Forum Discussion

h_elyot's avatar
h_elyot
Icon for Nimbostratus rankNimbostratus
Mar 22, 2019

OpenShift : iRule for redirecting to Status URL if PODs are unreachable

Dears,

We would like to redirect traffic to an external status page if the PODs in our Openshift environment are unreachable. In the ASM config, the members of the related pools are the openshift routers interfaces. I lack knowledge in the field, that's why I am asking for advice here. Would the following iRule work in this situation ?

 

when HTTP_RESPONSE {  if { [HTTP::status] contains "404"} {    HTTP::redirect "http://www.siterequest.com/"  }}

 

Regards,

ASM Advanced WAF
BIG-IP
cloud
devops
irule

8 Replies

Sort By
  • AMiles_377865's avatar
    AMiles_377865
    Icon for Cirrocumulus rankCirrocumulus
    Mar 26, 2019

    Hello Elliot,

     

    That looks reasonable. The only thing I am a little uncertain of is the exact response a downed POD will make to the F5, which is why I might consider triggering the irule from a monitor instead of the HTTP response event. That way, if your F5 registers all pool members are down, users will be directed straight to the status page.

     

    Best of luck,

     

    Austin

     

    • h_elyot's avatar
      h_elyot
      Icon for Nimbostratus rankNimbostratus
      Apr 03, 2019

      Hi Austin,

      Thank you for the reply. Regarding the code itself, I should probably use { if { [HTTP::status] contains "503"} instead of { if { [HTTP::status] contains "404"} Now about triggering the iRule from a monitor,I thought about your idea but I am not sure it will work because monitors do not currently return any information to iRules other that up/down status of the pool. As the pool members are the network interfaces of the Openshift routers and not the Openshift PODs themselves, the result could be misleading.

      Regards

  • Karim's avatar
    Karim
    Icon for Cirrus rankCirrus
    Apr 03, 2019

    Hi,

     

    The issue with your iRule is that is doesn't not take into consideration the health status of your pool members.

     

    I would suggest this: in the HTTP profile there is a property called "Fallback Host". When all your pool members are marked down by the monitor assigned to the pool, the bigip will send a 302 response.

     

    Many thanks,

     

    Karim

     

    • h_elyot's avatar
      h_elyot
      Icon for Nimbostratus rankNimbostratus
      Apr 03, 2019

      Hi Karim,

       

      Thanks for the suggestion. So using http://www.statuspage.com as Fallback Host in the profile should do the job, instead of using a iRule, if I understand well?

       

      Regards

       

    • Karim's avatar
      Karim
      Icon for Cirrus rankCirrus
      Apr 03, 2019

      Hi,

       

      Yes, the fallback host will redirect client only in the following situations :

       

      • A pool member is not chosen (the system failed to select a pool or a pool member, or no pool members were available).

         

      • A pool member is unreachable (when no route to the target exists).

         

      • A pool member is unresponsive (resets a connection request).

         

      • A pool member closes an established connection before the request is sent.

         

      More info here : https://support.f5.com/csp/article/K6510

       

      Many thanks,

       

      Karim

       

  • Karim_Benyello1's avatar
    Karim_Benyello1
    Icon for Cirrus rankCirrus
    Apr 03, 2019

    Hi,

     

    The issue with your iRule is that is doesn't not take into consideration the health status of your pool members.

     

    I would suggest this: in the HTTP profile there is a property called "Fallback Host". When all your pool members are marked down by the monitor assigned to the pool, the bigip will send a 302 response.

     

    Many thanks,

     

    Karim

     

    • h_elyot's avatar
      h_elyot
      Icon for Nimbostratus rankNimbostratus
      Apr 03, 2019

      Hi Karim,

       

      Thanks for the suggestion. So using http://www.statuspage.com/ as Fallback Host in the profile should do the job, instead of using a iRule, if I understand well?

       

      Regards

       

    • Karim_Benyello1's avatar
      Karim_Benyello1
      Icon for Cirrus rankCirrus
      Apr 03, 2019

      Hi,

       

      Yes, the fallback host will redirect client only in the following situations :

       

      • A pool member is not chosen (the system failed to select a pool or a pool member, or no pool members were available).

         

      • A pool member is unreachable (when no route to the target exists).

         

      • A pool member is unresponsive (resets a connection request).

         

      • A pool member closes an established connection before the request is sent.

         

      More info here : https://support.f5.com/csp/article/K6510

       

      Many thanks,

       

      Karim