You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: documentation/3.3/content/_index.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -31,7 +31,7 @@ using the operator to deploy and run a WebLogic domain container-packaged web ap
31
31
#### Current production release
32
32
33
33
The [current release of the operator](https://github.com/oracle/weblogic-kubernetes-operator/releases) is 3.3.2.
34
-
This release was published on September 1, 2021. See the [operator prerequisites]({{< relref "/userguide/prerequisites/introduction.md" >}}) and [supported environments]({{< relref "/userguide/platforms/environments.md" >}}).
34
+
This release was published on September 24, 2021. See the [operator prerequisites]({{< relref "/userguide/prerequisites/introduction.md" >}}) and [supported environments]({{< relref "/userguide/platforms/environments.md" >}}).
Copy file name to clipboardExpand all lines: documentation/3.3/content/faq/external-clients.md
+2Lines changed: 2 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -547,6 +547,8 @@ please see [Meet Kubernetes resource name restrictions]({{< relref "/userguide/m
547
547
548
548
- You can configure a custom channel with a secure protocol and two-way SSL to help prevent external access by unwanted applications. See [When is a WebLogic custom channel needed?](#when-is-a-weblogic-custom-channel-needed).
549
549
550
+
- For a detailed description of external network access security, see [External network access security]({{< relref "/security/domain-security/weblogic-channels.md" >}}).
551
+
550
552
#### Optional reading
551
553
552
554
- For a description of the WebLogic URL syntax for JMS, EJB, and JNDI applications
Copy file name to clipboardExpand all lines: documentation/3.3/content/faq/security-validation.md
+5Lines changed: 5 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -21,3 +21,8 @@ Warnings may be at the level of the JDK, or that SSL is not enabled. Some warnin
21
21
- For Domain in Image, create a new image with the recommended changes or use [configuration overrides]({{< relref "/userguide/managing-domains/configoverrides/_index.md" >}}).
22
22
23
23
- For Model in Image, supply model files with the recommended changes in its image's `modelHome` directory or use [runtime updates]({{< relref "/userguide/managing-domains/model-in-image/runtime-updates.md" >}}).
24
+
25
+
{{% notice note %}}
26
+
For information about handling file permission warnings on the OpenShift Kubernetes Platform, see the [OpenShift chapter]({{<relref "/security/openshift.md">}}) in the Security section.
Copy file name to clipboardExpand all lines: documentation/3.3/content/release-notes.md
+5-1Lines changed: 5 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ draft: false
8
8
9
9
| Date | Version | Introduces backward incompatibilities? | Change |
10
10
| --- | --- | --- | --- |
11
-
| September 1, 2021 | v3.3.2 | no |Enhanced liveness and readiness probe customization to support customizing failure thresholds. |
11
+
| September 24, 2021 | v3.3.2 | no |Istio 1.10 support, enhanced liveness and readiness probe customization to support customizing failure thresholds, and additional validations. |
12
12
| August 23, 2021 | v3.3.1 | no | Resolved an issue related to managed Coherence cluster formation when using Istio and another issue related to Secret and ConfigMap validation. |
13
13
| July 20, 2021 | v3.3.0 | no | Auxiliary image support. |
14
14
| June 21, 2021 | v3.2.5 | no | Updated Oracle Linux libraries and resolved an issue related to repeated introspection. |
@@ -47,7 +47,11 @@ draft: false
47
47
48
48
#### Operator 3.3.2
49
49
50
+
* Support for the networking changes included with Istio 1.10 ([#2538](https://github.com/oracle/weblogic-kubernetes-operator/pull/2538)).
51
+
* Support for accessing the WebLogic Server Administration Console through `kubectl port-forward` ([#2520](https://github.com/oracle/weblogic-kubernetes-operator/pull/2520)).
52
+
* Prevent insecure file system warnings related to the "umask 027" requirement ([#2533](https://github.com/oracle/weblogic-kubernetes-operator/pull/2533)).
50
53
* Enhanced [liveness and readiness probe customization](https://oracle.github.io/weblogic-kubernetes-operator/userguide/managing-domains/domain-lifecycle/liveness-readiness-probe-customization/) to support customizing failure thresholds ([#2521](https://github.com/oracle/weblogic-kubernetes-operator/pull/2521)).
54
+
* Additional validation for container port names and WebLogic Network Access Point (NAP) names that will be used as container ports ([#2542](https://github.com/oracle/weblogic-kubernetes-operator/pull/2542)).
Oracle recommends _not_ exposing any administrative, RMI, or T3 channels outside the Kubernetes cluster
12
-
unless absolutely necessary. If exposing any of these channels, limit access using
13
-
controls like security lists or set up a Bastion to provide access.
