From 714aba8a51eaeb90977525357df59952427cd3c3 Mon Sep 17 00:00:00 2001 From: Adrian Date: Thu, 27 Oct 2016 21:34:38 -0700 Subject: [PATCH] [hrm] Improve docs and network creation (#3774) Several minor fixes for HRM: - Make the `ucp-hrm` network encrypted by default - Add a `ucp-hrm` access label to the ucp-hrm label so groups can be granted the ability to put services on this network (since we have no `docker network update` command) - Remove a few lingering `lb` identifiers in the UI code - Document the polling interval and the access label --- configuration/route-hostnames.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/configuration/route-hostnames.md b/configuration/route-hostnames.md index 4aaa2790eb..ab2d8cf5de 100644 --- a/configuration/route-hostnames.md +++ b/configuration/route-hostnames.md @@ -69,6 +69,9 @@ $ docker service create -p 80:8080 \ --label com.docker.ucp.mesh.http=http://foo.example.com mywebserver ``` +The HTTP Routing Mesh checks for new services every 60 seconds, so it may take +up to one minute for configuration to complete. + Next, you will need to route the referenced domains to the HTTP routing mesh. ## Route domains to the HTTP routing mesh @@ -85,6 +88,13 @@ the HTTP routing mesh are disconnected from the **ucp-hrm** network. Next, go to the **UCP web UI**, navigate to the **Settings** page, and click the **Routing Mesh** tab. Uncheck the checkbox to disable the HTTP routing mesh. +## Access Control + +To route a domain to the HTTP Routing Mesh, the service must be on the +`ucp-hrm` network which has the `ucp-hrm` access label. Adding a service to +this network either requires administrator-level access, or the user must be in +a group that gives them `ucp-hrm` access. + ## Troubleshoot Check the logs of the `ucp-controller` containers on your UCP controller nodes