Bug 1452700 - [RFE] only restrict routes DNS name to a subdomain based on project name regardless of route name
Summary: [RFE] only restrict routes DNS name to a subdomain based on project name rega...
Keywords:
Status: NEW
Alias: None
Product: OpenShift Online
Classification: Red Hat
Component: RFE
Version: 3.x
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: Abhishek Gupta
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-19 13:39 UTC by Aleksandar Kostadinov
Modified: 2022-05-09 08:33 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-07-12 15:59:38 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Aleksandar Kostadinov 2017-05-19 13:39:15 UTC
Description of problem:
Hi, as a user I would like to have a backend API and a frontend angular/whatever based running in separate pods. To avoid the need for special CORS setup it would be very hand if I can create two routes with same domain name but different paths.

In default configuration the hostname is bound to match route's name. Given that two routes cannot share the same name, it is impossible to do that.

IMO it would be safe to allow hostname to match any of the existing other route names in the project.

Version-Release number of selected component (if applicable):
3.4.x

How reproducible:
always

Steps to Reproduce:
$ oc expose svc testapp-ui --hostname=testapp-ns.example.com --path=/ui
route "testapp-ui" exposed
$ oc expose svc testapp --hostname=testapp-ns.example.com
route "testapp" exposed

Actual results:

$ oc get route
NAME             HOST/PORT                                       PATH      SERVICES         PORT      TERMINATION   WILDCARD
testapp   testapp-ns.example.com             testapp   http                    None
testapp-ui    testapp-ui-ns.example.com    /ui       testapp-ui    80                      None

Expected results:

$ oc get route
NAME             HOST/PORT                                       PATH      SERVICES         PORT      TERMINATION   WILDCARD
testapp   testapp-ns.example.com             testapp   http                    None
testapp-ui    testapp-ns.example.com    /ui       testapp-ui    80                      None

Comment 1 Ben Bennett 2017-07-12 15:59:38 UTC
You can disable the claims today: https://trello.com/c/jd6RksVX

But this is a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1344746

*** This bug has been marked as a duplicate of bug 1344746 ***

Comment 2 Aleksandar Kostadinov 2017-07-12 19:49:39 UTC
I don't think this is a duplicate. The other issue is to let multiple projects share a dns name with different paths.

This much simpler. It is about one project to restrict routes according to project name and probably route name but allow two or more routes to share same DNS name with different paths. This is without cluster admins getting involved.

In my opinion restricting routes to the project subdomain would be secure enough for the cluster. Let users control their sub-domains as they wish.

Comment 3 zhaozhanqi 2017-07-13 00:53:46 UTC
@ Aleksandar

you can enable ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK=true, like:

oc env dc router ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK=true

thus, you can create the route with same hostname and with different path in one project.

Comment 4 zhaozhanqi 2017-07-13 00:57:55 UTC
FYI, above feature only can work from 3.5 version since I saw you reported this bug on 3.4.

Comment 5 Aleksandar Kostadinov 2017-07-13 09:03:12 UTC
Oh, I see what you mean. Actually my request is to allow same domain different paths even when ROUTER_DISABLE_NAMESPACE_OWNERSHIP_CHECK is not used.

For example in Online environment, you cannot control that setting. And it would be stupid for administrators to disable the checks.

I see no value in restricting the subdomain name of routes to the route name. Restricting to be a subdomain of the project project is totally reasonable. But within the project subdomain, I see no value in restricting the users.

I hope this clarifies my request [1] and I don't think it is a duplicate of bug 1344746  so I'm reopening. If you believe this will be fixed as part of bug 1344746 though, feel free to close again.

[1] initially I asked for some mechanism to allow subdomain usage with different paths, but thinking more about it, I believe checking only project name vs DNS name makes more sense to me.

i.e.
> route_name = 'someroute'
> project_name = 'myproject'
> requested_dns_allowed = 'mysubdomain.myproject.default.domain.example.com'
> requested_dns_denied = 'mysubdomain.notmyproject.default.domain.example.com'


Note You need to log in before you can comment on or make changes to this bug.