12
+
unless absolutely necessary.
14
13
{{% /notice %}}
15
14
16
-
When accessing T3 or RMI based channels, the preferred approach is to `kubectl exec` into
17
-
the Kubernetes Pod and then run `wlst`, or set up Bastion access and then run
18
-
`wlst` from the Bastion host to connect to the Kubernetes cluster.
15
+
If exposing an administrative, RMI, EJB, JMS, or T3 capable
16
+
channel using a load balancer,
17
+
port forwarding, `NodePorts`, or similar,
18
+
then limit access by using a custom
19
+
dedicated WebLogic Server port that you have configured
20
+
with the T3 or administration protocol (a network access point)
21
+
instead of relaying the traffic to a default port,
22
+
leverage two-way SSL, use controls like security lists,
23
+
and/or set up a Bastion to provide access. A custom channel
24
+
is preferred over a default channel because a default port supports
25
+
multiple protocols.
19
26
20
-
Also, consider a private VPN if you need use cross-domain T3 access
21
-
between clouds, data centers, and such.
27
+
When accessing T3 or RMI based channels for administrative purposes,
28
+
such as running WLST, the preferred approach is to `kubectl exec` into
29
+
the Kubernetes Pod and then run `wlst.sh`, or set up Bastion access and then run
30
+
`java weblogic.WLST` or `$ORACLE_HOME/oracle_common/common/bin/wlst.sh`
31
+
from the Bastion host to connect to the Kubernetes cluster
32
+
(some cloud environments use the term Jump Host or Jump Server instead of Bastion).
33
+
34
+
Also, if you need to use cross-domain T3 access
35
+
between clouds, data centers, and such, consider a private VPN.
36
+
37
+
#### WebLogic HTTP channels
38
+
39
+
When providing remote access to HTTP using a load balancer,
40
+
port forwarding, `NodePorts`, or similar,
41
+
Oracle recommends relaying the traffic to a dedicated
42
+
WebLogic Server port that you have configured
43
+
using a custom HTTP channel (network access point)
44
+
instead of relaying the traffic to a default port.
45
+
This helps ensure that external
46
+
traffic is limited to the HTTP protocol. A custom HTTP channel
47
+
is preferred over a default port because a default port supports
48
+
multiple protocols.
49
+
50
+
Do not enable tunneling on an HTTP channel
51
+
that is exposed for remote access unless you specifically
52
+
intend to allow it to handle T3 traffic
53
+
(tunneling allows T3 to tunnel through the channel using HTTP)
54
+
and you perform the additional steps that may be necessary
55
+
to further secure access, as described
56
+
in [WebLogic T3 and administrative channels](#weblogic-t3-and-administrative-channels).
57
+
58
+
#### Limit use of Kubernetes NodePorts
59
+
60
+
Although Kubernetes `NodePorts` are good for use in demos and getting-started guides,
61
+
they are typically not suited for production systems for multiple reasons, including:
62
+
63
+
- With some cloud providers, a `NodePort` may implicitly expose a port to the public Internet.
64
+
- They bypass almost all network security in Kubernetes.
65
+
- They allow all protocols (load balancers can limit to the HTTP protocol).
66
+
- They cannot expose standard, low-numbered ports like 80 and 443 (or even 8080 and 8443).
67
+
- Some Kubernetes cloud environments cannot expose usable `NodePorts` because their Kubernetes clusters run on a private network that cannot be reached by external clients.
68
+
69
+
#### General advice
70
+
71
+
1._Set up administration ports_: Configure an administration port on WebLogic, or an administrative channel, to prevent
72
+
all other channels from accepting administration-privileged traffic
73
+
(this includes preventing administration-privileged traffic from a WebLogic console over HTTP).
74
+
75
+
1._Be aware of anonymous defaults_:
76
+
If an externally available port supports a protocol suitable for WebLogic
77
+
JNDI, EJB/RMI, or JMS clients,
78
+
then note that _by default_:
79
+
- WebLogic enables anonymous users to access such a port.
80
+
- JNDI entries, EJB/RMI applications, and JMS are open to anonymous users.
81
+
82
+
1._Configure SSL_:
83
+
You can configure two-way SSL to help prevent external access by unwanted applications
84
+
(often SSL is setup between the caller and the load balancer, and plain-text
85
+
traffic flows internally from the load balancer to WebLogic).
Copy file name to clipboardExpand all lines: documentation/3.3/content/security/openshift.md
+3Lines changed: 3 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -116,3 +116,6 @@ see [OpenShift]({{<relref "/userguide/platforms/environments#openshift">}}).
