2

I successfully installed on OpenShift Online (Starter Plan, US Virginia server) a Java Web Application (with MySQL Persistent service). The runtime is Tomcat. I managed to build the WAR from an external Git repository (via ssh authentication moreover) and deploy the app to the container. It is reachable from autogenerated route, but i'm getting a weird error setting up a custom new one linked to a www domain. Here's the message:

Route is invalid: spec.host: Forbidden: you do not have permission to set the host field of the route.

I suppose that's a platform bug, but don't know how to work it out (if possible). Any idea please? Many thanks in advance.

2 Answers 2

4

This is meant by Supports Custom Domains for the non-starter (Pro) plan. With the starter plan, you cannot specify domain names.

4
  • 1
    Correct, Starter plans cannot have custom domains. Nov 4, 2017 at 0:26
  • Thanks for your reply. I mean that i'm not able to set a public hostname as route to my app (eg. www.mydomain.com) anymore. If you're right, means that the policy has recently changed, because it used to work untill few days ago with the starter plan.
    – luis-br
    Nov 4, 2017 at 9:29
  • 1
    This has always been the policy. I believe there was a grace period during the initial launch of Starter where this may not have been enforced. However, you can create a public hostname. By leaving the host value blank when creating a route, you will automatically have a public URL generated. Nov 5, 2017 at 5:26
  • That would explain why my route does not work anymore. Since sometime I get the same issue when i try to upload via shell the sqldumpdir, i thought there were temporary problems on the platform.. thank you again.
    – luis-br
    Nov 5, 2017 at 18:26
4

I get same error messages on OKD 4.

Forbidden: you do not have permission to set host fields in ingress rules

The root cause was ingresses managed by routes and routes needing extra ClusterRole settings to update those fields.

Allow route spec.host to be controlled by permission merged at 2017/3

So we need to add extra permissions to the Service Account who want to update ingresses

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: foobar-openshift-ingress
rules:
- apiGroups: ["route.openshift.io"]
  resources: ["routes", "routes/custom-host"]
  verbs:  ["create", "patch"]

Binding this ClusterRole to your Service Account, everything will work.

1
  • 1
    fyi had this today on IBM Cert Manager (copy of jetstack cert-manager). Your RB role fix worked for me. Thanks.
    – Tilo
    Sep 16, 2021 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.