Networking Operators

Procedure

1. Create a new project within your cluster for the AWS Load Balancer Operator:

   $ oc new-project aws-load-balancer-operator

2. Create an AWS IAM policy for the AWS Load Balancer Operator.

   1. Download the appropriate IAM policy:

      $ curl -o ${SCRATCH}/operator-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/refs/heads/main/hack/operator-permission-policy.json

   2. Create the permission policy for the Operator:

      $ aws iam create-policy \
              --policy-name aws-load-balancer-operator-policy \
              --policy-document file://${SCRATCH}/operator-permission-policy.json \
              --region ${REGION}

      Take note of the Operator policy ARN in the output. This is referred to as the $OPERATOR_POLICY_ARN for the remainder of this process.

3. Create an AWS IAM role for the AWS Load Balancer Operator:

   1. Create the trust policy for the Operator role:

      $ cat <<EOF > "${SCRATCH}/operator-trust-policy.json"
      {
       "Version": "2012-10-17",
       "Statement": [
       {
       "Effect": "Allow",
       "Condition": {
         "StringEquals" : {
           "${OIDC_ENDPOINT}:sub": ["system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-operator-controller-manager", "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster"]
         }
       },
       "Principal": {
         "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
       },
       "Action": "sts:AssumeRoleWithWebIdentity"
       }
       ]
      }
      EOF

   2. Create the Operator role using the trust policy:

      $ aws iam create-role --role-name "${CLUSTER_NAME}-alb-operator" \
          --assume-role-policy-document "file://${SCRATCH}/operator-trust-policy.json"

      Take note of the Operator role ARN in the output. This is referred to as the $OPERATOR_ROLE_ARN for the remainder of this process.

   3. Associate the Operator role and policy:

      $ aws iam attach-role-policy --role-name "${CLUSTER_NAME}-alb-operator" \
          --policy-arn $OPERATOR_POLICY_ARN

4. Install the AWS Load Balancer Operator by creating an OperatorGroup and a Subscription:

   $ cat <<EOF | oc apply -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: aws-load-balancer-operator
     namespace: aws-load-balancer-operator
   spec:
     targetNamespaces: []
   ---
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: aws-load-balancer-operator
     namespace: aws-load-balancer-operator
   spec:
     channel: stable-v1
     name: aws-load-balancer-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       env:
       - name: ROLEARN
         value: "${OPERATOR_ROLE_ARN}"
   EOF

5. Create an AWS IAM policy for the AWS Load Balancer Controller.

   1. Download the appropriate IAM policy:

      $ curl -o ${SCRATCH}/controller-permission-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.12.0/docs/install/iam_policy.json

   2. Create the permission policy for the Controller:

      $ aws iam create-policy \
          --region ${REGION} \
          --policy-name aws-load-balancer-controller-policy \
          --policy-document file://${SCRATCH}/controller-permission-policy.json

      Take note of the Controller policy ARN in the output. This is referred to as the $CONTROLLER_POLICY_ARN for the remainder of this process.

6. Create an AWS IAM role for the AWS Load Balancer Controller:

   1. Create the trust policy for the Controller role:

      $ cat <<EOF > ${SCRATCH}/controller-trust-policy.json
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${OIDC_ENDPOINT}:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster"
                  }
              }
            }
          ]
        }
      EOF

   2. Create the Controller role using the trust policy:

      CONTROLLER_ROLE_ARN=$(aws iam create-role --role-name "${CLUSTER_NAME}-albo-controller" \ --assume-role-policy-document "file://${SCRATCH}/controller-trust-policy.json" \ --query Role.Arn --output text) echo ${CONTROLLER_ROLE_ARN}

      Take note of the Controller role ARN in the output. This is referred to as the $CONTROLLER_ROLE_ARN for the remainder of this process.

   3. Associate the Controller role and policy:

      $ aws iam attach-role-policy \
          --role-name "${CLUSTER_NAME}-albo-controller" \
          --policy-arn ${CONTROLLER_POLICY_ARN}

7. Deploy an instance of the AWS Load Balancer Controller:

   $ cat << EOF | oc apply -f -
   apiVersion: networking.olm.openshift.io/v1
   kind: AWSLoadBalancerController
   metadata:
    name: cluster
   spec:
    credentialsRequestConfig:
      stsIAMRoleARN: ${CONTROLLER_ROLE_ARN}
   EOF

   Note

   If you get an error here, wait a minute and try again. This situation happens because the Operator has not completed installation yet.

