Get ready to install Connectivity Link

As you plan your Connectivity Link install, ensure that you have access to the required platforms in your environment with the correct user permissions. You can also decide whether to use optional supported components, such as rate limiting and Observability.

Required platforms and components

The following platforms and components are required to install Connectivity Link successfully:

Red Hat account

You have a Red Hat account with subscriptions for Connectivity Link and OpenShift Container Platform.

OpenShift Container Platform

OpenShift Container Platform 4.18 or later is installed, or you have access to a supported OpenShift Container Platform cloud service. For more information, see "OpenShift Container Platform installation documentation".

Important

When using the Gateway API custom resource definitions (CRDs) provided in OpenShift Container Platform 4.19 or newer, you must create a GatewayClass named openshift-default and specify a controllerName of openshift.io/gateway-controller/v1. For more details, see "Getting started with Gateway API for the Ingress Operator" in the OpenShift Container Platform documentation.
OpenShift Service Mesh

A separate OpenShift Service Mesh installation is not required with Connectivity Link 1.3 or newer. If you use OpenShift Service Mesh, ensure that you are using 3.4 to stay in a supported configuration.

cert-manager Operator for Red Hat OpenShift

You installed cert-manager Operator for Red Hat OpenShift 1.19 to manage the TLS certificates for your gateways. See the "cert-manager Operator for Red Hat OpenShift documentation".

Important

Before using a Connectivity Link TLSPolicy custom resource (CR), you must set up a certificate issuer for your cloud provider platform. See the "OpenShift documentation on configuring an ACME issuer".

Prerequisites for other components

The following components are optional with Connectivity Link. You can decide what you want to use and plan for those configurations before beginning your installation.

DNSPolicy

For a DNSPolicy CR, you can use a cloud DNS provider or coreDNS. If you are using a cloud provider, you must have an account for one of the supported DNS providers and have set up a hosted zone for Connectivity Link. For more details, see your cloud DNS provider documentation:

  • "Amazon Route 53 documentation"

  • "Google Cloud DNS documentation"

  • "Microsoft Azure DNS documentation"

RateLimitPolicy

For RateLimitPolicy CRs, if you require a shared counter in multicluster environment, you can use a Redis-based datastore. For details on how to install and configure a secure and highly available datastore, see the documentation for your Redis-compatible datastore:

  • "Redis documentation"

  • "AWS ElastiCache (Redis OSS) User Guide"

  • "Dragonfly documentation"

  • "Valkey documentation"

AuthPolicy

For an AuthPolicy CR, you can install Red Hat build of Keycloak if required in your environment. For more details, see the "Red Hat build of Keycloak documentation".

Observability

For Observability, you must configure OpenShift Container Platform user workload monitoring to remote-write to a central storage system.

Supported configurations with Connectivity Link

Connectivity Link must run on a supported version of OpenShift Container Platform. If you want to use TLS policies, cert-manager Operator for Red Hat OpenShift must be also be installed. Connectivity Link is supported on x86_64a and AArch64 (ARM) architectures.

To configure observability, use Red Hat OpenShift Service Mesh.

Red Hat provides both production and development support for supported configurations and tested integrations according to your subscription agreement.

Important

If you use a configuration that includes OpenShift Container Platform 4.18 or older, you must also use Red Hat OpenShift Service Mesh as the Gateway API provider.
Supported OpenShift Container Platform version configurations
Red Hat Connectivity Link Red Hat OpenShift Container Platform Red Hat OpenShift Dedicated Red Hat OpenShift Service on AWS Microsoft Azure Red Hat OpenShift

1.4

4.22, 4.21, 4.20, 4.19

4.22, 4.21, 4.20, 4.19

4.22, 4.21, 4.20, 4.19

4.19, 4.20

1.3

4.21, 4.20, 4.19, 4.18

4.21, 4.20, 4.19, 4.18

4.21, 4.20, 4.19, 4.18

4.19

1.2

4.20, 4.19, 4.18

4.20, 4.19, 4.18

4.20, 4.19, 4.18

4.17

For Microsoft Azure, see the Support lifecycle for Azure Red Hat OpenShift 4.

