Creating Secure Tunnel connections

ChatOps connection

To integrate IBM Cloud Pak for Watson AIOps with a service like Slack or Microsoft Teams, the IBM Cloud Pak for Watson AIOps instance needs to be accessible from the public network. If your IBM Cloud Pak for Watson AIOps is not accessible from the public network, you can open the IBM Cloud Pak for Watson AIOps instance to the public network by creating a Secure Tunnel. You can do it by exposing the IBM Cloud Pak for Watson AIOps instance to either a cluster (Red Hat OpenShift Container Platform or IBM Kubernetes Service cluster) or a host machine (virtual machine or physical machine), which is accessible from the public network. Simplify the creation of a secure tunnel by using the ChatOps template from the Secure Tunnel Console on the Manage connections page. Take the following steps to create a ChatOps connection:

1. Click the ChatOps tile and a panel with an introduction to the ChatOps template opens. Click Get started.

2. In the Name and Tags section, provide a name and tag for this connection.

   • Connection name: required. The name of the connection. The name can include only lowercase alphanumeric characters and '-', and must start and end with a lowercase alphanumeric character.

   • New tag: optional. The tag of the Connection.

3. In the Connector settings section:

   • First, you need to specify where the connector is located, such as whether it is a Cloud or Host machine.

   • If you choose to install the connector in the Red Hat OpenShift cluster, the connector can be installed automatically. Complete the following actions:

     • Login command for target Red Hat OpenShift cluster: required. Specify a publicly accessible cluster with a CA-signed domain certificate. Do not install the connector in the cluster that contains the Tunnel Connection worker.
     • Target namespace to install the connector: required. The project (namespace) where you want to install the connector.
     • Connector replicas: configure the tunnel connector replicas to set High Availability

   • If you want to install the connector to Red Hat OpenShift Container Platform manually, you can use the Custom method

   • If you choose to install the connector in a Kubernetes cluster, you need to complete the following actions:

     • Cloud domain: Run the command to get IBM Kubernetes Service cluster domain name:

       ibmcloud ks cluster get --cluster <Cluster ID> --output json | jq '.ingress.hostname'
       

     • Target namespace to install the connector: required. The project (namespace) where you want to install the connector.

     • Connector replicas: you will config the tunnel connector replicas to set High Availability.

   • If you choose to install the connector in the Host machine,take the following actions:

     • Host machine addresses: required. Includes the External address of the host machine and Port and Default address of the host machine. When a host machine includes multiple addresses, a default IP address is required. If you want to use one host machine to expose more than one IBM Cloud Pak for Watson AIOps, you need to set a different port for other ChatOps connections.

       • Expose mapping port: required. Default is 12443. You can change this port to allow several IBM Cloud Pak for Watson AIOps instances to have different exposed ports. Then, you can use one host machine to create more than one ChatOps connection.

     • DNS and load balancing: required. First, enter the DNS name of a suitable host machine. Next, select the same machine to host a reverse proxy / load balancer (bundled with the connector). Finally, specify the corresponding certificate and private key.

       • Note: If you have an IBM Cloud account, see Getting started with IBM Cloud Internet Services to apply for a DNS name, and see Preparing to order public certificates to apply for a CA-signed certificate. Extract the CA-signed certificate file, hostname.pem, for the certificate and hostname.key for the private key. If an intermediate file is in your CA-signed certificate file – such as hostname-intermediate.pem – concatenate this file with a cert file, such as hostname.pem, by running the following command:

         cat hostname-intermediate.pem >> hostname.pem
         

4. In the Secure Tunnel settings, configure the tunnel worker replicas to set High Availability.

5. HTTPS proxy: optional. Specify a forward proxy to enable the Secure Tunnel to reach the connector in the other network, such as username:password@hostname:port.

   Note: It is necessary to enter the HTTPS proxy information when Secure Tunnel is in an air-gapped environment. If your Secure Tunnel is in an air-gapped environment without internet connectivity, you need to prepare a host machine (virtual machine or physical machine). Ensure that the host machine can be accessed from the IBM Cloud Pak for Watson AIOps cluster, and also that it can connect to the internet. Then, install an HTTPS proxy server in the host machine, and set the HTTPS proxy server in the HTTPS proxy field.

