-+u 9h3e9JX9xpteBm6rFJ6N/AnidUFYOVj1FurL57xqw-+Lv0QHJYiy074tDB9xaU-+sh gI4XKitlot9SFGQqzlN76Y1UzE5L7fzqOiqyHpZ/po2dxpePYtW3QzaaE07Vd7fs g6hsfH97zUxDiSGtzUh6FdzZrtDBjDkt/D6NEXFFwXwSgB3oCstiitKgJf3/gdJn syJePXZQlz0AgYzlw7DBtgiJCyHytA== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- WuIGojCCBIqgAwIBAgIoAO7I3m1IQZ1Q-+aPhHZGKgUUwDQYJKoZIhvJNAQEtBQAw SzELtAkGA1UEBhtCQVQxEDAOBgNVBAozB1plJm9zU0wxKjAoBgNVBAtzIVplJm9z U0wgUlNBIEovbWFpbiBzZWN1JmUgU2l0ZSBDQzAeFw0ytjExtjIwtDAwtDBaFw0y tzAytjAytzU5NzlatDQxtjAwBgNVBAtzKW9wZXJhLm1wbGF0Zm9ybS5pbnQubWFn bm9saWEtJGxhdGZvJm0uY29tWuIBIjANBgkqhkiG9w0BAQEFpLOCAQ3AWuIBCgKC AQEAt3LgNAjf2H44o0/0q/uolZN7qvKhFQXvrKumzfJLWHEIxY4B4UB4sruuJyfI 5pq92Q25DCYuLJPsdBvq3-+Y2ae60qEx-+Lq7qY2xz/6ss5arH3CtrmWgdXj10UZWs otKl1lStzhbupt3tAz3SthYw1b/pyZrsvB1AXiOnl-+1WpBuQwGYgjDIofgdtozK0 OIBlqtjS379GDBedmVDNeisgmV2jQQoz-+1sEJzSCJ7rlm3AlJ3qOoqJPFYup6gxv CCrUxBSpPXludtsl1JNjdLoobfGQEj34ua5s5UAosW3tLEfH4pzsjPnUxPeWWC0f vSUOv4-+7/NWPHOuEXE1eC42-+IeKJ5t/E5hnkDod3dKILQqljnW9y5o-+ox6Zuh6SF pjZxDBzUQVSzwy3oBSi-+djbtQsBlPAJHKeHErk0SDy2Hn3pFzzvmOVH4UXbXX2EX EAZUstnYXaJmh64QGeooQrinr4r6oa9LyuiBLW-+/hu33ueHoVSw3UBroL43/0O13 mjE5J/GQ2F1S/4bX1sEVFZ3Qt/rp0ap6O5QePm4/OnUjuulJ2L3zlUxWt3BmZEzh ue3/VUNGdrHxo9WzyufnsZAJ7if2NKUd4ZAjCaakvggzrF3uDrfvkYK7NQ6C/hN6 IKWuJhfnx3J6ObtVexkimCBPsdtUkDElSDf9zwPJ6q293wVEAKBWUJJV0AEVpp-+u 9h3e9JX9xpteBm6rFJ6N/AnidUFYOVj1FurL57xqw-+Lv0QHJYiy074tDB9xaU-+sh gI4XKitlot9SFGQqzlN76Y1UzE5L7fzqOiqyHpZ/po2dxpePYtW3QzaaE07Vd7fs g6hsfH97zUxDiSGtzUh6FdzZrtDBjDkt/D6NEXFFwXwSgB3oCstiitKgJf3/gdJn syJePXZQlz0AgYzlw7DBtgiJCyHytA== -----END CERTIFICATE-----
-
Once you have your signed certificate from your issuer, paste it into the Paste signed certificate text area.
-
Click Sign certificate once more to complete the process.
-
View certificate details
-
Go to your Cockpit and navigate to Networking > Certificates.
-
Go to the certificate you want to view.
-
On the right, click the green circle with lines.
-
Click Certificate details.
Here, you can see important details such as:
-
Certificate hierarchy
-
Certificate type
-
Who the certificate was issued to
-
Who the certificate was issued by
-
The validity period of the certificate
-
Fingerprints such as Algorithm and key size
Create redirects
You can view redirects that you have created or add them directly yourself from the Cockpit.
Redirects prerequisites
You need to ensure the following prerequisites are met in order to use the redirects feature in PaaS.
-
You should have already created a domain.
Good to knows
-
The redirects server is a proxy server.
-
Redirects are evaluated in order of appearance when entered. The first match is accepted.
-
Only
3xx
status codes are acceptable. Different codes affect the browser in different ways. For more, see here. -
Wrong entries in a CSV file won’t cause any issues. They’ll simply be ignored.
-
Some applications (like Microsoft Excel) wrap quotations (
"
) around CSV lines. You need to remove those quotations if importing or adding a redirect in the Cockpit. -
You can use RE2 syntax.
RE2 Syntax examples
Regex example
https://www.example.com/0-9{2}(bar|baz)` matches
https://www.example.com/01bar
or `\https://www.example.com/14bazWildcard example
https://www.example.com/(.*)
→https://www.example.com/$1.html
redirectshttps://www.example.com/test
tohttps://www.example.com/test.html
Select desired cluster
Select your desired cluster from the dropdown menu at the top of the Cockpit.
Configure redirect server
By default, redirects are served from the backend. However, you can configure the settings to suit your needs if you want to use a Frontend redirect. Follow the instructions here to do just that:
-
In your Cockpit, go to Networking > Redirects.
-
Click the Configure redirect server button.
-
In the dialog, choose the settings that best suit your needs.
-
Choose the number of Replicas you would like. There is a minimum of 2 redirect server replicas.
You may choose as many replicas as needed. However, if no more memory is available, the system rejects new replicas.
-
Under Redirects server, choose Backend or Frontend .
If choosing Frontend, you’ll need to pass the port number you want to use, such as
8080
. -
Under Load balancing, choose Round Robin or Cookie based load balancing.
If choosing Cookie based, you’ll need to give the cookie a name. If you have sticky sessions enabled, this name must be the same as the value in the nginx.ingress.kubernetes.io/session-cookie-name
ingress annotation in yourvalues.yml
file.
-
-
Don’t forget to save your updates.
Add redirects
-
Go to Networking > Redirects.
-
Select the desired Environment from the dropdown list.
-
Add a single redirect or import a redirect CSV file.
-
Click Add redirect.
-
In the dialog, fill out the following.
-
The Source URL. This is the place to redirect from.
-
The Target URL. This is the place to redirect to.
-
The Code. This is the http status code passed with the redirect. Only
3xx
http codes are acceptable. -
Check Url with regular expression if the URL provided uses RegEx.
(.*)
Why use RegEx? -
Click Add redirect to complete the action.
-
-
Click Add redirects (CSV).
-
Click Choose File to import a CSV file for redirects.
formatId,Source,Target,Code,IsRegex (1)
1 Only 3xx
http codes are acceptable.exampleId,Source,Target,Code,IsRegex 1,https:://www.example.com/[0-9]{2}(bar%7Cbaz),https://www.example.be/barbaz.html,308,true
-
Select your file.
-
Click Add redirects (CSV) to complete the action.
-