diff --git a/modules/installation-guide/nav.adoc b/modules/installation-guide/nav.adoc index a895df0f89..ae87fb4a45 100644 --- a/modules/installation-guide/nav.adoc +++ b/modules/installation-guide/nav.adoc @@ -45,7 +45,7 @@ ** xref:deploying-che-with-support-for-git-repositories-with-self-signed-certificates.adoc[] ** xref:installing-che-using-storage-classes.adoc[] ** xref:importing-untrusted-tls-certificates.adoc[] -** xref:switching-between-external-and-internal-communication.adoc[] +** xref:configuring-communication-between-che-components.adoc[] ** xref:setting-up-the-keycloak-che-username-readonly-theme-for-the-eclipse-che-login-page.adoc[] ** xref:mounting-a-secret-as-a-file-or-an-environment-variable-into-a-container.adoc[] ** xref:enabling-dev-workspace-engine.adoc[] diff --git a/modules/installation-guide/pages/configuring-communication-between-che-components.adoc b/modules/installation-guide/pages/configuring-communication-between-che-components.adoc new file mode 100644 index 0000000000..35df91d02b --- /dev/null +++ b/modules/installation-guide/pages/configuring-communication-between-che-components.adoc @@ -0,0 +1,6 @@ +[id="configuring-communication-between-che-components"] +:navtitle: Configuring communication between Che components +:keywords: installation-guide +:page-aliases: .:configuring-communication-between-che-components, .:switching-between-external-and-internal-communication, switching-between-external-and-internal-communication + +include::partial$proc_configuring-communication-between-che-components.adoc[] diff --git a/modules/installation-guide/pages/switching-between-external-and-internal-communication.adoc b/modules/installation-guide/pages/switching-between-external-and-internal-communication.adoc deleted file mode 100644 index 3949356b8f..0000000000 --- a/modules/installation-guide/pages/switching-between-external-and-internal-communication.adoc +++ /dev/null @@ -1,7 +0,0 @@ -[id="switching-between-external-and-internal-communication"] -// = Configuring Labels -:navtitle: Switching between external and internal ways in inter-component communication -:keywords: installation-guide -:page-aliases: .:switching-between-external-and-internal-communication - -include::partial$proc_switching-between-external-and-internal-communication.adoc[] diff --git a/modules/installation-guide/partials/assembly_advanced-configuration.adoc b/modules/installation-guide/partials/assembly_advanced-configuration.adoc index eab39ba0ef..db38af886c 100644 --- a/modules/installation-guide/partials/assembly_advanced-configuration.adoc +++ b/modules/installation-guide/partials/assembly_advanced-configuration.adoc @@ -36,7 +36,7 @@ The next sections describe some specific user stories. * xref:importing-untrusted-tls-certificates.adoc[] -* xref:switching-between-external-and-internal-communication.adoc[] +* xref:configuring-communication-between-che-components.adoc[] * xref:setting-up-the-keycloak-che-username-readonly-theme-for-the-eclipse-che-login-page.adoc[] diff --git a/modules/installation-guide/partials/proc_configuring-communication-between-che-components.adoc b/modules/installation-guide/partials/proc_configuring-communication-between-che-components.adoc new file mode 100644 index 0000000000..ea16affd5d --- /dev/null +++ b/modules/installation-guide/partials/proc_configuring-communication-between-che-components.adoc @@ -0,0 +1,65 @@ +[id="configuring-communication-between-{prod-id-short}-components_{context}"] += Configuring communication between {prod-short} components + +You can select whether {prod-short} components communicate by using the internal network or external {platforms-ingress}. + +By default, {prod-short} components communicate by using the internal network. {prod-short} components use their internal services names, which are exposed in the internal {platforms-name} network. + +As the administrator, disable the use of the internal services names to force the {prod-short} components to use external {platforms-ingress} in the following situations: + +* To deploy {prod-short} on a cluster where NetworkPolicies restricts communications between namespaces. +* To deploy {prod-short} with the multitenant network plugin. + +[IMPORTANT] +==== +Using the external {platforms-ingress} might slow the traffic and lead to issues because it uses proxies, certificates, and firewalls. +==== + +.Prerequisites + +* An instance of {prod-short} running on {platforms-name}. + +.Procedure + +* In the CheCluster Custom Resource server settings, for the `disableInternalClusterSVCNames` property, set `____` to: +[horizontal] +`true`:: To use external {platforms-ingress}. +`false`:: To use internal {orch-name} DNS names. + ++ +==== +[source,yaml,subs="+quotes"] +---- +apiVersion: org.eclipse.che/v1 +kind: CheCluster +# ... +spec: + server: + # ... + disableInternalClusterSVCNames: ____ +---- +==== + +.Verification steps +. Specify {prod-short} as the default project: ++ +[subs="+quotes,attributes"] +---- +$ {orch-cli} project {prod-namespace} +---- +. Inspect the ConfigMap properties to determine which communication method {prod-short} uses: ++ +[subs="+quotes,attributes,macros"] +---- +$ {orch-cli} get configmap che -o \ +jsonpath='{.data.pass:[CHE_KEYCLOAK_AUTH__INTERNAL__SERVER__URL]}' +$ {orch-cli} get configmap che -o \ +jsonpath='{.data.pass:[CHE_WORKSPACE_PLUGIN__REGISTRY__INTERNAL__URL]}' +---- +* If {prod-short} components communicate internally, the output is following: ++ +---- +http://keycloak.eclipse-che.svc:8080/auth +http://plugin-registry.eclipse-che.svc:8080/v3 +---- +* Otherwise, if the components communicate externally, the output is empty. diff --git a/modules/installation-guide/partials/proc_switching-between-external-and-internal-communication.adoc b/modules/installation-guide/partials/proc_switching-between-external-and-internal-communication.adoc deleted file mode 100644 index b4bb48c46c..0000000000 --- a/modules/installation-guide/partials/proc_switching-between-external-and-internal-communication.adoc +++ /dev/null @@ -1,73 +0,0 @@ -// Module included in the following assemblies: -// -// advanced-configuration - -[id="switching-between-external-and-internal-communication_{context}"] -= Switching between external and internal DNS names in inter-component communication - -By default, new {prod-short} deployments use {orch-name} services DNS names for communications between {prod-short} server, {identity-provider}, registries, and helps with: - -* Bypassing proxy, certificates, and firewalls issues -* Speeding up the traffic - -This type of communication is an alternative to the external method of inter-component communication, which uses {platforms-ingress} cluster host names. In the situations described below, using {orch-name} internal DNS names is not supported. By disabling the use of the internal cluster host name in inter-component communication, the communication using external {platforms-ingress} will come into effect. - -.Internal inter-component communication restrictions in {platforms-name} - -* The {prod-short} components are deployed across multicluster {platforms-name} environments. -* The {orch-name} NetworkPolicies restricts communication between namespaces. - -The following section describes how to enable and disable the external inter-component communication for {platforms-ingress}. - - -.Prerequisites - -* The `{orch-cli}` tool is available. -* An instance of {prod-short} running in {platforms-name}. - - -.Procedure - -Switching between external and internal inter-component communication method is reached through the update against Custom Resource (CR). - -ifeval::["{project-context}" == "che"] -* For {prod-short} deployed using Operators -endif::[] -. To use external {platforms-ingress} in inter-component communication: -+ -[subs="+quotes,+attributes"] ----- -$ {orch-cli} patch checluster/{prod-checluster} -n {prod-namespace} --type=json -p \ -'[{"op": "replace", "path": "/spec/server/disableInternalClusterSVCNames", "value": true}]' ----- - -. To use internal {orch-name} DNS names in the inter-component communication: -+ -[subs="+quotes,+attributes"] ----- -$ {orch-cli} patch checluster/{prod-checluster} -n {prod-namespace} --type=json -p \ -'[{"op": "replace", "path": "/spec/server/disableInternalClusterSVCNames", "value": false}]' ----- - -ifeval::["{project-context}" == "che"] -* For {prod-short} deployed using a Helm Chart - -. Clone the https://github.com/eclipse-che/che-server[{prod-short} server] project -. Go to `deploy/kubernetes/helm/che` directory -. Update the `global.useInternalClusterSVCNames` property. To do that, add the following option to the `helm upgrade` command: -- To use external {platforms-ingress} in inter-component communication: -+ -[subs="+quotes,+attributes"] ----- -$ helm upgrade che -n {prod-namespace} --set global.useInternalClusterSVCNames=false \ --f values/multi-user.yaml -f values/tls.yaml . ----- -- To use internal {orch-name} DNS names in the inter-component communication: -+ -[subs="+quotes,+attributes"] ----- -$ helm upgrade che -n {prod-namespace} --set global.useInternalClusterSVCNames=true \ --f values/multi-user.yaml -f values/tls.yaml . ----- -NOTE: if {prod} has been deployed in single-host mode or without TLS then remove the corresponding flags from the `helm upgrade` command and add others if needed. -endif::[]