   If you install a connector in Red Hat OpenShift Container Platform, and the Secure Tunnel in an air-gapped environment and you configured the HTTPS proxy for it, choose Kubernetes for the Cloud Type in the above step. Then, to get the domain for the Cloud domain field, run

   HOSTNAME=$(oc get route -n openshift-console console -o=jsonpath={.spec.host}) && HOSTNAME=${HOSTNAME#console-openshift-console.} && echo $HOSTNAME
   

   For example, squid is a simple HTTPS proxy server. See the following example of using squid to set up an HTTPS proxy server (Do not use this example in your production environment). For a production environment, contact your network administrator to help you configure the HTTPS proxy.

   Save the following configurations in a file squid.conf:

   acl all src 0.0.0.0/0.0.0.0
   acl SSL_ports port 443
   acl CONNECT method CONNECT
   
   http_access deny CONNECT !SSL_ports
   
   http_access allow all
   
   # Squid normally listens to port 3128
   http_port 3128
   
   # Uncomment and adjust the following to add a disk cache directory.
   cache_dir ufs /var/spool/squid 100 16 256
   # Leave coredumps in the first cache dir
   coredump_dir /var/spool/squid
   #
   # Add any of your own refresh_pattern entries above these.
   #
   refresh_pattern ^ftp:        1440    20%    10080
   refresh_pattern ^gopher:    1440    0%    1440
   refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
   refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
   # example lin deb packages
   #refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
   refresh_pattern .        0    20%    4320
   

   Start the squid server by running the following command:

   docker run --name squid -d -p 3128:3128 -v `pwd`/squid.conf:/etc/squid/squid.conf datadog/squid
   

   Set the <host machine IP>:3128 in the HTTPS proxy field.

6. Click Create connection to create a ChatOps connection.

   • If you choose to install the connector in the Red Hat OpenShift cluster, the connector is automatically installed. You can see the installation status in the connector installation section. When the installation is finished, you can get the application mapping URLs for Slack integration and Microsoft Teams integration.
   • If you choose to install the connector in Kubernetes or a host machine, the connector must be manually installed. You can get the installation script in the Next steps section. Install the connector following this installation guide. When the connector is installed, you can use the appropriate application mapping address to integrate with Slack or Microsoft Teams.

VMware connection

Follow the installation instructions to install Secure Tunnel.

You can access services in a private VMware® vCenter from a public cloud Infrastructure automation. In this case, install a Secure Tunnel in the Infrastructure automation cluster, with IBM Cloud Pak for Watson AIOps or a stand-alone version. Then, take the following steps to configure the VMware tunnel connection:

Note: VMware template supports the VMware scenario specifically. Other scenarios can be created by using a Custom template.

Simplifying the creation of a Secure Tunnel by using VMware template in IBM Cloud Pak for Watson AIOps:

1. Click VMware tile. The VMware side panel opens and provides an introductory explanation to the VMware template. Click Get started.

2. In the Name and Tags section, provide a name and tag for this connection:

   • Connection name: required. The name of the connection. The name can include only lowercase alphanumeric characters and '-', and must start and end with a lowercase alphanumeric character.
   • New tag: optional. The tag of the Connection.

3. In the Connector settings section, configure the tunnel connector replicas to High Availability and install the tunnel connector to Cloud or Host machine by selecting the connector location section.

4. In the Secure Tunnel setting, configure the tunnel worker replicas to set High Availability.

5. HTTPS proxy: optional. Specify a forward proxy to enable the Secure Tunnel to reach the connector in the other network, such as username:password@hostname:port.

   Note: It is necessary to enter the HTTPS proxy information when Secure Tunnel is in an air-gapped environment. If your Secure Tunnel is in an air-gapped environment without internet connectivity, you need to prepare a host machine (virtual machine or physical machine). Ensure that the host machine can be accessed from the IBM Cloud Pak for Watson AIOps cluster, and can also connect to the internet. Then, install an HTTPS proxy server in the host machine, and set the HTTPS proxy server in the HTTPS proxy field.

   If you install the connector in OCP, and Secure Tunnel in an air-gapped environment, you need use the Custom method to create a ChatOps connection

   For example, squid is a simple HTTPS proxy server. See the following example of using squid to set up an HTTPS proxy server. (It is just an example. Don't use it in your production environment.) For the production environment, contact your network administrator to help you configure the HTTPS proxy.

