OpenShift: how to create a host alias

3
votes

I have an external TLS-enabled service that I want my pods to access

https://abc.myservice.acme

abc.myservice.acme resolves to 1.2.3.4. I wish to override this IP address with another (say 5.6.7.8) for the pods to use.

I would add an entry for each pod's /etc/hosts to override the IP address, but I have a feeling that it is an anti-pattern and there's probably a better way of doing this.

I investigated/tried:

  1. creating a service + endpoint. This works, but the problem is the service name is not present in the SSL Certificate's SAN entry, so I'm getting a "SSL: no alternative certificate subject name matches target host name 'svc-external-acme'" message. Sure I can add it to the certificate SAN, but it's probably not the correct solution.

  2. installing DNSmasq (https://developers.redhat.com/blog/2015/11/19/dns-your-openshift-v3-cluster/) on the worker nodes but again it feels like a complicated hack. There must be a simpler one.

  3. hostAliases. Unfortunately, this is only available for kube 1.7+ but I'm on openshift 3.5 (kube 1.6). This would have been perfect.

Is there any way I can accomplish #3 in openshift?

I can edit the image to echo my desired entry to /etc/hosts, but I'm saving it as last resort.

-M

1
openshift

1 Answers

0
votes

Maybe I'm a bit late answering this question

I had a similar issue with our dev environment and the way we managed to resolve it was:

  1. We created a config-map with the desired content of the /etc/hosts file. I'm using hosts-delta as the name of the config map entry
  2. We define a mount point of that config map inside the container (/app/hosts/). I think the directory /app/hosts should exist within the container filesystem so you should add a RUN mkdir -p /app/hosts in your Dockerfile
  3. We modified the deployment config yaml adding a post start hook in this way:
lifecycle:
  postStart:
    exec:
      command:
        - /bin/sh
        - '-c'
        - |
        cat /app/hosts/hosts-delta >> /etc/hosts

The previous snippet should be placed inside the spec > template > spec > containers element

Hope this helps somebody