Chapter 2. Understanding networking settings

Procedure

1. To create your ovn.yaml file, run the following command:

   $ sudo cp /etc/microshift/ovn.yaml.default /etc/microshift/ovn.yaml

2. To list the contents of the configuration file you created, run the following command:

   $ cat /etc/microshift/ovn.yaml

   Example YAML file with default maximum transmission unit (MTU) value

   mtu: 1400

3. To customize your configuration, you can change the MTU value. The table that follows provides details:

   Table 2.1. Supported optional OVN-Kubernetes configurations for MicroShift

   Field	Type	Default	Description	Example
   mtu	uint32	auto	MTU value used for the pods	1300

   Important

   If you change the mtu configuration value in the ovn.yaml file, you must restart the host that MicroShift is running on to apply the updated setting.

   Example custom ovn.yaml configuration file

   mtu: 1300

1. Access the remote cluster by running the following command:

   $ export KUBECONFIG=$PWD/kubeconfig

2. Find the name of the ovnkube-master pod that you want to restart by running the following command:

   $ pod=$(oc get pods -n openshift-ovn-kubernetes | awk -F " " '/ovnkube-master/{print $1}')

3. Delete the ovnkube-master pod by running the following command:

   $ oc -n openshift-ovn-kubernetes delete pod $pod

4. Confirm that a new ovnkube-master pod is running by using the following command:

   $ oc get pods -n openshift-ovn-kubernetes

   The listing of the running pods shows a new ovnkube-master pod name and age.

Procedure

1. Add this setting to the /etc/systemd/system/rpm-ostreed.service.d/00-proxy.conf file:

   [Service]
   Environment="http_proxy=http://$PROXY_USER:$PROXY_PASSWORD@$PROXY_SERVER:$PROXY_PORT/"

2. Next, reload the configuration settings and restart the service to apply your changes.

   1. Reload the configuration settings by running the following command:

      $ sudo systemctl daemon-reload

   2. Restart the rpm-ostreed service by running the following command:

      $ sudo systemctl restart rpm-ostreed.service

Procedure

1. Create the directory for the configuration file if it does not exist:

   $ sudo mkdir /etc/systemd/system/crio.service.d/

2. Add the following settings to the /etc/systemd/system/crio.service.d/00-proxy.conf file:

   [Service]
   Environment=NO_PROXY="localhost,127.0.0.1"
   Environment=HTTP_PROXY="http://$PROXY_USER:$PROXY_PASSWORD@$PROXY_SERVER:$PROXY_PORT/"
   Environment=HTTPS_PROXY="http://$PROXY_USER:$PROXY_PASSWORD@$PROXY_SERVER:$PROXY_PORT/"

   Important

   You must define the Service section of the configuration file for the environment variables or the proxy settings fail to apply.

3. Reload the configuration settings:

   $ sudo systemctl daemon-reload

4. Restart the CRI-O service:

   $ sudo systemctl restart crio

5. Restart the MicroShift service to apply the settings:

   $ sudo systemctl restart microshift

Verification

1. Verify that pods are started by running the following command and examining the output:

   $ oc get all -A

2. Verify that MicroShift is able to pull container images by running the following command and examining the output:

   $ sudo crictl images

Procedure

1. Verify that your pods are running by entering the following command:

   $ oc get pods -A

   Example output

   NAMESPACE                            NAME                                                     READY   STATUS   RESTARTS  AGE
   default                              i-06166fbb376f14a8bus-west-2computeinternal-debug-qtwcr  1/1     Running	   0		   46m
   kube-system                          csi-snapshot-controller-5c6586d546-lprv4                 1/1     Running	   0		   51m
   kube-system                          csi-snapshot-webhook-6bf8ddc7f5-kz6k9                    1/1     Running	   0		   51m
   openshift-dns                        dns-default-45jl7                                        2/2     Running	   0		   50m
   openshift-dns                        node-resolver-7wmzf                                      1/1     Running	   0		   51m
   openshift-ingress                    router-default-78b86fbf9d-qvj9s                          1/1     Running 	 0		   51m
   openshift-multus                     dhcp-daemon-j7qnf                                        1/1     Running    0		   51m
   openshift-multus                     multus-r758z                                             1/1     Running    0		   51m
   openshift-operator-lifecycle-manager catalog-operator-85fb86fcb9-t6zm7                        1/1     Running    0		   51m
   openshift-operator-lifecycle-manager olm-operator-87656d995-fvz84                             1/1     Running    0		   51m
   openshift-ovn-kubernetes             ovnkube-master-5rfhh                                     4/4     Running    0		   51m
   openshift-ovn-kubernetes             ovnkube-node-gcnt6                                       1/1     Running    0		   51m
   openshift-service-ca                 service-ca-bf5b7c9f8-pn6rk                               1/1     Running    0		   51m
   openshift-storage                    topolvm-controller-549f7fbdd5-7vrmv                      5/5     Running    0		   51m
   openshift-storage                    topolvm-node-rht2m                                       3/3     Running    0		   50m

