GWS/Current/GWSPEGuide/ConfigureIngress - Revision history

WikiSysop at 19:30, December 22, 2023

2023-12-22T19:30:45Z

Show changes

WikiSysop at 13:01, February 28, 2023

2023-02-28T13:01:35Z

WikiSysop at 16:45, July 8, 2022

2022-07-08T16:45:44Z

WikiSysop at 12:15, May 4, 2022

2022-05-04T12:15:59Z

WikiSysop at 12:45, April 26, 2022

2022-04-26T12:45:49Z

WikiSysop at 18:45, April 8, 2022

2022-04-08T18:45:51Z

Jumunn: Published

2022-02-01T20:11:25Z

Published

Show changes

Ed.jamer@genesys.com: Text replacement - "Genesys Engage [cC]loud" to "Genesys Multicloud CX"

2021-11-09T20:31:47Z

Text replacement - "Genesys Engage [cC]loud" to "Genesys Multicloud CX"

Julie.munn@genesys.com at 20:55, October 29, 2021

2021-10-29T20:55:10Z

Show changes

Julie.munn@genesys.com: Published

2021-10-29T20:54:07Z

Published

New page

{{Article
|Standalone=No
|DisplayName=Configure GWS Ingress
|Context=Learn how to configure GWS Ingress.
|ComingSoon=No
|Section={{Section
|sectionHeading=Override Helm chart values
|anchor=override
|alignment=Vertical
|structuredtext=You can specify parameters for the deployment by overriding Helm chart values in the '''values.yaml''' file. See the tables below for a full list of overridable values available for each container in GWS Ingress.

For more information about how to override Helm chart values, see {{SuiteLevelLink|helmoverride}} in the ''Setting up Genesys Engage Cloud Private Edition'' guide.

