// Module included in the following assemblies:
//
// * microshift_configuring/microshift-ingress-controller.adoc

:_mod-docs-content-type: CONCEPT
[id="microshift-ingress-control-concept_{context}"]
= Using ingress control in {microshift-short}

[role="_abstract"]
When you create your {microshift-short} node, each pod and service running on the node is allocated an IP address. These IP addresses are accessible to other pods and services running nearby by default, but are not accessible to external clients. {microshift-short} uses a minimal implementation of the {OCP} `IngressController` API to enable external access to node services.

With more configuration options, you can fine-tune ingress to meet your specific needs. To use enhanced ingress control, update the parameters in the {microshift-short} configuration file and restart the service.

Ingress configuration is useful in a variety of ways, for example:

Accommodate server response speed::
* If your application starts processing requests from clients but the connection closes before it can respond, you can set the `ingress.tuningOptions.serverTimeout` parameter in the configuration file to a higher value to accommodate the speed of the response from the server.

Closing router connections::
* If the router has many connections open because an application running on the node does not close connections properly, you can set the `ingress.tuningOptions.serverTimeout` and `spec.tuningOptions.serverFinTimeout` parameters to a lower value, forcing those connections to close sooner.

Verify client certificates::
* If you need to configure the ingress controller to verify client certificates, you can use the `ingress.clientTLS` parameter to set a clientCA value, which is a reference to a config map. The config map contains the PEM-encoded CA certificate bundle that is used to verify a client's certificate. Optionally, you can also configure a list of certificate subject filters.

Configure a TLS security profile::
* If you need to configure a TLS security profile for an ingress controller, you can use the `ingress.tlsSecurityProfile` parameter to specify a default or custom individual TLS security profiles. The TLS security profile defines the minimum TLS version and the TLS ciphers for TLS connections for the ingress controllers.
If a TLS security profile is not configured, the default value is based on the TLS security profile set for the API server.

Create policies for new route claims::
* If you need to define a policy for handling new route claims, you can use the `routeAdmission` parameter to allow or deny claims across namespaces. Set the `routeAdmission` parameter to describe how hostname claims across namespaces should be handled and to describe how the ingress controller handles routes with wildcard policies.

Customize error pages::
* If you want more than the default error pages, which are usually empty and only return the HTTP status code, configure custom error pages.

Capture HTTP headers or cookies::
* If you want to include the capture of HTTP headers or cookies, configure them in the access logging.