2. Create a namespace by running the following commands:

   $ NAMESPACE=<nginx-lb-test> 1

   1

   Replace _<nginx-lb-test> with the application namespace that you want to create.

   $ oc create ns $NAMESPACE

   Example namespace

   The following example deploys three replicas of the test nginx application in the created namespace:

   oc apply -n $NAMESPACE -f - <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: nginx
   data:
     headers.conf: |
       add_header X-Server-IP  \$server_addr always;
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: nginx
   spec:
     replicas: 3
     selector:
       matchLabels:
         app: nginx
     template:
       metadata:
         labels:
           app: nginx
       spec:
         containers:
         - image: quay.io/packit/nginx-unprivileged
           imagePullPolicy: Always
           name: nginx
           ports:
           - containerPort: 8080
           volumeMounts:
           - name: nginx-configs
             subPath: headers.conf
             mountPath: /etc/nginx/conf.d/headers.conf
           securityContext:
             allowPrivilegeEscalation: false
             seccompProfile:
               type: RuntimeDefault
             capabilities:
               drop: ["ALL"]
             runAsNonRoot: true
         volumes:
           - name: nginx-configs
             configMap:
               name: nginx
               items:
                 - key: headers.conf
                   path: headers.conf
   EOF

3. You can verify that the three sample replicas started successfully by running the following command:

   $ oc get pods -n $NAMESPACE

4. Create a LoadBalancer service for the nginx test application by running the following command:

   oc create -n $NAMESPACE -f - <<EOF
   apiVersion: v1
   kind: Service
   metadata:
     name: nginx
   spec:
     ports:
     - port: 81
       targetPort: 8080
     selector:
       app: nginx
     type: LoadBalancer
   EOF

   Note

   You must ensure that the port parameter is a host port that is not occupied by other LoadBalancer services or MicroShift components.

5. Verify that the service file exists, that the external IP address is properly assigned, and that the external IP is identical to the node IP by running the following command:

   $ oc get svc -n $NAMESPACE

   Example output

   NAME    TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)        AGE
   nginx   LoadBalancer   10.43.183.104   192.168.1.241   81:32434/TCP   2m

Procedure

1. Change the NODEPORT variable to the host port number assigned to your Kubernetes NodePort service by running the following command:

   # export NODEPORT=30700

2. Change the INTERFACE_IP value to the IP address from the host interface that you want to block. For example:

   # export INTERFACE_IP=192.168.150.33

3. Insert a new rule in the nat table PREROUTING chain to drop all packets that match the destination port and IP address. For example:

   $ sudo nft -a insert rule ip nat PREROUTING tcp dport $NODEPORT ip daddr $INTERFACE_IP drop

4. List the new rule by running the following command:

   $ sudo nft -a list chain ip nat PREROUTING
   table ip nat {
   	chain PREROUTING { # handle 1
   		type nat hook prerouting priority dstnat; policy accept;
   		tcp dport 30700 ip daddr 192.168.150.33 drop # handle 134
   		counter packets 108 bytes 18074 jump OVN-KUBE-ETP # handle 116
   		counter packets 108 bytes 18074 jump OVN-KUBE-EXTERNALIP # handle 114
   		counter packets 108 bytes 18074 jump OVN-KUBE-NODEPORT # handle 112
   	}
   }

   Note

   Note the handle number of the newly added rule. You need to remove the handle number in the following step.

5. Remove the custom rule with the following sample command:

   $ sudo nft -a delete rule ip nat PREROUTING handle 134