116
116
#### Using a dedicated namespace
117
117
118
118
When the user that installs an individual instance of the operator does not have the required privileges to create resources at the Kubernetes cluster level, a dedicated namespace can be used for the operator instance and all the WebLogic domains that it manages. For more details about the `dedicated` setting, please refer to [Operator Helm configuration values]({{< relref "/userguide/managing-operators/using-helm#operator-helm-configuration-values" >}}).
119
+
120
+
#### Set the Helm chart property `kubernetesPlatorm` to `OpenShift`
121
+
Beginning with operator version 3.3.2, set the operator `kubernetesPlatform` Helm chart property to `OpenShift`. This property accommodates OpenShift security requirements. For more information, see [Operator Helm configuration values]({{<relref "/userguide/managing-operators/using-helm#operator-helm-configuration-values">}}).
Copy file name to clipboardExpand all lines: documentation/3.3/content/userguide/istio/istio.md
+32Lines changed: 32 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -142,6 +142,38 @@ If the WebLogic administration port is enabled on the Administration Server:
142
142
Additionally, when Istio support is enabled for a domain, the operator
143
143
ensures that the Istio sidecar is not injected into the introspector job's pods.
144
144
145
+
#### Support for network changes in Istio v1.10 and later
146
+
147
+
Starting with Istio 1.10, the networking behavior was changed in that the proxy no longer redirects
148
+
the traffic to the localhost interface, but instead forwards it to the network interface associated
149
+
with the pod's IP.
150
+
151
+
To learn more about changes to Istio networking beginning with Istio 1.10, see [Upcoming networking changes in Istio 1.10](https://istio.io/latest/blog/2021/upcoming-networking-changes/).
152
+
153
+
In order to support Istio v1.10 and later, as well as previous releases, the
154
+
operator will:
155
+
156
+
* Add an additional WebLogic HTTP protocol network channel for the readiness probe that is bound to the localhost network interface.
157
+
* Add additional WebLogic network channels, bound to the localhost network interface, for each defined custom network channel.
158
+
* Continue to automatically add the network channels described above in [How Istio-enabled domains differ from regular domains](#how-istio-enabled-domains-differ-from-regular-domains)
159
+
160
+
When adding additional WebLogic network channels for the readiness probe and any defined custom channels,
161
+
the name of the additional channel will be appended with '-lhNN', where NN represents
162
+
a two digit value for uniqueness.
163
+
164
+
For example, the additional WebLogic HTTP protocol network channel for the readiness probe would be
165
+
defined as follows:
166
+
167
+
|Name|Port|Listening address|Protocol|Exposed as a container port|
168
+
|----|----|----|--------|-----|
169
+
|`http-probe-lh01`|From configuration Istio `readinessPort` | `127.0.0.1` | `http`| No |
170
+
171
+
As another example, for a custom WebLogic network channel defined as `T3Channel` with port `5556`
172
+
and protocol `t3`, the additional channel would be defined as follows:
173
+
174
+
|Name|Port|Listening address|Protocol|Exposed as a container port|
Copy file name to clipboardExpand all lines: documentation/3.3/content/userguide/managing-domains/accessing-the-domain/admin-console.md
+59-13Lines changed: 59 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -7,6 +7,7 @@ description: "Use the WebLogic Remote Console to manage a domain running in Kube
7
7
---
8
8
9
9
The WebLogic Remote Console is a lightweight, open source console that does not need to be collocated with a WebLogic Server domain.
10
+
It is an _alternative_ to the WebLogic Server Administration Console.
10
11
You can install and run the Remote Console anywhere. For an introduction, read the blog, ["The NEW WebLogic Remote Console"](https://blogs.oracle.com/weblogicserver/new-weblogic-server-remote-console).
11
12
For detailed documentation, see the [WebLogic Remote Console](https://github.com/oracle/weblogic-remote-console) GitHub project.
12
13
@@ -16,13 +17,20 @@ or [OSDC](https://edelivery.oracle.com/osdc/faces/Home.jspx;jsessionid=LchBX6sgz
16
17
Slim installers reduce the size of WebLogic Server downloads, installations, container images, and Kubernetes pods.
17
18
For example, a WebLogic Server 12.2.1.4 slim installer download is approximately 180 MB smaller.
18
19
19
-
20
20
The Remote Console is deployed as a standalone Java program, which can connect to multiple WebLogic Server Administration Servers using REST APIs.
21
21
You connect to the Remote Console and, when prompted, supply the WebLogic Server login credentials
22
22
along with the URL of the WebLogic Server Administration Server's administration port to which you want to connect.