8. Confirm that the Operator and Controller pods are both running:

   $ oc -n aws-load-balancer-operator get pods

   If you do not see output similar to the following, wait a few moments and retry.

   Example output

   NAME                                                             READY   STATUS    RESTARTS   AGE
   aws-load-balancer-controller-cluster-6ddf658785-pdp5d            1/1     Running   0          99s
   aws-load-balancer-operator-controller-manager-577d9ffcb9-w6zqn   2/2     Running   0          2m4s

Procedure

1. Create a new project:

   $ oc new-project hello-world

2. Create a new hello-world application based on the hello-openshift image:

   $ oc new-app -n hello-world --image=docker.io/openshift/hello-openshift

3. Configure a NodePort service for an AWS Application Load Balancer (ALB) to connect to:

   $ cat << EOF | oc apply -f -
   apiVersion: v1
   kind: Service
   metadata:
     name: hello-openshift-nodeport
     namespace: hello-world
   spec:
     ports:
       - port: 80
         targetPort: 8080
         protocol: TCP
     type: NodePort
     selector:
       deployment: hello-openshift
   EOF

4. Deploy an AWS ALB for the application:

   $ cat << EOF | oc apply -f -
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: hello-openshift-alb
     namespace: hello-world
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
   spec:
     ingressClassName: alb
     rules:
       - http:
           paths:
             - path: /
               pathType: Exact
               backend:
                 service:
                   name: hello-openshift-nodeport
                   port:
                     number: 80
   EOF

5. Test access to the AWS ALB endpoint for the application:

   Note

   ALB provisioning takes a few minutes. If you receive an error that says curl: (6) Could not resolve host, please wait and try again.

   $ ALB_INGRESS=$(oc -n hello-world get ingress hello-openshift-alb \
       -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

   $ curl "http://${ALB_INGRESS}"

   Example output

   Hello OpenShift!

6. Deploy an AWS Network Load Balancer (NLB) for the application:

   $ cat << EOF | oc apply -f -
   apiVersion: v1
   kind: Service
   metadata:
     name: hello-openshift-nlb
     namespace: hello-world
     annotations:
       service.beta.kubernetes.io/aws-load-balancer-type: external
       service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
       service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
   spec:
     ports:
       - port: 80
         targetPort: 8080
         protocol: TCP
     type: LoadBalancer
     selector:
       deployment: hello-openshift
   EOF

7. Test access to the NLB endpoint for the application:

   Note

   NLB provisioning takes a few minutes. If you receive an error that says curl: (6) Could not resolve host, please wait and try again.

   $ NLB=$(oc -n hello-world get service hello-openshift-nlb \
     -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

   $ curl "http://${NLB}"

   Expected output shows Hello OpenShift!.

8. You can now delete the sample application and all resources in the hello-world namespace.

   $ oc delete project hello-world

Procedure

1. Delete the Operator Subscription:

   $ oc delete subscription aws-load-balancer-operator -n aws-load-balancer-operator

2. Detach and delete the relevant AWS IAM roles:

   $ aws iam detach-role-policy \
     --role-name "<cluster-id>-alb-operator" \
     --policy-arn <operator-policy-arn>

   $ aws iam delete-role \
     --role-name "<cluster-id>-alb-operator"

3. Delete the AWS IAM policy:

   $ aws iam delete-policy --policy-arn <operator-policy-arn>

Procedure

1. To create the openshift-ingress-node-firewall namespace, enter the following command:

   $ cat << EOF| oc create -f -
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       pod-security.kubernetes.io/enforce: privileged
       pod-security.kubernetes.io/enforce-version: v1.24
     name: openshift-ingress-node-firewall
   EOF

2. To create an OperatorGroup CR, enter the following command:

   $ cat << EOF| oc create -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: ingress-node-firewall-operators
     namespace: openshift-ingress-node-firewall
   EOF

