Chapter 5. Postinstallation configuration

Procedure

1. In the web console, click Networking NetworkAttachmentDefinitions.

2. Click Create Network Attachment Definition.

   Note

   The network attachment definition must be in the same namespace as the pod or virtual machine.

3. Enter a unique Name and optional Description.
4. Select CNV Linux bridge from the Network Type list.
5. Enter the name of the bridge in the Bridge Name field.
6. Optional: If the resource has VLAN IDs configured, enter the ID numbers in the VLAN Tag Number field.
7. Optional: Select MAC Spoof Check to enable MAC spoof filtering. This feature provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.
8. Click Create.

Procedure

1. Create a

   NetworkAttachmentDefinition

   manifest according to the following example:

   Example configuration file

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition
   metadata:
     name: my-secondary-network
     namespace: openshift-cnv
   spec:
     config: '{
       "cniVersion": "0.3.1",
       "name": "migration-bridge",
       "type": "macvlan",
       "master": "eth1",
       "mode": "bridge",
       "ipam": {
         "type": "whereabouts",
         "range": "10.200.5.0/24"
       }
     }'

   • metadata.name

     specifies the name of the

     NetworkAttachmentDefinition

     object.

   • config.master

     specifies the name of the NIC to be used for live migration.

   • config.type

     specifies the name of the CNI plugin that provides the network for the NAD.

   • config.range

     specifies an IP address range for the secondary network. This range must not overlap the IP addresses of the main network.

2. Open the

   HyperConverged

   CR in your default editor by running the following command:

   $ oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv

3. Add the name of the

   NetworkAttachmentDefinition

   object to the

   spec.liveMigrationConfig

   stanza of the

   HyperConverged

   CR:

   Example HyperConverged manifest

   apiVersion: hco.kubevirt.io/v1beta1
   kind: HyperConverged
   metadata:
     name: kubevirt-hyperconverged
     namespace: openshift-cnv
   spec:
     liveMigrationConfig:
       completionTimeoutPerGiB: 800
       network: <network>
       parallelMigrationsPerCluster: 5
       parallelOutboundMigrationsPerNode: 2
       progressTimeout: 150
   # ...

   • spec.liveMigrationConfig.network

     specifies the name of the Multus

     NetworkAttachmentDefinition

     object to be used for live migrations.
4. Save your changes and exit the editor. The

   virt-handler

   pods restart and connect to the secondary network.

Procedure

1. Go to Virtualization > Overview in the OpenShift Container Platform web console.
2. Click the Settings tab and then click Live migration.
3. Select the network from the Live migration network list.

Procedure

1. Create an

   SriovNetworkNodePolicy

   object, and then save the YAML in the

   <name>-sriov-node-network.yaml

   file. Replace

   <name>

   with the name for this configuration.

   apiVersion: sriovnetwork.openshift.io/v1
   kind: SriovNetworkNodePolicy
   metadata:
     name: <name>
     namespace: openshift-sriov-network-operator
   spec:
     resourceName: <sriov_resource_name>
     nodeSelector:
       feature.node.kubernetes.io/network-sriov.capable: "true"
     priority: <priority>
     mtu: <mtu>
     numVfs: <num>
     nicSelector:
       vendor: "<vendor_code>"
       deviceID: "<device_id>"
       pfNames: ["<pf_name>", ...]
       rootDevices: ["<pci_bus_id>", "..."]
     deviceType: vfio-pci
     isRdma: false

   • metadata.name

     specifies a name for the

     SriovNetworkNodePolicy

     object.

   • metadata.namespace

     specifies the namespace where the SR-IOV Network Operator is installed.

   • spec.resourceName

     specifies the resource name of the SR-IOV device plugin. You can create multiple

     SriovNetworkNodePolicy

     objects for a resource name.

   • spec.nodeSelector.feature.node.kubernetes.io/network-sriov.capable

     specifies the node selector to select which nodes are configured. Only SR-IOV network devices on selected nodes are configured. The SR-IOV Container Network Interface (CNI) plugin and device plugin are deployed only on selected nodes.

