Chapter 13. OVN-Kubernetes default CNI network provider

1. Available only as a Technology Preview feature in OpenShift Container Platform 4.5.
2. Egress firewall is also known as egress network policy in OpenShift SDN. This is not the same as network policy egress.
3. Does not support egress rules and some ipBlock rules.

Procedure

1. To backup the configuration for the cluster network, enter the following command:

   $ oc get Network.config.openshift.io cluster -o yaml > cluster-openshift-sdn.yaml

   Copy to Clipboard Toggle word wrap

2. To enable the migration, set an annotation on the Cluster Network Operator configuration object by entering the following command:

   $ oc annotate Network.operator.openshift.io cluster \
     'networkoperator.openshift.io/network-migration'=""

   Copy to Clipboard Toggle word wrap

3. To change the default CNI network provider, enter the following command:

   $ oc patch Network.config.openshift.io cluster \
     --type='merge' --patch '{ "spec": { "networkType": "OVNKubernetes" } }'

   Copy to Clipboard Toggle word wrap

4. To confirm the migration disabled the OpenShift SDN default CNI network provider and removed all OpenShift SDN pods, enter the following command. It might take several moments for all the OpenShift SDN pods to stop.

   $ watch oc get pod -n openshift-sdn

   Copy to Clipboard Toggle word wrap

5. To complete the migration, reboot each node in your cluster. For example, you could use a bash script similar to the following. The script assumes that you can connect to each host by using ssh and that you have configured sudo to not prompt for a password.

   #!/bin/bash
   
   for ip in $(oc get nodes  -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}')
   do
      echo "reboot node $ip"
      ssh -o StrictHostKeyChecking=no core@$ip sudo shutdown -r -t 3
   done

   Copy to Clipboard Toggle word wrap

6. After the nodes in your cluster have rebooted, confirm that the migration succeeded:

   1. To confirm that the default CNI network provider is OVN-Kubernetes, enter the following command. The value of status.networkType must be OVNKubernetes.

      $ oc get network.config/cluster -o jsonpath='{.status.networkType}{"\n"}'

      Copy to Clipboard Toggle word wrap

   2. To confirm that the cluster nodes are in the Ready state, enter the following command:

      $ oc get nodes

      Copy to Clipboard Toggle word wrap

      If a node is stuck in the NotReady state, reboot the node again.

   3. To confirm that your pods are not in an error state, enter the following command:

      $ oc get pods --all-namespaces -o wide --sort-by='{.spec.nodeName}'

      Copy to Clipboard Toggle word wrap

      If pods on a node are in an error state, reboot that node.

7. Complete the following steps only if the migration succeeds and your cluster is in a good state:

   1. To remove the migration annotation from the Cluster Network Operator configuration object, enter the following command:

      $ oc annotate Network.operator.openshift.io cluster \
        networkoperator.openshift.io/network-migration-

      Copy to Clipboard Toggle word wrap

   2. To remove the OpenShift SDN network provider namespace, enter the following command:

      $ oc delete namespace openshift-sdn

      Copy to Clipboard Toggle word wrap

1. Change your current project to the project that you enabled multicast for. Replace <project> with the project name.

   $ oc project <project>

   Copy to Clipboard Toggle word wrap

2. Create a pod to act as a multicast receiver:

   $ cat <<EOF| oc create -f -
   apiVersion: v1
   kind: Pod
   metadata:
     name: mlistener
     labels:
       app: multicast-verify
   spec:
     containers:
       - name: mlistener
         image: registry.access.redhat.com/ubi8
         command: ["/bin/sh", "-c"]
         args:
           ["dnf -y install socat hostname && sleep inf"]
         ports:
           - containerPort: 30102
             name: mlistener
             protocol: UDP
   EOF

   Copy to Clipboard Toggle word wrap

3. Create a pod to act as a multicast sender:

   $ cat <<EOF| oc create -f -
   apiVersion: v1
   kind: Pod
   metadata:
     name: msender
     labels:
       app: multicast-verify
   spec:
     containers:
       - name: msender
         image: registry.access.redhat.com/ubi8
         command: ["/bin/sh", "-c"]
         args:
           ["dnf -y install socat && sleep inf"]
   EOF

   Copy to Clipboard Toggle word wrap

4. Start the multicast listener.

   1. Get the IP address for the Pod:

      $ POD_IP=$(oc get pods mlistener -o jsonpath='{.status.podIP}')

      Copy to Clipboard Toggle word wrap

   2. To start the multicast listener, in a new terminal window or tab, enter the following command:

      $ oc exec mlistener -i -t -- \
          socat UDP4-RECVFROM:30102,ip-add-membership=224.1.0.1:$POD_IP,fork EXEC:hostname

      Copy to Clipboard Toggle word wrap

5. Start the multicast transmitter.

   1. Get the pod network IP address range:

      $ CIDR=$(oc get Network.config.openshift.io cluster \
          -o jsonpath='{.status.clusterNetwork[0].cidr}')

      Copy to Clipboard Toggle word wrap

   2. To send a multicast message, enter the following command:

      $ oc exec msender -i -t -- \
          /bin/bash -c "echo | socat STDIO UDP4-DATAGRAM:224.1.0.1:30102,range=$CIDR,ip-multicast-ttl=64"

      Copy to Clipboard Toggle word wrap

      If multicast is working, the previous command returns the following output:

      mlistener

      Copy to Clipboard Toggle word wrap