   • Save the following configurations in a file squid.conf.

     acl all src 0.0.0.0/0.0.0.0
     acl SSL_ports port 443
     acl CONNECT method CONNECT
     
     http_access deny CONNECT !SSL_ports
     
     http_access allow all
     
     # Squid normally listens to port 3128
     http_port 3128
     
     # Uncomment and adjust the following to add a disk cache directory.
     cache_dir ufs /var/spool/squid 100 16 256
     # Leave coredumps in the first cache dir
     coredump_dir /var/spool/squid
     #
     # Add any of your own refresh_pattern entries above these.
     #
     refresh_pattern ^ftp:        1440    20%    10080
     refresh_pattern ^gopher:    1440    0%    1440
     refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
     refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
     # example lin deb packages
     #refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
     refresh_pattern .        0    20%    4320
     

     • Start the squid server by running the following command:

       docker run --name squid -d -p 3128:3128 -v `pwd`/squid.conf:/etc/squid/squid.conf datadog/squid
       

     • Set the < host machine IP >:3128 in the HTTPS proxy field.

6. In the Application mappings section, edit the VMware addresses to match your environment. If it is the same as the address in the template, you don't need to change anything.

7. Click Create connection to create a VMware connection. You can get the installation script in the Next steps section. Install the Connector following the guide. When the connector is installed, the application mapping address is accessible. You can use this address as the VMware vCenter service address to configure the VMware connection from the Infrastructure Automation UI.

Turbonomic connection

The Turbonomic server is in one private network cluster and you want to integrate it with a kubeturbo probe in another private network.

In this case, install a stand-alone Secure Tunnel on a public Cloud. Then, create one tunnel connection to export the Turbonomic server endpoint to the public cloud cluster. Next, create another tunnel connection to export the exposed Turbonomic server endpoint (a Kubernetes service in the public cloud cluster) to the kubeturbo private network cluster.

So the kubeturbo can access the Turbonomic server through the Secure Tunnel.

Simplifying the creation of a secure tunnel by using the Turbonomic template:

• Click the Turbonomic tile to open the Turbonomic side panel. Next, click Get started to create a connection. The first connection exposes Turbonomic to the Secure Tunnel server.

• In the Name and Tags section, provide a name and tags for this connection:

  • Connection name: required. The name of the connection. The name can include only lowercase alphanumeric characters and '-', and must start and end with a lowercase alphanumeric character.
  • New tag: optional. The tag of the Connection.

• In the High availability section:

  • Connector replicas: configure the tunnel connector replicas to High Availability
  • Tunnel worker replicas: configure the tunnel connector replicas to High Availability

• In the Application mappings section, edit the Turbonomic server addresses to match your environment.(In particular, check the namespace part of the Turbonomic Kubernetes service address, and check whether it matches the Turbonomic Kubernetes service address). If it is the same as the address in the template, you don't need to change anything.

• Click Create connection to create a Turbonomic connection to expose the Turbonomic server to the public cloud cluster (as a Kubernetes network service), then you get the installation script in the Next steps section. You can install the connector by following this guide or install it later in the Manage connections page, by clicking Action > installation connector.

• Click Next. Install the second connection. This step is the same as the first. The difference is that you cannot change the application address in the Application mappings section. Now create a tunnel connection to export the exposed Turbonomic server from the public cluster (a Kubernetes network service) to the kubeturbo private network cluster. Then, click Create connection to create a Turbonomic connection. You can get the installation script in the Next steps section, and install the connector.

• Finally, select the <the name that you provided in the Name and Tags>-kubeturbo tunnel connection and obtain the application mapping address. Then, you can use this application mapping address as the Turbonomic server address in the kubeturbo. The address is similar to this: http://sre-tunnel-9a4f8fbb26374fa7.tunnel-connector-turbo:8080.

