Chapter 2. Configuring private connections

Procedure

1. Log in to the Web Console for the Red Hat OpenShift Service on AWS AWS Account and navigate to the VPC Dashboard in the region where the cluster is being hosted.
2. Go to the Peering Connections page and click the Create Peering Connection button.

3. Verify the details of the account you are logged in to and the details of the account and VPC you are connecting to:

   1. Peering connection name tag: Set a descriptive name for the VPC Peering Connection.
   2. VPC (Requester): Select the Red Hat OpenShift Service on AWS Cluster VPC ID from the list.
   3. Account: Select Another account and provide the Customer AWS Account number *(without dashes).
   4. Region: If the Customer VPC Region differs from the current region, select Another Region and select the customer VPC Region from the list.
   5. VPC (Accepter): Set the Customer VPC ID.
4. Click Create Peering Connection.
5. Confirm that the request enters a Pending state. If it enters a Failed state, confirm the details and repeat the process.

Procedure

1. Log in to the AWS Web Console.
2. Navigate to VPC Service.
3. Go to Peering Connections.
4. Click on Pending peering connection.
5. Confirm the AWS Account and VPC ID that the request originated from. This should be from the Red Hat OpenShift Service on AWS AWS Account and Red Hat OpenShift Service on AWS Cluster VPC.
6. Click Accept Request.

Procedure

1. Log in to the AWS Web Console for the Red Hat OpenShift Service on AWS AWS Account.
2. Navigate to the VPC Service, then Route tables.

3. Select the Route Table for the Red Hat OpenShift Service on AWS Cluster VPC.

   Note

   On some clusters, there may be more than one route table for a particular VPC. Select the private one that has a number of explicitly associated subnets.

4. Select the Routes tab, then Edit.
5. Enter the Customer VPC CIDR block in the Destination text box.
6. Enter the Peering Connection ID in the Target text box.
7. Click Save.

8. You must complete the same process with the other VPC’s CIDR block:

   1. Log into the Customer AWS Web Console VPC Service Route Tables.
   2. Select the Route Table for your VPC.
   3. Select the Routes tab, then Edit.
   4. Enter the Red Hat OpenShift Service on AWS Cluster VPC CIDR block in the Destination text box.
   5. Enter the Peering Connection ID in the Target text box.
   6. Click Save changes.

Procedure

1. Verify the tunnel is up in AWS.

   1. From the VPC Dashboard, under Virtual private network (VPN), click on Site-to-Site VPN connections.
   2. Select the VPN connection you created previously and click the Tunnel details tab.
   3. You should see that at least one of the VPN tunnels is in an Up status.

2. Verify the connection.

   To test network connectivity to an endpoint device, nc (or netcat) is a helpful troubleshooting tool. It is included in the default image and provides quick and clear output if a connection can be established:

   1. Create a temporary pod using the busybox image, which cleans up after itself:

      $ oc run netcat-test \
          --image=busybox -i -t \
          --restart=Never --rm \
          -- /bin/sh

      Copy to Clipboard Toggle word wrap

   2. Check the connection using nc.

      • Example successful connection results:

        / nc -zvv 192.168.1.1 8080
        10.181.3.180 (10.181.3.180:8080) open
        sent 0, rcvd 0

        Copy to Clipboard Toggle word wrap

      • Example failed connection results:

        / nc -zvv 192.168.1.2 8080
        nc: 10.181.3.180 (10.181.3.180:8081): Connection refused
        sent 0, rcvd 0

        Copy to Clipboard Toggle word wrap

   3. Exit the container, which automatically deletes the Pod:

      / exit

      Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select VPC from the Services menu.
3. From Virtual private network (VPN), select Virtual private gateways.
4. Select Create virtual private gateway.
5. Give the virtual private gateway a suitable name in the Details field.
6. Click Custom ASN and enter the Amazon side ASN value gathered previously or use the Amazon Provided ASN.
7. Click Create virtual private gateway.
8. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
9. Click virtual private gateways and select the virtual private gateway.
10. Click View details.
11. Click the Direct Connect gateway associations tab.
12. Click Associate Direct Connect gateway
13. Under Association account type, for Account owner, click Another account.
14. Under Association settings, for Direct Connect gateway ID, enter the ID of the Direct Connect gateway.
15. For Direct Connect gateway owner, enter the ID of the AWS account that owns the Direct Connect gateway.
16. Optional: Add prefixes to Allowed prefixes, separating them using commas or put them on separate lines.
17. Click Associate Direct Connect gateway.
18. After the Association Proposal has been sent, it will be waiting for your acceptance. The final steps you must perform are available in the AWS Documentation.