   • spec.priority

     is an optional field that specifies an integer value between

     0

     and

     99

     . A smaller number gets higher priority, so a priority of

     10

     is higher than a priority of

     99

     . The default value is

     99

     .

   • spec.mtu

     is an optional field that specifies a value for the maximum transmission unit (MTU) of the virtual function. The maximum MTU value can vary for different NIC models.

   • spec.numVfs

     specifies the number of the virtual functions (VF) to create for the SR-IOV physical network device. For an Intel network interface controller (NIC), the number of VFs cannot be larger than the total VFs supported by the device. For a Mellanox NIC, the number of VFs cannot be larger than

     127

     .

   • spec.nicSelector

     selects the Ethernet device for the Operator to configure. You do not need to specify values for all the parameters.
     Note

     It is recommended to identify the Ethernet adapter with enough precision to minimize the possibility of selecting an Ethernet device unintentionally. If you specify

     rootDevices

     , you must also specify a value for

     vendor

     ,

     deviceID

     , or

     pfNames

     .

     If you specify both

     pfNames

     and

     rootDevices

     at the same time, ensure that they point to an identical device.

   • spec.nicSelector.vendor

     is an optional field that specifies the vendor hex code of the SR-IOV network device. The only allowed values are either

     8086

     or

     15b3

     .

   • spec.nicSelector.deviceID

     is an optional field that specifies the device hex code of SR-IOV network device. The only allowed values are

     158b

     ,

     1015

     ,

     1017

     .

   • spec.nicSelector.pfNames

     is an optional field that specifies an array of one or more physical function (PF) names for the Ethernet device.

   • spec.nicSelector.rootDevices

     is an optional field that specifies an array of one or more PCI bus addresses for the physical function of the Ethernet device. Provide the address in the following format:

     0000:02:00.1

     .

   • spec.deviceType

     specifies the driver type. The

     vfio-pci

     driver type is required for virtual functions in OpenShift Virtualization.

   • spec.isRdma

     is an optional field that specifies whether to enable remote direct memory access (RDMA) mode. For a Mellanox card, set

     isRdma

     to

     false

     . The default value is

     false

     .
     Note

     If

     isRDMA

     flag is set to

     true

     , you can continue to use the RDMA enabled VF as a normal network device. A device can be used in either mode.

2. Optional: Label the SR-IOV capable cluster nodes with

   SriovNetworkNodePolicy.Spec.NodeSelector

   if they are not already labeled. For more information about labeling nodes, see "Understanding how to update labels on nodes".

3. Create the

   SriovNetworkNodePolicy

   object. When running the following command, replace

   <name>

   with the name for this configuration:

   $ oc create -f <name>-sriov-node-network.yaml

   After applying the configuration update, all the pods in

   sriov-network-operator

   namespace transition to the

   Running

   status.

4. To verify that the SR-IOV network device is configured, enter the following command. Replace

   <node_name>

   with the name of a node with the SR-IOV network device that you just configured.

   $ oc get sriovnetworknodestates -n openshift-sriov-network-operator <node_name> -o jsonpath='{.status.syncStatus}'

Procedure

1. Create a

   storageclass_csi.yaml

   file to define the storage class:

   apiVersion: storage.k8s.io/v1
   kind: StorageClass
   metadata:
     name: hostpath-csi
   provisioner: kubevirt.io.hostpath-provisioner
   reclaimPolicy: Delete 

   1

   
   volumeBindingMode: WaitForFirstConsumer 

   2

   
   parameters:
     storagePool: my-storage-pool 

   3

   • reclaimPolicy

     specifies whether the underlying storage is deleted or retained when a user deletes a PVC. The two possible

     reclaimPolicy

     values are

     Delete

     and

     Retain

     . If you do not specify a value, the default value is

     Delete

     .

   • volumeBindingMode

     specifies the timing of PV creation. The

     WaitForFirstConsumer

     configuration in this example means that PV creation is delayed until a pod is scheduled to a specific node.

   • parameters.storagePool

     specifies the name of the storage pool defined in the HPP custom resource (CR).
2. Save the file and exit.

3. Create the

   StorageClass

   object by running the following command:

   $ oc create -f storageclass_csi.yaml