NGINX

This section provides information about how to install and configure the ingress-based NGINX load balancer to load balance Oracle WebCenter Content domain clusters. You can configure NGINX for non-SSL, SSL termination, and end-to-end SSL access of the application URL.

Follow these steps to set up NGINX as a load balancer for an Oracle WebCenter Content domain in a Kubernetes cluster:

See the official installation document for prerequisites.

To get repository information, enter the following Helm commands:

  $ helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
  $ helm repo update

Non-SSL and SSL termination

Install the NGINX load balancer

  1. Deploy the ingress-nginx controller by using Helm on the domain namespace:

     $ helm install nginx-ingress -n wccns \
            --set controller.service.type=NodePort \
            --set controller.admissionWebhooks.enabled=false \
              ingress-nginx/ingress-nginx 
    
    Click here to see the sample output.
  2. Check the status of the deployed ingress controller:

    $ kubectl --namespace wccns get services | grep ingress-nginx-controller
    

    Sample output:

     nginx-ingress-ingress-nginx-controller    NodePort    10.97.189.122    <none>            80:30993/TCP,443:30232/TCP    7d2h
    

Configure NGINX to manage ingresses

  1. Create an ingress for the domain in the domain namespace by using the sample Helm chart. Here path-based routing is used for ingress. Sample values for default configuration are shown in the file ${WORKDIR}/charts/ingress-per-domain/values.yaml. By default, type is TRAEFIK, tls is Non-SSL, and domainType is wccinfra. These values can be overridden by passing values through the command line or can be edited in the sample file values.yaml. If needed, you can update the ingress YAML file to define more path rules (in section spec.rules.host.http.paths) based on the domain application URLs that need to be accessed. Update the template YAML file for the NGINX load balancer located at ${WORKDIR}/charts/ingress-per-domain/templates/nginx-ingress.yaml

    $ cd ${WORKDIR}
    $ helm install wccinfra-nginx-ingress charts/ingress-per-domain \
    --namespace wccns \
    --values charts/ingress-per-domain/values.yaml \
    --set "nginx.hostname=$(hostname -f)" \
    --set type=NGINX \
    --set tls=NONSSL
    

    Sample output:

    NAME: wccinfra-nginx-ingress
    LAST DEPLOYED: Sun Feb  7 23:52:38 2021
    NAMESPACE: wccns
    STATUS: deployed
    REVISION: 1
    TEST SUITE: None
    
  2. For secured access (SSL) to the Oracle WebCenter Content application, create a certificate and generate a Kubernetes secret:

     $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/tls1.key -out /tmp/tls1.crt -subj "/CN=*"
     $ kubectl -n wccns create secret tls domain1-tls-cert --key /tmp/tls1.key --cert /tmp/tls1.crt
    
  3. Install ingress-per-domain using Helm for SSL configuration:

     $ cd ${WORKDIR}
     $ helm install wccinfra-nginx-ingress charts/ingress-per-domain \
         --namespace wccns \
         --values charts/ingress-per-domain/values.yaml \
         --set "nginx.hostname=$(hostname -f)" \
         --set "nginx.hostnameorip=$(hostname -f)" \
         --set type=NGINX --set tls=SSL
    

    Sample output:

     NAME: wccinfra-nginx-ingress
     LAST DEPLOYED: Mon Feb  8 00:01:13 2021
     NAMESPACE: wccns
     STATUS: deployed
     REVISION: 1
     TEST SUITE: None
    
  4. For non-SSL access or SSL to the Oracle WebCenter Content application, get the details of the services by the ingress:

      $ kubectl describe ingress wccinfra-nginx  -n wccns
    
    Click here to see the sample output of the services supported by the above deployed ingress.

Verify non-SSL and SSL termination access

Non-SSL configuration

Verify that the Oracle WebCenter Content domain application URLs are accessible through the LOADBALANCER-Non-SSLPORT:

  http://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/weblogic/ready
  http://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/console
  http://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/em
  http://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/cs
  http://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/ibr
  http://${LOADBALANCER_HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/imaging
  http://${LOADBALANCER_HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/dc-console
  http://${LOADBALANCER_HOSTNAME}:${LOADBALANCER-Non-SSLPORT}/wcc  
SSL configuration

Verify that the Oracle WebCenter Content domain application URLs are accessible through the LOADBALANCER-SSLPORT:

  https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/weblogic/ready
  https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/console
  https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/em
  https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/cs
  https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/ibr
  https://${LOADBALANCER_HOSTNAME}:${LOADBALANCER-SSLPORT}/imaging
  https://${LOADBALANCER_HOSTNAME}:${LOADBALANCER-SSLPORT}/dc-console
  https://${LOADBALANCER_HOSTNAME}:${LOADBALANCER-SSLPORT}/wcc