• Install the kubeturbo. Create a Project(namespace), like kubeturbo, to install the kubeturbo operator and instance from the Red Hat OpenShift console OperatorHub. Enter kubeturbo into the All Items field. Click the Kubeturbo Operator panel to install the kubeturbo. After the operator is installed from the Installed Operators > Kubeturbo Operator, click Create instance from the Kubeturbo operator panel. Change to the YAML View and edit the YAML like this:

  spec:
    replicaCount: 1
    restAPIConfig:
      opsManagerPassword: <password of the Turbonomic server>
      opsManagerUserName: <username of the Turbonomic server>
    serverMeta:
      turboServer: '<the turbo server application mapping address, should be like: http://sre-tunnel-9a4f8fbb26374fa7.tunnel-connector-turbo:8080>'
      version: '8'
    targetConfig:
      targetName: <give a name like: tunneltest>
  

Note: Check that the connectors have successfully installed for the two connections. One is in the private Turbonomic server cluster, the other is in the private kubeturbo agent container.

OpenStack connection

Scenario: The OpenStack server is in a private network cluster and IBM Cloud Pak for Watson AIOps is in a public cluster. To integrate with the private OpenStack server, you can use a Secure Tunnel to create an OpenStack connection. The OpenStack template that is described in the following section supports this type of connection. You can create other templates through a custom connection. For more information, see Custom connection.

Custom connection

Secure Tunnel can accommodate specific requirements with a Custom connection. For instance, you can use this type of connection for ChatOps to help you understand how to custom your own connection.

The installation connector in Red Hat OpenShift is automatically supported when you use the ChatOps template. If you don't want to take this approach, you can install the connector in Red Hat OpenShift manually with the Custom method.

Use case summary: IBM Cloud Pak for Watson AIOps is installed. Slack (for ChatOps) is in a public network. To access IBM Cloud Pak for Watson AIOps, expose the IBM Cloud Pak for Watson AIOps instance to the public cluster through a connector that is installed in Red Hat OpenShift.

1. Create a connection to create a bridge configuration for the network where Secure Tunnel is installed and the network that has the connector.

   • Click Custom tile. This opens the Custom side panel. Then, click Get started.

   • In the Name and Tags section, Provide a name and tags for this connection:

     • Connection name: required. The name of the connection. The name can include lowercase alphanumeric characters and '-', and must start and end with a lowercase alphanumeric character.

       • New tag: optional. The tag of the Connection. Add the tag chatops=true in our example.

   • In Direction, specify whether the relationship is connector in private network initializes connection to Secure Tunnel in public network or Secure Tunnel in private network initializes connection to connector in public network. Because Secure Tunnel is in the IBM Cloud Pak for Watson AIOps cluster, you need to choose the option Secure Tunnel in private network initializes connection to connector in public network.

   • In the Connector settings section:

     • Connector location: required. Select whether installation connector is in the Cloud or in a Host machine. Because the connector is installed on Red Hat OpenShift, choose Cloud.

     • Connector replicas: Configure the tunnel connector replicas to set High Availability, 1 - 16, as you need.

     • Cloud domain: If you install the connector in the Cloud direction, the Secure Tunnel in the private network initializes the connection to a connector in a public network. You need to input the cloud domain of the cluster where you installed the connection. Run this command to get the Red Hat OpenShift cluster domain name:

       oc get route -n openshift-console console -o jsonpath={.spec.host} | sed -e 's/[^\.]*\.//
       

       Run this command to get the IBM Kubernetes Service cluster domain name:

       ibmcloud ks cluster get --cluster <Cluster ID> --output json | jq '.ingress.hostname'`
       

     • Host Machine: if you install the connector in a VM or Physical machine, you need:

       • Host machine addresses
         • If your Connection direction is Secure Tunnel in private network initializes connection to connector in public network,* it must include the External address of host machine and Port and Default address of host machine .(Optionally, specify a default IP address when a host machine includes multiple addresses).
         • If your connection direction is Connector in private network initializes connection to Secure Tunnel in public network it must include Default address of host machine (optionally, specify a default IP address when a host machine includes multiple addresses.)
         • Common DNS name for all inbound traffic (optional): required, in this case. Specify a DNS name for all inbound (connector to tunnel) traffic. When multiple host machines are present, you can enter a DNS name or the external IP address or hostname of the machine hosting the reverse proxy/load balancer. Note: do not complete this field unless you have at least one host machine address.
         • Host machine for reverse proxy / load balancer (optional): required, in this case. All inbound (connector to tunnel) traffic is routed to an NGINX-based reverse proxy/load balancer deployed to this host machine during installation of the connector.

     • Connector replicas: configure the tunnel connector replicas to set High Availability.