If you want to use arbitrary UIDs in your OpenShift deployment, you must override the '''securityContext''' settings in the '''values.yaml''' file, so that no user or group IDs are specified. For details, see {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureIngress|anchor=security|display text=Configure security}} below.
{{{!}} class="wikitable"
{{!}}+Parameters
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}podLabels
{{!}}Custom labels for each pod.
{{!}}A valid set of labels as "name: value"
{{!}}{}
{{!}}-
{{!}}podAnnotations
{{!}}Custom annotations for each pod.
{{!}}A valid set of annotations as "name: value"
{{!}}{}
{{!}}-
{{!}}priorityClassName
{{!}}The class name Kubernetes uses to determine the priority of the pods for this container deployment relative to other pods. See the [https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ Kubernetes documentation] for details.
{{!}}A valid priority class name
{{!}}""
{{!}}-
{{!}}deploymentGlobals.deploymentTag
{{!}}The deployment tag used as a suffix for the names of Kubernetes objects created by the chart. The value must be the same as the value in the {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=globalP|display text=GWS Helm chart}}.
{{!}}{{Editgrn open}}JM: What are the valid values?{{Editgrn close}}
{{!}}"live"
{{!}}-
{{!}}deploymentGlobals.strategy
{{!}}The strategy GWS Ingress uses to upgrade its containers.
{{!}}RollingUpdate or Recreate
{{!}}"RollingUpdate"
{{!}}-
{{!}}deploymentGlobals.securityContext.runAsNonRoot
{{!}}Specifies whether the container must run as a non-root user.
{{!}}true or false
{{!}}true
{{!}}-
{{!}}deploymentGlobals.securityContext.runAsUser
{{!}}The user ID to run the entry point of the container process. In OpenShift, if your deployment uses arbitrary UIDs set this value to null.
{{!}}A valid user ID or null
{{!}}500
{{!}}-
{{!}}deploymentGlobals.securityContext.runAsGroup
{{!}}The group ID to run the entry point of the container process. In OpenShift, if your deployment uses arbitrary UIDs set this value to null.
{{!}}A valid group ID or null
{{!}}500
{{!}}-
{{!}}deploymentGlobals.securityContext.fsGroup
{{!}}A supplemental group ID that applies to all containers in a pod. In OpenShift, if your deployment uses arbitrary UIDs set this value to null.
{{!}}A valid group ID or null
{{!}}500
{{!}}-
{{!}}nodeSelector
{{!}}The labels Kubernetes uses to assign pods to nodes. See the [https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector Kubernetes documentation] for details.
{{!}}Valid nodeSelector settings.
{{!}}{}
{{!}}-
{{!}}gwsServiceProxy.deployment.replicaCount
{{!}}The number of pod replicas in this deployment.
{{!}}A number greater than 0
{{!}}2
{{!}}-
{{!}}gwsServiceProxy.image.registry
{{!}}The Docker registry from which Kubernetes pulls images.
{{!}}A valid registry URL
{{!}}""
{{!}}-
{{!}}gwsServiceProxy.image.repository
{{!}}The name of the Docker registry repository.
{{!}}A valid repository name
{{!}}"gws-system-nginx"
{{!}}-
{{!}}gwsServiceProxy.image.pullPolicy
{{!}}Specifies when Kubernetes pulls images from the registry on start up.
{{!}}IfNotPresent or Always
{{!}}"Always"
{{!}}-
{{!}}gwsServiceProxy.image.imagePullSecrets
{{!}}The secret Kubernetes uses to get credentials to pull images from the registry.
{{!}}A valid secret
{{!}}[]
{{!}}-
{{!}}gwsServiceProxy.context.sessionCookieName
{{!}}The cookie name for sticky sessions.
{{!}}A valid cookie name
{{!}}"GWSSESSIONID"
{{!}}-
{{!}}gwsServiceProxy.context.env.CONSUL_PORT
{{!}}The port of the local Consul agent.
{{!}}A valid port
{{!}}8500
{{!}}-
{{!}}gwsServiceProxy.context.env.GWS_NGINX_CONSUL_ENABLED
{{!}}Specifies whether Consul is enabled.
{{!}}{{Editgrn open}}JM: What are the valid values?{{Editgrn close}}
{{!}}"off"
{{!}}-
{{!}}gwsServiceProxy.context.env.GWS_NGINX_ENABLE_MAPPING
