Chapter 1. Services overview

Create the inbound and outbound firewall rules on your Microsoft Azure environment to open the IP security NAT traversal ports (by default 4500/UDP) to enable Submariner communication:

# create inbound nat rule
$ az network lb inbound-nat-rule create --lb-name <lb-name> \
--resource-group <res-group> \
--name <name> \
--protocol Udp --frontend-port <ipsec-port> \
--backend-port <ipsec-port> \
--frontend-ip-name <frontend-ip-name>

# add your vm network interface to the created inbound nat rule
$ az network nic ip-config inbound-nat-rule add \
--lb-name <lb-name> --resource-group <res-group> \
--inbound-nat-rule <nat-name> \
--nic-name <nic-name> --ip-config-name <pipConfig>

Replace lb-name with your load balancer name.

Replace res-group with your resource group name.

Replace nat-name with your load balancing inbound NAT rule name.

Replace ipsec-port with your IPsec port.

Replace pipConfig with your cluster frontend IP configuration name.

Replace nic-name with your network interface card (NIC) name.

Create one load balancing inbound NAT rules to forward Submariner gateway metrics service request:

# create inbound nat rule
$ az network lb inbound-nat-rule create --lb-name <lb-name> \
--resource-group <res-group> \
--name <name> \
--protocol Tcp --frontend-port 8080 --backend-port 8080 \
--frontend-ip-name <frontend-ip-name>

# add your vm network interface to the created inbound nat rule
$ az network nic ip-config inbound-nat-rule add \
--lb-name <lb-name> --resource-group <res-group> \
--inbound-nat-rule <nat-name> \
--nic-name <nic-name> --ip-config-name <pipConfig>

Replace lb-name with your load balancer name.

Replace res-group with your resource group name.

Replace nat-name with your load balancing inbound NAT rule name.

Replace pipConfig with your cluster frontend IP configuration name.

Replace nic-name with your network interface card (NIC) name.

Create network security groups {NSG) security rules on your Azure to open a NAT traversal port (by default 4500/UDP) for Submariner:

$ az network nsg rule create --resource-group <res-group> \
--nsg-name <nsg-name> --priority <priority> \
--name <name> --direction Inbound --access Allow \
--protocol Udp --destination-port-ranges <ipsec-port>

$ az network nsg rule create --resource-group <res-group> \
--nsg-name <nsg-name> --priority <priority> \
--name <name> --direction Outbound --access Allow \
--protocol Udp --destination-port-ranges <ipsec-port>
Replace `res-group` with your resource group name.
+
Replace `nsg-name` with your NSG name.
+
Replace `priority` with your rule priority.
+
Replace `name` with your rule name.
+
Replace `ipsec-port` with your IPsec port.

Create the NSG rules to open 4800/UDP port to encapsulate pod traffic from the worker and master nodes to the Submariner Gateway nodes:

$ az network nsg rule create --resource-group <res-group> \
--nsg-name <nsg-name> --priority <priority> \
--name <name> --direction Inbound --access Allow \
--protocol Udp --destination-port-ranges 4800 \

$ az network nsg rule create --resource-group <res-group> \
--nsg-name <nsg-name> --priority <priority> \
--name <name> --direction Outbound --access Allow \
--protocol Udp --destination-port-ranges 4800

Replace res-group with your resource group name.

Replace nsg-name with your NSG name.

Replace priority with your rule priority.

Replace name with your rule name.

Create the NSG rules to open 8080/TCP port to export metrics service from the Submariner Gateway nodes:

$ az network nsg rule create --resource-group <res-group> \
--nsg-name <nsg-name> --priority <priority> \
--name <name> --direction Inbound --access Allow \
--protocol Tcp --destination-port-ranges 8080 \

$ az network nsg rule create --resource-group <res-group> \
--nsg-name <nsg-name> --priority <priority> \
--name <name> --direction Outbound --access Allow \
--protocol Udp --destination-port-ranges 8080

Replace res-group with your resource group name.

Replace nsg-name with your NSG name.

Replace priority with your rule priority.

Replace name with your rule name.

Create a ManagedClusterSet on the hub cluster by using the instructions provided in Creating and managing ManagedClusterSets. Your entry for the ManagedClusterSet should resemble the following content:

apiVersion: cluster.open-cluster-management.io/v1alpha1
kind: ManagedClusterSet
metadata:
  name: <managed-cluster-set-name>

Replace managed-cluster-set-name with a name for the ManagedClusterSet that you are creating.

Note: The maximum length of the name of the Kubernetes namespace is 63 characters, so the maximum length of the <managed-cluster-set-name> is 56 characters. If the length of <managed-cluster-set-name> exceeds 56, the <managed-cluster-set-name> is truncated from the head.

After the ManagedClusterSet is created, the submariner-addon creates a namespace called <managed-cluster-set-name>-broker and deploys the Submariner broker to it.

Add one managed cluster to the ManagedClusterSet by entering the following command:

oc label managedclusters <managed-cluster-name> "cluster.open-cluster-management.io/clusterset=<managed-cluster-set-name>" --overwrite

Replace <managed-cluster-name> with the name of the managed cluster that you want to add to the ManagedClusterSet.

Replace <managed-cluster-set-name> with the name of the ManagedClusterSet to which you want to add the managed cluster.

Deploy Submariner on the managed cluster by entering the following command:

cat << EOF | oc apply -f -
apiVersion: addon.open-cluster-management.io/v1alpha1
kind: ManagedClusterAddOn
metadata:
     name: submariner
     namespace: <managed-cluster-name>
spec:
     installNamespace: submariner-operator

Replace managed-cluster-name with the name of the managed cluster that you want to use with Submariner.

The installNamespace field in the spec of the ManagedClusterAddOn is the namespace on the managed cluster where it installs Submariner. Currently, Submariner must be installed in the submariner-operator namespace.

After the ManagedClusterAddOn is created, the submariner-addon deploys Submariner to the submariner-operator namespace on the managed cluster. You can view the deployment status of Submariner from the status of this ManagedClusterAddOn.

Note: The name of ManagedClusterAddOn must be submariner.

After Submariner is deployed on the managed cluster, you can verify the Submariner deployment status by checking the status of submariner ManagedClusterAddOn by entering the following command:

oc -n <managed-cluster-name> get managedclusteraddons submariner -oyaml

Replace managed-cluster-name with the name of the managed cluster.

In the status of the Submariner ManagedClusterAddOn, three conditions indicate the deployment status of Submariner: