Chapter 14. Networking for hosted control planes

Verification

1. Verify that the hosted configuration is correct by entering the following command:

   $ oc get hostedcluster <hosted_cluster_name> -n <hosted_control_plane_namespace> \
     -o jsonpath='{.spec.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig}' | jq .

   Copy to Clipboard Toggle word wrap

   Example output

   {
     "ipv4": {
       "internalJoinSubnet": "100.99.0.0/16",
       "internalTransitSwitchSubnet": "100.69.0.0/16"
     }
   }

   Copy to Clipboard Toggle word wrap

2. Check the Network Operator configuration in the hosted cluster:

   1. Extract the hosted cluster kubeconfig file by entering the following command:

      $ oc extract secret/<hosted_cluster_name>-admin-kubeconfig \
        -n <hosted_control_plane_namespace> --to=- > <hosted_cluster_kubeconfig_file>

      Copy to Clipboard Toggle word wrap

   2. Verify the Network Operator configuration by entering the following command:

      $ oc get network.operator.openshift.io cluster \
        --kubeconfig=<hosted_cluster_kubeconfig_file> \
        -o jsonpath='{.spec.defaultNetwork.ovnKubernetesConfig.ipv4}' | jq .

      Copy to Clipboard Toggle word wrap

      Example output

      {
        "internalJoinSubnet": "100.99.0.0/16",
        "internalTransitSwitchSubnet": "100.69.0.0/16"
      }

      Copy to Clipboard Toggle word wrap

3. Create 2 test pods by completing the following steps:

   1. In node 1, create pod 1, as shown in the following example:

      kind: Pod
      apiVersion: v1
        metadata:
          name: "<pod_1>"
          namespace: "<hosted_control_plane_namespace>"
          labels:
            name: <pod_name>
        spec:
          securityContext:
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          containers:
          - image: "<image_url>"
            name: <pod_name>
            securityContext:
              allowPrivilegeEscalation: false
              capabilities:
                drop: ["ALL"]
          nodeName: "${NODE1}"

      Copy to Clipboard Toggle word wrap

   2. In node 2, create pod 2, as shown in the following example:

      kind: Pod
      apiVersion: v1
        metadata:
          name: "<pod_2>"
          namespace: "<hosted_control_plane_namespace>"
          labels:
            name: <pod_name>
        spec:
          securityContext:
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          containers:
          - image: "<image_url>"
            name: <pod_name>
            securityContext:
              allowPrivilegeEscalation: false
              capabilities:
                drop: ["ALL"]
          nodeName: "${NODE2}"

      Copy to Clipboard Toggle word wrap

4. Create a test service that backs up both pods, as shown in the following example:

   kind: Service
   apiVersion: v1
     metadata:
       name: "<test_service_name"
       namespace: "<hosted_control_plane_namespace>"
       labels:
         name: test-service
     spec:
       internalTrafficPolicy: "Cluster"
       externalTrafficPolicy: ""
       ipFamilyPolicy: "SingleStack"
       ports:
       - name: http
         port: <service_test_port_number>
         protocol: "TCP"
         targetPort: 8080
       selector:
         name: "<pod_name>"
       type: "ClusterIP"

   Copy to Clipboard Toggle word wrap

5. Verify that the OVN pods are running:

   1. Enter the following command:

      $ oc rollout status daemonset/ovnkube-node \
        -n openshift-ovn-kubernetes \
        --kubeconfig=<hosted_cluster_kubeconfig_file> \
        --timeout=5m

      Copy to Clipboard Toggle word wrap

   2. Enter the following command:

      $ oc get pods -n openshift-ovn-kubernetes --kubeconfig=<hosted_cluster_kubeconfig_file>

      Copy to Clipboard Toggle word wrap

      All ovnkube-node pods should be in Running state with all containers ready.

6. Make sure that the changes synchronized to the Network Operator by entering the following command:

   $ oc get network.operator.openshift.io/cluster \
     -ojsonpath='{.spec.defaultNetwork.ovnKubernetesConfig.ipv4}' \
     --kubeconfig=<clusters-hostedclustername> | jq .

   Copy to Clipboard Toggle word wrap

7. Get the IP address of pod 2 and transfer it from pod 1:

   1. Enter the following command:

      $ pod2_ip=oc get pod -n e2e-test-networking-ovnkubernetes-xxt8s <pod_2> -o=jsonpath={.status.podIPs[0].ip}

      Copy to Clipboard Toggle word wrap

   2. Enter the following command:

      $ oc exec <pod_1> -- /bin/sh -x -c curl --connect-timeout 5 -s <pod2_ip>:8080

      Copy to Clipboard Toggle word wrap

8. Get the service IP address and verify that the pod can be visited externally from a service:

   1. Enter the following command:

      $ SERVICE_IP=oc get service test-service-o=jsonpath={.spec.clusterIPs[0]}

      Copy to Clipboard Toggle word wrap

   2. Enter the following command:

      $ oc exec <pod_1> -- /bin/sh -x -c curl --connect-timeout 5 -s $SERVICE_IP:<service_test_port_number>

      Copy to Clipboard Toggle word wrap