{{!}}Specifies whether mapping is enabled in Nginx.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}gwsServiceProxy.context.env.GWS_NGINX_CONSUL_SERVICE
{{!}}The name of the Consul service.
{{!}}A valid name
{{!}}"system-nginx"
{{!}}-
{{!}}gwsServiceProxy.context.env.GWS_CONSUL_KV_PREFIX
{{!}}The prefix used to locate GWS Ingress data in the Consul KV datastore.
{{!}}String
{{!}}""
{{!}}-
{{!}}gwsServiceProxy.livenessProbe.startupDelay
{{!}}Specifies the time in seconds to wait before performing the first liveness probe.
{{!}}Number
{{!}}5
{{!}}-
{{!}}gwsServiceProxy.livenessProbe.checkInterval
{{!}}Specifies the interval in seconds between liveness probes.
{{!}}Number
{{!}}10
{{!}}-
{{!}}gwsServiceProxy.readinessProbe.startupDelay
{{!}}Specifies the time in seconds to wait before performing the first readiness probe.
{{!}}Number
{{!}}15
{{!}}-
{{!}}gwsServiceProxy.readinessProbe.checkInterval
{{!}}Specifies the interval in seconds between readiness probes.
{{!}}Number
{{!}}20
{{!}}-
{{!}}gwsServiceProxy.service.ports
{{!}}The HTTP ports used by service.
{{!}}A valid set of ports as "name: value","port: value"
{{!}}[{"name": "gws-service-proxy", "port": 80, "targetPort": 8080}, {"name": "gws-service-proxy-ext", "port": 81, "targetPort": 8081}]
{{!}}-
{{!}}entryPoints.internal.service.annotations
{{!}}Custom annotations for the service.
{{!}}A valid set of annotations as "name: value"
{{!}}{}
{{!}}-
{{!}}entryPoints.internal.ingress.enabled
{{!}}Whether ingress will start
{{!}}true or false
{{!}}true
{{!}}-
{{!}}entryPoints.internal.ingress.annotations
{{!}}Custom annotations for internal ingress.
{{!}}A valid set of annotations as "name: value"
{{!}}{}
{{!}}-
{{!}}entryPoints.internal.ingress.paths
{{!}}Paths to internal ingress, relative to the hostnames.
{{!}}Valid paths
{{!}}["/"]
{{!}}-
{{!}}entryPoints.internal.ingress.hosts
{{!}}List of internal ingress hostnames.
{{!}}Valid hostnames
{{!}}["gws-int.genesys.com"]
{{!}}-
{{!}}entryPoints.internal.ingress.tls
{{!}}List of TLS configurations for internal ingress. See {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Planning|anchor=Network|display text=Network requirements}} for an example configuration.
{{!}}Valid TLS configurations
{{!}}[]
{{!}}-
{{!}}entryPoints.external.ingress.enabled
{{!}}Specifies whether internal ingress will start.
{{!}}true or false
{{!}}true
{{!}}-
{{!}}entryPoints.external.ingress.annotations
{{!}}Custom annotations for external ingress.
{{!}}A valid set of annotations as "name: value"
{{!}}{}
{{!}}-
{{!}}entryPoints.external.ingress.paths
{{!}}Paths to external ingress, relative to the hostnames.
{{!}}Valid paths
{{!}}["/"]
{{!}}-
{{!}}entryPoints.external.ingress.hosts
{{!}}List of external ingress hostnames.
{{!}}Valid hostnames
{{!}}["gws.genesys.com"]
{{!}}-
{{!}}entryPoints.external.ingress.tls
{{!}}List of TLS configurations for external ingress. See {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Planning|anchor=Network|display text=Network requirements}} for an example configuration.
{{!}}Valid TLS configurations
{{!}}[]
{{!}}}
|Status=No
}}{{Section
|sectionHeading=Configure Kubernetes
|anchor=kubernetes
|alignment=Vertical
|structuredtext=Create a Kubernetes secret for your API token from Consul. For more information about this token, see [https://www.consul.io/docs/security/acl/acl-system Consul's access control documentation].
<syntaxhighlight>
kubectl create secret generic gws-secrets-green -n gws --from-literal='gws-consul-token=<token-from-consul>'
</syntaxhighlight>
|Status=No
}}{{Section
|sectionHeading=Configure security
|anchor=security
|alignment=Vertical
|structuredtext=To learn more about how security is configured for private edition, be sure to read the {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=Prerequisites|display text=Permissions}} and {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=ConfigSecurity}} topics in the ''Setting up Genesys Engage Cloud Private Edition'' guide.

