Chapter 6. Post-installation network configuration

• Your cluster infrastructure must allow access to the ports that you specify within the expanded range. For example, if you expand the node port range to 30000-32900, the inclusive port range of 32768-32900 must be allowed by your firewall or packet filtering configuration.

• Deny all traffic:

  To make a project deny by default, add a NetworkPolicy object that matches all pods but accepts no traffic:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: deny-by-default
  spec:
    podSelector: {}
    ingress: []

• Only allow connections from the OpenShift Container Platform Ingress Controller:

  To make a project allow only connections from the OpenShift Container Platform Ingress Controller, add the following NetworkPolicy object.

  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: allow-from-openshift-ingress
  spec:
    ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            network.openshift.io/policy-group: ingress
    podSelector: {}
    policyTypes:
    - Ingress

• Only accept connections from pods within a project:

  To make pods accept connections from other pods in the same project, but reject all other connections from pods in other projects, add the following NetworkPolicy object:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-same-namespace
  spec:
    podSelector: {}
    ingress:
    - from:
      - podSelector: {}

• Only allow HTTP and HTTPS traffic based on pod labels:

  To enable only HTTP and HTTPS access to the pods with a specific label (role=frontend in following example), add a NetworkPolicy object similar to the following:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-http-and-https
  spec:
    podSelector:
      matchLabels:
        role: frontend
    ingress:
    - ports:
      - protocol: TCP
        port: 80
      - protocol: TCP
        port: 443

• Accept connections by using both namespace and pod selectors:

  To match network traffic by combining namespace and pod selectors, you can use a NetworkPolicy object similar to the following:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-pod-and-namespace-both
  spec:
    podSelector:
      matchLabels:
        name: test-pods
    ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              project: project_name
          podSelector:
            matchLabels:
              name: test-pods

Prerequisites

• Your cluster uses a cluster network provider that supports NetworkPolicy objects, such as the OVN-Kubernetes network provider or the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.
• You installed the OpenShift CLI (oc).
• You are logged in to the cluster with a user with admin privileges.

• Red Hat OpenShift Container Platform version 4.9 or later.
• Red Hat OpenShift Dedicated version 4.
• Azure Red Hat OpenShift (ARO) version 4.
• Red Hat OpenShift Service on AWS (ROSA).

• OpenShift Online is not supported for Red Hat OpenShift Service Mesh.
• Red Hat OpenShift Service Mesh does not support the management of microservices outside the cluster where Service Mesh is running.

• OpenShift-SDN
• OVN-Kubernetes is supported on OpenShift Container Platform 4.7.32+, OpenShift Container Platform 4.8.12+, and OpenShift Container Platform 4.9+.
• Third-Party Container Network Interface (CNI) plugins that have been certified on OpenShift Container Platform and passed Service Mesh conformance testing. See Certified OpenShift CNI Plug-ins for more information.

• This release of Red Hat OpenShift Service Mesh is only available on OpenShift Container Platform x86_64, IBM Z, and IBM Power Systems.

  • IBM Z is only supported on OpenShift Container Platform 4.6 and later.
  • IBM Power Systems is only supported on OpenShift Container Platform 4.6 and later.
• Configurations where all Service Mesh components are contained within a single OpenShift Container Platform cluster.
• Configurations that do not integrate external services such as virtual machines.
• Red Hat OpenShift Service Mesh does not support EnvoyFilter configuration except where explicitly documented.

• The Kiali console is only supported on the two most recent releases of the Chrome, Edge, Firefox, or Safari browsers.

• Jaeger agent as a sidecar is the only supported configuration for Jaeger. Jaeger as a daemonset is not supported for multitenant installations or OpenShift Dedicated.

• 3scale WebAssembly is the only provided WebAssembly module. You can create custom WebAssembly modules.

• OpenShift Elasticsearch - (Optional) Provides database storage for tracing and logging with the distributed tracing platform. It is based on the open source Elasticsearch project.
• Red Hat OpenShift distributed tracing platform - Provides distributed tracing to monitor and troubleshoot transactions in complex distributed systems. It is based on the open source Jaeger project.
• Kiali - Provides observability for your service mesh. Allows you to view configurations, monitor traffic, and analyze traces in a single console. It is based on the open source Kiali project.
• Red Hat OpenShift Service Mesh - Allows you to connect, secure, control, and observe the microservices that comprise your applications. The Service Mesh Operator defines and monitors the ServiceMeshControlPlane resources that manage the deployment, updating, and deletion of the Service Mesh components. It is based on the open source Istio project.

Next steps

• Install Red Hat OpenShift Service Mesh in your OpenShift Container Platform environment.

• HTTP keep-alive/close mode
• Route type
• TLS session resumption client support
• Number of concurrent connections per target route
• Number of target routes
• Back end server page size
• Underlying infrastructure (network/SDN solution, CPU, and so on)

Prerequisites

• OpenShift Container Platform cluster must be installed
• Floating IP addresses are enabled as described in the OpenShift Container Platform on RHOSP installation documentation.

• The enablePortPoolsPrepopulation parameter controls pool prepopulation, which forces Kuryr to add ports to the pool when it is created, such as when a new host is added, or a new namespace is created. The default value is false.
• The poolMinPorts parameter is the minimum number of free ports that are kept in the pool. The default value is 1.

• The poolMaxPorts parameter is the maximum number of free ports that are kept in the pool. A value of 0 disables that upper bound. This is the default setting.

  If your OpenStack port quota is low, or you have a limited number of IP addresses on the pod network, consider setting this option to ensure that unneeded ports are deleted.

• The poolBatchPorts parameter defines the maximum number of Neutron ports that can be created at once. The default value is 3.

Prerequisites

• You have an active cluster.
• You installed the OpenShift CLI (oc).