3. Subscribe to the Ingress Node Firewall Operator.

   • To create a Subscription CR for the Ingress Node Firewall Operator, enter the following command:

     $ cat << EOF| oc create -f -
     apiVersion: operators.coreos.com/v1alpha1
     kind: Subscription
     metadata:
       name: ingress-node-firewall-sub
       namespace: openshift-ingress-node-firewall
     spec:
       name: ingress-node-firewall
       channel: stable
       source: redhat-operators
       sourceNamespace: openshift-marketplace
     EOF

4. To verify that the Operator is installed, enter the following command:

   $ oc get ip -n openshift-ingress-node-firewall

   Example output

   NAME            CSV                                         APPROVAL    APPROVED
   install-5cvnz   ingress-node-firewall.4.0-202211122336   Automatic   true

5. To verify the version of the Operator, enter the following command:

   $ oc get csv -n openshift-ingress-node-firewall

   Example output

   NAME                                        DISPLAY                          VERSION               REPLACES                                    PHASE
   ingress-node-firewall.4.0-202211122336   Ingress Node Firewall Operator   4.0-202211122336   ingress-node-firewall.4.0-202211102047   Succeeded

Procedure

1. Install the Ingress Node Firewall Operator:

   1. In the Red Hat OpenShift Service on AWS web console, click Ecosystem → Software Catalog.
   2. Select Ingress Node Firewall Operator from the list of available Operators, and then click Install.
   3. On the Install Operator page, under Installed Namespace, select Operator recommended Namespace.
   4. Click Install.

2. Verify that the Ingress Node Firewall Operator is installed successfully:

   1. Navigate to the Ecosystem → Installed Operators page.

   2. Ensure that Ingress Node Firewall Operator is listed in the openshift-ingress-node-firewall project with a Status of InstallSucceeded.

      Note

      During installation an Operator might display a Failed status. If the installation later succeeds with an InstallSucceeded message, you can ignore the Failed message.

      If the Operator does not have a Status of InstallSucceeded, troubleshoot using the following steps:

      • Inspect the Operator Subscriptions and Install Plans tabs for any failures or errors under Status.
      • Navigate to the Workloads → Pods page and check the logs for pods in the openshift-ingress-node-firewall project.

      • Check the namespace of the YAML file. If the annotation is missing, you can add the annotation workload.openshift.io/allowed=management to the Operator namespace with the following command:

        $ oc annotate ns/openshift-ingress-node-firewall workload.openshift.io/allowed=management

        Note

        For single-node OpenShift clusters, the openshift-ingress-node-firewall namespace requires the workload.openshift.io/allowed=management annotation.

Procedure

1. Create the IngressNodeFirewallConfig inside the openshift-ingress-node-firewall namespace named ingressnodefirewallconfig.

2. Run the following command to deploy Ingress Node Firewall Operator rules:

   $ oc apply -f rule.yaml

Procedure

1. Apply the following labels to the ingress-node-firewall-system namespace:

   $ oc label namespace openshift-ingress-node-firewall \
       pod-security.kubernetes.io/enforce=privileged \
       pod-security.kubernetes.io/warn=privileged --overwrite

2. Edit the IngressNodeFirewallConfig object named ingressnodefirewallconfig and set the ebpfProgramManagerMode field:

   Ingress Node Firewall Operator configuration object

   apiVersion: ingressnodefirewall.openshift.io/v1alpha1
   kind: IngressNodeFirewallConfig
   metadata:
     name: ingressnodefirewallconfig
     namespace: openshift-ingress-node-firewall
   spec:
     nodeSelector:
       node-role.kubernetes.io/worker: ""
     ebpfProgramManagerMode: <ebpf_mode>

   where:

   <ebpf_mode>: Specifies whether or not the Ingress Node Firewall Operator uses the eBPF Manager Operator to manage eBPF programs. Must be either true or false. If unset, eBPF Manager is not used.

Procedure

1. Run the following command to view all current rules :

   $ oc get ingressnodefirewall

2. Choose one of the returned <resource> names and run the following command to view the rules or configs:

   $ oc get <resource> <name> -o yaml