The security context settings define the privilege and access control settings for pods and containers.

By default, the user and group IDs are set in the '''values.yaml''' file as <tt>500:500:500</tt>, meaning the '''genesys''' user.
<syntaxhighlight>
deploymentGlobals:
securityContext:
runAsUser: 500
runAsGroup: 500
fsGroup: 500
runAsNonRoot: true
</syntaxhighlight>

===Arbitrary UIDs in OpenShift===
If you want to use arbitrary UIDs in your OpenShift deployment, you must override the '''securityContext''' settings in the '''values.yaml''' file, so that you do not define any specific IDs.
<syntaxhighlight>
deploymentGlobals:
securityContext:
runAsUser: null
runAsGroup: 0
fsGroup: null
runAsNonRoot: true
</syntaxhighlight>For details about these parameters and possible values, see '''deploymentGlobals.securityContext.*''' in the {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureIngress|anchor=override|display text=Parameters}} table above.
|Status=No
}}{{Section
|sectionHeading=Next steps
|anchor=next
|alignment=Vertical
|structuredtext=*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=DeployIngress}}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ProvisionAS}}
|Status=No
}}
}}

@@ Line 15: / Line 15: @@
 For more information about how to override Helm chart values, see {{SuiteLevelLink|helmoverride}}.
+<!--
 If you want to use arbitrary UIDs in your OpenShift deployment, you must override the '''securityContext''' settings in the '''values.yaml''' file, so that no user or group IDs are specified. For details, see {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureIngress|anchor=security|display text=Configure security}} below.
 {{{!}} class="wikitable"
 {{!}}+Parameters
@@ Line 37: / Line 38: @@
 {{!}}The class name Kubernetes uses to determine the priority of the pods for this container deployment relative to other pods. See the [https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ Kubernetes documentation] for details.
 {{!}}A valid priority class name
 {{!}}""
 {{!}}-
@@ Line 55: / Line 61: @@
 {{!}}-
 {{!}}deploymentGlobals.securityContext.runAsUser
-{{!}}The user ID to run the entry point of the container process. In OpenShift, if your deployment uses arbitrary UIDs set this value to null.
+{{!}}The user ID to run the entry point of the container process. <!-- In OpenShift, if your deployment uses arbitrary UIDs set this value to null. -->
 {{!}}A valid user ID or null
 {{!}}500
 {{!}}-
 {{!}}deploymentGlobals.securityContext.runAsGroup
-{{!}}The group ID to run the entry point of the container process. In OpenShift, if your deployment uses arbitrary UIDs set this value to null.
+{{!}}The group ID to run the entry point of the container process. <!-- In OpenShift, if your deployment uses arbitrary UIDs set this value to null.-->
 {{!}}A valid group ID or null
 {{!}}500
 {{!}}-
 {{!}}deploymentGlobals.securityContext.fsGroup
-{{!}}A supplemental group ID that applies to all containers in a pod. In OpenShift, if your deployment uses arbitrary UIDs set this value to null.
+{{!}}A supplemental group ID that applies to all containers in a pod. <!-- In OpenShift, if your deployment uses arbitrary UIDs set this value to null.-->
 {{!}}A valid group ID or null
 {{!}}500
@@ Line 79: / Line 85: @@
 {{!}}2
 {{!}}-
-{{!}}gwsServiceProxy.image.registry
+{{!}}{{AnchorDiv|gwsServiceProxy.image.registry}}gwsServiceProxy.image.registry
-{{!}}The Docker registry from which Kubernetes pulls images.
+{{!}}The Docker registry from which Kubernetes pulls images. If set, this parameter overrides {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureIngress|anchor=imageGlobals.registry|display text=imageGlobals.registry}}.
 {{!}}A valid registry URL
 {{!}}""
@@ Line 241: / Line 247: @@
      runAsNonRoot: true
 </syntaxhighlight>
+<!--
 ===Arbitrary UIDs in OpenShift===
 If you want to use arbitrary UIDs in your OpenShift deployment, you must override the '''securityContext''' settings in the '''values.yaml''' file, so that you do not define any specific IDs.
@@ Line 251: / Line 257: @@
      fsGroup: null
      runAsNonRoot: true
-</syntaxhighlight>For details about these parameters and possible values, see '''deploymentGlobals.securityContext.*''' in the {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureIngress|anchor=override|display text=Parameters}} table above.
+</syntaxhighlight>
 |Status=No
 }}{{Section