See also "Platform Agnostic Operators".

Supported Operators
Red Hat Connectivity Link Red Hat OpenShift Service Mesh cert-manager Operator for Red Hat OpenShift

Version 1.4

3.3, 3.4

1.19

Version 1.3

3.2

1.18

Version 1.2

3.1

1.17
Supported cloud providers

All versions of Connectivity Link support the following platforms as backing cloud providers for OpenShift Container Platform:

  • Amazon Web Services

  • Google Cloud Platform

  • Microsoft Azure

For more information, see the documentation for your chosen cloud provider.

Supported cloud DNS providers

For DNS policies, all supported versions of Connectivity Link support the following cloud DNS providers:

  • Amazon Route 53

  • Google Cloud Platform DNS

  • Microsoft Azure DNS

For more information, see the documentation for your chosen cloud DNS provider.

Supported on-premise DNS providers

You can use CoreDNS can to configure an on-cluster DNS zone. For more information, see "Using on-premise DNS with CoreDNS".

Supported data stores for rate limiting

For rate limiting policies, Connectivity Link supports the following Redis-based data stores for rate limit counters in multicluster environments:

Red Hat Connectivity Link Redis Enterprise or Cloud Amazon ElastiCache Dragonfly Community or Cloud Valkey

1.4

8.6.2

latest

1.39.0

9.x.x

1.3

latest

latest

latest

latest

1.2

latest

latest

latest

latest

For more information, see the documentation for your chosen Redis-based datastore.

Supported identity access management

For authentication policies, Connectivity Link supports API keys and the following product versions:

Red Hat Connectivity Link Red Hat build of Keycloak

1.4

26.6

1.3

26.4

1.2

26.4

For more information, see "Supported Configurations for Red Hat build of Keycloak".

Additional resources

Understand how and when you can use the Connectivity Link core policies and observability features with your cloud applications and APIs.

Secure your applications with TLSPolicy

  • TLSPolicy is a lightweight wrapper API to manage TLS for targeted gateways.

  • Automatically provision TLS certificates based on the gateway listener hosts by using integration with cert-manager and ACME providers such as Let’s Encrypt.

  • Configure secrets so that the gateway automatically retrieves them.

Protect your applications with AuthPolicy

  • Use AuthPolicy objects to apply authentication and authorization across your selected listeners in a gateway or at the HTTPRoute or HTTPRouteRule level.

  • Use the hierarchical and role-based concept of defaults and overrides to improve collaboration and ensure compliance.

  • Use dedicated OIDC authentication providers such as Red Hat build of Keycloak.

  • Apply fine-grained authorization requirements based on request and metadata attributes.

Protect your applications with RateLimitPolicy

  • Apply rate-limiting rules across all listeners in a gateway or at the HTTPRoute or HTTPRouteRule level.

  • Use the role-based and hierarchical concept of defaults and overrides to improve collaboration and ensure compliance.

  • Configure limits conditionally based on metadata and request data.

  • Share counters by using a backend store in multicluster environments.

Connect your applications with DNSPolicy

  • DNSPolicy is a standard API that is not based on custom annotations.

  • Automatically populate DNS records based on listener hosts and addresses expressed by Gateway API resources.

  • Configure multicluster connectivity and routing options, for example, geographic and weighted responses.

  • Use common cloud DNS providers: Amazon Route 53, Microsoft Azure DNS, Google Cloud DNS, or CoreDNS.

  • Configure health checks to enable DNS failover.

Observe your ingress traffic

You can use the Connectivity Link observability features to observe and monitor your gateways, applications, and APIs on OpenShift Container Platform. You can download and use community-based templates to integrate with Grafana, Prometheus, and Alertmanager deployments, or use these templates as starting points to modify for your specific needs.

↑ Up: Plan | ⌂ Home: Red Hat Connectivity Link | Next: Install →