   • In the Secure Tunnel setting, configure the tunnel worker replicas to set High Availability, limit: 1-16.

   • HTTPS proxy: optional. Specify a forward proxy to enable the Secure Tunnel to reach the connector in the other network, such as username:password@hostname:port.

     Note: It is necessary to enter the HTTPS proxy information when Secure Tunnel is in an air-gapped environment. If your Secure Tunnel is in an air-gapped environment without internet connectivity, you need to prepare a host machine (virtual machine or physical machine), and ensure that the host machine can be accessed from the IBM Cloud Pak for Watson AIOps cluster and also can connect to the internet. Then, install an HTTPS proxy server in the host machine, and set the HTTPS proxy server in the HTTPS proxy field.

   • Allowed list: Specify the IP addresses and ports that are exposed across this connection through application mappings. You can specify address ranges and port ranges. If you do not define an allowed list, the application mapping URL is inaccessible. To expose the IBM Cloud Pak for Watson AIOps instance, input IBM Cloud Pak for Watson AIOps instance address: internal-nginx-svc 12443

   • Click Create connection to initiate a custom connection. In the Next steps page, you install a connector and create application mappings.

2. Follow the Install Secure Tunnel Connector guide to enable the connection.

3. 3. Create Application Mapping to expose the applications to another network (Secure Tunnel side to connector side, or opposite). Set application mappings to expose the IBM Cloud Pak for Watson AIOps instance. Go to the Secure Tunnel Console on the Manage connections tab page, and click the Application mappings of the tunnel connection list. You are redirected to the Application mappings page. You have two ways to create a connection, one is Create from scratch, the other is Copy from template.

• Click Create to open the wizard panel to create an application mapping from scratch.

  • In the Name and Tags section, provide a name and tags for this application mapping:

    • Application mapping name: required. The name of the application mapping name can include lowercase alphanumeric characters and '-', and must start and end with a lowercase alphanumeric character.
      • New tag: optional. The tag of the application. Add a tag chatops=true in our example.

  • In Direction, specify how you expose the application from connector side to Secure Tunnel side or from Secure Tunnel side to connector side. Because the IBM Cloud Pak for Watson AIOps instance is in Secure Tunnel side, in this case, choose from Secure Tunnel side to connector side.

  • In the Application details section,

    • Specify the address of the application and the ports that you want to expose. The address and ports must be included in the allowed list for the connection. Configure DNS so that the application can be accessed by using the original address or the application mapping address (optional) . Input the IBM Cloud Pak for Watson AIOps instance address: internal-nginx-svc, and port: 12443, and the exposed mapping port (default is 12443. Change as you need.). Note: Before you add an IP address or hostname, check the existing application mappings from the Application mappings page in the IBM Cloud Pak Automation console. Check for an existing application mapping. If one is available, check whether the original address is the same IP address or hostname as the new one that you want to specify. Edit the existing mapping to add the new port value instead of creating another application mapping.

    • DNS: Configure DNS so that application can be accessed by using the original address or application mapping address.

    • If you choose to expose the application from the connector side to the Secure Tunnel side in the Direction section, you can optionally configure the Reverse proxy. Toggle each switch to Yes to enable the following:

      • Origin application uses HTTP/HTTPS, and server will check hostname or respond to other URLs of application through HTTP response payload (for example, Falcon LogScale)
      • Origin application uses HTTPS (for example, OpenStack)
      • Origin application responds to other URLs of application through HTTP response payload (for example, OpenStack)

  • In Access rule, you can use access rules to control the traffic flow at the IP address or port level for particular applications in your cluster. The default network policy allows all ingress and egress traffic for each application mapping. Network policy: Network policies help you specify how a pod is allowed to communicate with various network "entities" over the network. Network policies apply to a connection with a pod on one or both ends, and are not relevant to other connections.

• Create application mappings by using an existing template: Click Copy from template button, and the wizard panel opens.

  • Choose a template. You can see the application mappings in this template is displayed in the table.
  • In the table, you can edit the Application Mapping name, Application original address, Application original Port and Application exposed port
  • Click Copy mappings to create application mappings through this connection.

4. Now you have successfully exposed the application as you need. In our example, IBM Cloud Pak for Watson AIOps is exposed to the public network, so you can use the application mapping address to access IBM Cloud Pak for Watson AIOps.