Chapter 4. Post-installation configuration

Procedure

1. Edit the object in your default editor by running the following command:

   $ oc edit <resource_type> <resource_name> -n openshift-cnv

2. Save the file to apply the changes.

Procedure

1. In the web console, click Networking NetworkAttachmentDefinitions.

2. Click Create Network Attachment Definition.

   Note

   The network attachment definition must be in the same namespace as the pod or virtual machine.

3. Enter a unique Name and optional Description.
4. Select CNV Linux bridge from the Network Type list.
5. Enter the name of the bridge in the Bridge Name field.
6. Optional: If the resource has VLAN IDs configured, enter the ID numbers in the VLAN Tag Number field.
7. Optional: Select MAC Spoof Check to enable MAC spoof filtering. This feature provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.

8. Optional: In the YAML tab, add the spec.config.disableContainerInterface field. When set to true, the Bridge CNI plug-in skips creating a standard container virtual ethernet (veth) interface inside the pod’s network namespace. This enables the virtualization networking backend to attach the layer-2 interface directly to the guest VM instead of a standard container.

   Example YAML:

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition
   metadata:
     name: bridge-network
     annotations:
       k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
   spec:
     config: |
       {
   # ...
         "disableContainerInterface": true,
   # ...
       }

9. Click Create.

Procedure

1. Create a NetworkAttachmentDefinition manifest according to the following example:

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition
   metadata:
     name: my-secondary-network
     namespace: openshift-cnv
   spec:
     config: '{
       "cniVersion": "0.3.1",
       "name": "migration-bridge",
       "type": "macvlan",
       "master": "eth1",
       "mode": "bridge",
       "ipam": {
         "type": "whereabouts",
         "range": "10.200.5.0/24"
       }
     }'

   • metadata.name defines the name of the NetworkAttachmentDefinition object.
   • config.master defines the name of the NIC to be used for live migration.
   • config.type defines the name of the CNI plugin that provides the network for the NAD.
   • config.range defines an IP address range for the secondary network. This range must not overlap the IP addresses of the main network.

2. Open the HyperConverged CR in your default editor by running the following command:

   $ oc edit hyperconvergeds.v1beta1.hco.kubevirt.io kubevirt-hyperconverged -n openshift-cnv

3. Add the name of the NetworkAttachmentDefinition object to the spec.liveMigrationConfig stanza of the HyperConverged CR.

   Example HyperConverged manifest:

   apiVersion: hco.kubevirt.io/v1beta1
   kind: HyperConverged
   metadata:
     name: kubevirt-hyperconverged
     namespace: openshift-cnv
   spec:
     liveMigrationConfig:
       completionTimeoutPerGiB: 800
       network: <network>
       parallelMigrationsPerCluster: 5
       parallelOutboundMigrationsPerNode: 2
       progressTimeout: 150
   # ...

   • spec.liveMigrationConfig.network defines the name of the Multus NetworkAttachmentDefinition object to be used for live migrations.
4. Save your changes and exit the editor. The virt-handler pods restart and connect to the secondary network.

Procedure

1. Go to Virtualization Settings in the OpenShift Dedicated web console.
2. On the Cluster tab, click General settiings.
3. Click Live Migration.
4. Select the network from the Live migration network list.

Procedure

1. Go to Virtualization Settings.
2. Click Cluster.
3. Expand General settings and SSH configuration.
4. Set SSH over LoadBalancer service to on.

Procedure

1. Configure the route to the external host by running the following command:

   $ oc create route reencrypt <route_name> -n openshift-cnv \
       --insecure-policy=Redirect \
       --hostname=<host_name_or_address> \
       --service=cdi-uploadproxy

   where:

   <route_name>

   Specifies the name to assign to this custom route.

   <host_name_or_address>

   Specifies the fully qualified domain name or IP address of the external host providing image upload access.

2. Run the following command to annotate the route. This ensures that the correct Containerized Data Importer (CDI) CA certificate is injected when certificates are rotated:

   $ oc annotate route <route_name> -n openshift-cnv \
       operator.cdi.kubevirt.io/injectUploadProxyCert="true"

   where:

   <route_name>

   Specifies the name of the route you created.

Procedure

1. Create a NodeHealthCheck custom resource (CR) to define the health check criteria and remediation strategy:

   apiVersion: remediation.medik8s.io/v1alpha1
   kind: NodeHealthCheck
   metadata:
     name: nodehealthcheck-sample
   spec:
     minHealthy: <count>
     pauseRequests:
       - <pause_test_cluster>
     remediationTemplate:
       apiVersion: self-node-remediation.medik8s.io/v1alpha1
       name: self-node-remediation-automatic-strategy-template
       namespace: openshift-workload-availability
       kind: SelfNodeRemediationTemplate
     escalatingRemediations:
       - remediationTemplate:
           apiVersion: self-node-remediation.medik8s.io/v1alpha1
           name: self-node-remediation-resource-deletion-template
           namespace: openshift-workload-availability
           kind: SelfNodeRemediationTemplate
         order: 1
         timeout: 300s
     selector:
       matchExpressions:
         - key: node-role.kubernetes.io/worker
           operator: Exists
     unhealthyConditions:
       - type: Ready
         status: "False"
         duration: 30s
       - type: Ready
         status: Unknown
         duration: 30s

   where:

   • spec.minHealthy defines the number of worker nodes required to host VMs that migrate from failed nodes.

     • For critical environments, set this value to the minimum number of nodes that you require to maintain the cluster workload.
     • For hyperconverged storage, set this value to one less than your number of nodes to limit remediation to a single worker-node failure and maintain storage stability.
   • spec.remediationTemplate defines the remediation template to use when the Node Health Check Operator detects an unhealthy node. This example uses the Self Node Remediation Operator.
   • spec.escalatingRemediations defines escalating remediation strategies. If the initial remediation does not resolve the issue within the specified timeout, the next remediation strategy runs.
   • spec.selector defines the nodes to monitor. This example monitors all worker nodes.
   • spec.unhealthyConditions defines the parameters to identify an unhealthy node.

   • spec.unhealthyConditions.duration defines the duration that a condition must persist before remediation starts. Set lower values for faster recovery. The following table shows recommended values:

     Expand

     Table 4.1. Recommended unhealthyConditions duration values

     Environment	Recommended duration
     Critical	30-60 seconds
     Standard	60-180 seconds
     Conservative	180-360 seconds

     Show more

2. Apply the NodeHealthCheck CR by running the following command:

   $ oc apply -f nodehealthcheck-sample.yaml

Procedure

1. Open the HyperConverged CR by running the following command:

   $ oc edit hyperconvergeds.v1beta1.hco.kubevirt.io kubevirt-hyperconverged -n openshift-cnv

2. Edit the spec.certConfig fields as shown in the following example. To avoid overloading the system, ensure that all values are greater than or equal to 10 minutes. Express all values as strings that comply with the golang ParseDuration format.

   apiVersion: hco.kubevirt.io/v1beta1
   kind: HyperConverged
   metadata:
     name: kubevirt-hyperconverged
     namespace: openshift-cnv
   spec:
     certConfig:
       ca:
         duration: 48h0m0s
         renewBefore: 24h0m0s
       server:
         duration: 24h0m0s
         renewBefore: 12h0m0s

   • The value of ca.renewBefore must be less than or equal to the value of ca.duration.
   • The value of server.duration must be less than or equal to the value of ca.duration.
   • The value of server.renewBefore must be less than or equal to the value of server.duration.

3. Apply updates to the HyperConverged CR by running the following command:

   $ oc apply -f <filename>.yaml

   For example:

   $ oc apply -f kubevirt-hyperconverged.yaml