23
23
24
24
**Note**: An Administration Server administration port typically is the same as its default port unless either an SSL port or an administration port is configured and enabled.
25
25
26
+
{{% notice warning %}}
27
+
Externally exposing administrative, RMI, or T3 capable WebLogic channels
28
+
using a Kubernetes `NodePort`, load balancer,
29
+
port forwarding, or a similar method can create an insecure configuration.
30
+
For more information, see [External network access security]({{<relref "/security/domain-security/weblogic-channels.md">}}).
31
+
{{% /notice %}}
32
+
33
+
26
34
### Setup
27
35
28
36
To set up access to WebLogic Server domains running in Kubernetes using the Remote Console:
@@ -32,29 +40,31 @@ To set up access to WebLogic Server domains running in Kubernetes using the Remo
32
40
**NOTE**: These instructions assume that you are installing and running the Remote Console Java program externally to your Kubernetes cluster.
33
41
34
42
1. When you first connect your browser to the Remote Console, which is at `http://localhost:8012` by default, the console will prompt you with a login dialog for a WebLogic Server Administration Server URL. To give the Remote Console access to an Administration Server running in Kubernetes, you can:
35
-
36
43
* Use an [Administration Server `NodePort`](#use-an-administration-server-nodeport).
37
44
38
45
* Deploy a load balancer with [ingress path routing rules](#configure-ingress-path-routing-rules).
39
46
47
+
*[Use a `kubectl port-forward` connection](#use-a-kubectl-port-forward-connection).
48
+
49
+
**Note**: If you want to customize the Remote Console listen address,
50
+
then see [Specify a Listen Address for the Remote Console Host](https://github.com/oracle/weblogic-remote-console/blob/master/site/install_config.md#remote). This is useful if you want to run the Remote Console
51
+
on a different machine than your browser, or if you want the Remote Console to use SSL.
52
+
40
53
41
54
#### Use an Administration Server `NodePort`
42
55
43
-
For the Remote Console to connect to the Kubernetes WebLogic Server Administration Server’s `NodePort`, use the URL:
56
+
For the Remote Console to connect to the Kubernetes WebLogic Server Administration Server’s `NodePort`, use the following URL after you have connected to the Remote Console
57
+
with your browser and it
58
+
prompts for the location of your WebLogic Server Administration Server:
44
59
45
60
```
46
61
http://hostname:adminserver-NodePort/
47
62
```
48
63
49
64
The `adminserver-NodePort` is the port number of the Administration Server outside the Kubernetes cluster.
50
65
For information about the `NodePort` Service on an Administration Server, see the [Domain resource](https://github.com/oracle/weblogic-kubernetes-operator/blob/main/documentation/domains/Domain.md) document.
51
-
52
-
{{% notice warning %}}
53
-
Exposing administrative, RMI, or T3 capable channels using a Kubernetes `NodePort`
54
-
can create an insecure configuration. In general, only HTTP protocols should be made available externally and this exposure
55
-
is usually accomplished by setting up an external load balancer that can access internal (non-`NodePort`) services.
56
-
For more information, see [T3 channels]({{<relref "/security/domain-security/weblogic-channels#weblogic-t3-channels">}}).
57
-
{{% /notice %}}
66
+
For an example of setting up the `NodePort` on an Administration Server,
67
+
see [Use a `NodePort` for WLST]({{< relref "/userguide/managing-domains/accessing-the-domain/wlst#use-a-nodeport" >}}).
58
68
59
69
#### Configure ingress path routing rules
60
70
@@ -81,7 +91,11 @@ For more information, see [T3 channels]({{<relref "/security/domain-security/web
81
91
port: 7001
82
92
```
83
93
84
-
1. For the Remote Console to connect to the Kubernetes WebLogic Server Administration Server, supply a URL that resolves to the load balancer host and ingress that you supplied in the previous step. For example:
94
+
95
+
1. After you have connected to the Remote Console with your browser,
96
+
it will prompt for the location of your WebLogic Server Administration
97
+
Server.
98
+
For the Remote Console to connect to the Kubernetes WebLogic Server Administration Server, supply a URL that resolves to the load balancer host and ingress that you supplied in the previous step. For example:
85
99
86
100
```
87
101
http://${HOSTNAME}:${LB_PORT}/
@@ -94,10 +108,42 @@ For more information, see [T3 channels]({{<relref "/security/domain-security/web
94
108
95
109
`$ export LB_PORT=$(kubectl -n traefik get service traefik-operator -o jsonpath='{.spec.ports[?(@.name=="web")].nodePort}')`
0 commit comments