Uninstall the ingress

Uninstall and delete the ingress-nginx deployment:

  $ helm delete wccinfra-nginx -n wccns

End-to-end SSL configuration

Install the NGINX load balancer for End-to-end SSL

  1. For secured access (SSL) to the Oracle WebCenter Content application, create a certificate and generate secrets:

     $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/tls1.key -out /tmp/tls1.crt -subj "/CN=*"
     $ kubectl -n wccns create secret tls domain1-tls-cert --key /tmp/tls1.key --cert /tmp/tls1.crt
    
  2. Deploy the ingress-nginx controller by using Helm on the domain namespace:

     $ helm install nginx-ingress -n wccns \	 
     --set controller.extraArgs.default-ssl-certificate=wccns/domain1-tls-cert \
     --set controller.service.type=NodePort \
     --set controller.admissionWebhooks.enabled=false \
     --set controller.extraArgs.enable-ssl-passthrough=true \
     ingress-nginx/ingress-nginx
    
    Click here to see the sample output.
  3. Check the status of the deployed ingress controller:

     $ kubectl --namespace wccns get services | grep ingress-nginx-controller
    

    Sample output:

      nginx-ingress-ingress-nginx-controller   NodePort    10.97.189.122    <none>            80:30993/TCP,443:30232/TCP    168m
    

Deploy tls to access individual Managed Servers

  1. Deploy tls to securely access the services. Only one application can be configured with ssl-passthrough. A sample tls file for NGINX is shown below for the service wccinfra-cluster-ucm-cluster and port 16201. All the applications running on port 16201 can be securely accessed through this ingress. For each backend service, create different ingresses as NGINX does not support multiple path/rules with annotation ssl-passthrough. That is, for wccinfra-cluster-ucm-cluster, wccinfra-cluster-ibr-cluster, wccinfra-cluster-ipm-cluster, wccinfra-cluster-capture-cluster, wccinfra-cluster-wccadf-cluster and wccinfra-adminserver, different ingresses must be created.

    Note: There is a limitation with load-balancer in end-to-end SSL configuration - accessing multiple types of servers (different Managed Servers and/or Administration Server) at the same time, is currently not supported. We can access only one Managed Server at a time.

     $ cd ${WORKDIR}/charts/ingress-per-domain/tls
    

    Sample nginx-ucm-tls.yaml:

Click here to see the content of the file nginx-ucm-tls.yaml

Note: host is the server on which this ingress is deployed.

  1. Deploy the secured ingress:

    $ cd ${WORKDIR}/charts/ingress-per-domain/tls
    $ kubectl create -f nginx-ucm-tls.yaml
    
  2. Check the services supported by the ingress:

    $ kubectl describe ingress wcc-ucm-ingress -n wccns
    
    Click here check the services supported by the ingress.

Verify end-to-end SSL access

Verify that the Oracle WebCenter Content domain application URLs are accessible through the LOADBALANCER-SSLPORT:

   https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/cs

Deploy tls to access Administration Server

  1. As ssl-passthrough in NGINX works on the clusterIP of the backing service instead of individual endpoints, you must expose adminserver service created by the WebLogic Kubernetes Operator with clusterIP.

    For example:

    a. Get the name of Administration Server service:

      $ kubectl get svc -n wccns | grep wccinfra-adminserver
    

    Sample output:

      wccinfra-adminserver  ClusterIP   None  <none>   7001/TCP,7002/TCP  7
    

    b. Expose the Administration Server service wccinfra-adminserver and use the new service name wccinfra-adminserver-nginx-ssl:

     $ kubectl expose svc wccinfra-adminserver -n wccns --name=wccinfra-adminserver-nginx-ssl --port=7002
    

    c. Deploy the secured ingress:

    Sample nginx-admin-tls.yaml:

    Click here to see the content of the file nginx-admin-tls.yaml

    Note: host is the server on which this ingress is deployed.

     $ cd ${WORKDIR}/charts/ingress-per-domain/tls
     $ kubectl create -f nginx-admin-tls.yaml
    

Verify end-to-end SSL access

Verify that the Oracle WebCenter Content Administration Server URL is accessible through the LOADBALANCER-SSLPORT:

https://${LOADBALANCER-HOSTNAME}:${LOADBALANCER-SSLPORT}/console

Uninstall ingress-nginx tls

$ cd ${WORKDIR}/charts/ingress-per-domain/tls
$ kubectl  delete -f nginx-ucm-tls.yaml

Uninstall the NGINX

//Uninstall and delete the `ingress-nginx` deployment
$ helm delete wccinfra-nginx-ingress -n wccns
  
//Uninstall NGINX
$ helm delete nginx-ingress -n wccns