@@ Line 6: / Line 6: @@
 |Section={{Section
 |alignment=Vertical
-|structuredtext={{NoteFormat|If you are deploying Web Services and Applications in a single namespace with other private edition services, then you do not need to deploy GWS ingress.|3}}
+|structuredtext={{NoteFormat|If you are deploying Genesys Web Services and Applications in a single namespace with other private edition services, then you do not need to deploy GWS ingress.|3}}
 |Status=No
 }}{{Section
@@ Line 12: / Line 12: @@
 |anchor=override
 |alignment=Vertical
-|structuredtext=You can specify parameters for the deployment by overriding Helm chart values in the '''values.yaml''' file. See the tables below for a full list of overridable values available for each container in GWS Ingress.
+|structuredtext=You can specify parameters for the deployment by overriding Helm chart values in the '''values.yaml''' file. See the tables below for a full list of overridable values available for each container in GWS ingress.
-For more information about how to override Helm chart values, see {{SuiteLevelLink|helmoverride}} in the ''Setting up Genesys Multicloud CX Private Edition'' guide.
+For more information about how to override Helm chart values, see {{SuiteLevelLink|helmoverride}}.
 If you want to use arbitrary UIDs in your OpenShift deployment, you must override the '''securityContext''' settings in the '''values.yaml''' file, so that no user or group IDs are specified. For details, see {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureIngress|anchor=security|display text=Configure security}} below.
@@ Line 45: / Line 45: @@
 {{!}}-
 {{!}}deploymentGlobals.strategy
-{{!}}The strategy GWS Ingress uses to upgrade its containers.
+{{!}}The strategy GWS ingress uses to upgrade its containers.
 {{!}}RollingUpdate or Recreate
 {{!}}"RollingUpdate"
@@ Line 120: / Line 120: @@
 {{!}}-
 {{!}}gwsServiceProxy.context.env.GWS_CONSUL_KV_PREFIX
-{{!}}The prefix used to locate GWS Ingress data in the Consul KV datastore.
+{{!}}The prefix used to locate GWS ingress data in the Consul KV datastore.
 {{!}}String
 {{!}}"gws"
@@ Line 155: / Line 155: @@
 {{!}}-
 {{!}}entryPoints.internal.ingress.enabled
-{{!}}Specifies whether internal ingress is enabled. Set this value to false if you are deploying Web Services and Applications in a single namespace.
+{{!}}Specifies whether internal ingress is enabled. Set this value to false if you are deploying Genesys Web Services and Applications in a single namespace.
 {{!}}true or false
 {{!}}true
 {{!}}-
 {{!}}entryPoints.internal.ingress.annotations
@@ Line 180: / Line 185: @@
 {{!}}-
 {{!}}entryPoints.external.ingress.enabled
-{{!}}Specifies whether external ingress is enabled. Set this value to false if you are deploying Web Services and Applications in a single namespace.
+{{!}}Specifies whether external ingress is enabled. Set this value to false if you are deploying Genesys Web Services and Applications in a single namespace.
 {{!}}true or false
 {{!}}true
 {{!}}-
 {{!}}entryPoints.external.ingress.annotations
@@ Line 218: / Line 228: @@
 |anchor=security
 |alignment=Vertical
-|structuredtext=To learn more about how security is configured for private edition, be sure to read the {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=Prerequisites|display text=Permissions}} and {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=ConfigSecurity}} topics in the ''Setting up Genesys Multicloud CX Private Edition'' guide.
+|structuredtext=To learn more about how security is configured for private edition, be sure to read {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=Prerequisites|display text=Permissions}} and {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=ConfigSecurity}}.
 The security context settings define the privilege and access control settings for pods and containers.

@@ Line 249: / Line 249: @@
 |structuredtext=*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=DeployIngress}}
 *{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Provision}}
 |Status=No
 }}
 }}

@@ Line 115: / Line 115: @@
 {{!}}-
 {{!}}gwsServiceProxy.context.env.GWS_NGINX_CONSUL_SERVICE
-{{!}}The name of the Consul service.
+{{!}}The name of the service to register in Consul.
 {{!}}A valid name
 {{!}}"system-nginx"
@@ Line 122: / Line 122: @@
 {{!}}The prefix used to locate GWS Ingress data in the Consul KV datastore.
 {{!}}String
-{{!}}""
+{{!}}"gws"
 {{!}}-
 {{!}}gwsServiceProxy.livenessProbe.startupDelay