Networking

Procedure

1. To create your ovn.yaml file, run the following command:

   $ sudo cp /etc/microshift/ovn.yaml.default /etc/microshift/ovn.yaml

   Copy to Clipboard Toggle word wrap

2. To list the contents of the configuration file you created, run the following command:

   $ cat /etc/microshift/ovn.yaml.default

   Copy to Clipboard Toggle word wrap

   Example 'yaml' configuration file with default values

   ovsInit:
     disableOVSInit: false
     gatewayInterface: "" 

   1

   
   mtu: 1400

   Copy to Clipboard Toggle word wrap

   1

   The default value is an empty string that means "not-specified." The CNI network plugin auto-detects to interface with the default route.

3. To customize your configuration, use the following table that lists the valid values you can use:

   Expand

   Table 1.1. Supported optional OVN-Kubernetes configurations for Red Hat build of MicroShift

   Field	Type	Default	Description	Example
   ovsInit.disableOVSInit	bool	false	Skip configuring OVS bridge br-ex in microshift-ovs-init.service	true [1]
   ovsInit.gatewayInterface	Alpha	eth0	Ingress that is the API gateway	eth0
   mtu	uint32	auto	MTU value used for the pods	1300

   Show more

   1. The OVS bridge is required. When disableOVSInit is true, OVS bridge br-ex must be configured manually.

      Important

      If you change the mtu configuration value in the ovn.yaml file, you must restart the host that Red Hat build of MicroShift is running on to apply the updated setting.

1. Access the remote cluster by running the following command:

   $ export KUBECONFIG=$PWD/kubeconfig

   Copy to Clipboard Toggle word wrap

2. Find the name of the ovnkube-master pod that you want to restart by running the following command:

   $ pod=$(oc get pods -n openshift-ovn-kubernetes | awk -F " " '/ovnkube-master/{print $1}')

   Copy to Clipboard Toggle word wrap

3. Delete the ovnkube-master pod by running the following command:

   $ oc -n openshift-ovn-kubernetes delete pod $pod

   Copy to Clipboard Toggle word wrap

4. Confirm that a new ovnkube-master pod is running by using the following command:

   $ oc get pods -n openshift-ovn-kubernetes

   Copy to Clipboard Toggle word wrap

   The listing of the running pods shows a new ovnkube-master pod name and age.

Procedure

1. Add this setting to the /etc/systemd/system/rpm-ostreed.service.d/00-proxy.conf file by running the following command:

   Environment="http_proxy=http://$PROXY_USER:$PROXY_PASSWORD@$PROXY_SERVER:$PROXY_PORT/"

   Copy to Clipboard Toggle word wrap

2. Next, reload the configuration settings and restart the service to apply your changes.

   1. Reload the configuration settings by running the following command:

      $ sudo systemctl daemon-reload

      Copy to Clipboard Toggle word wrap

   2. Restart the rpm-ostree service by running the following command:

      $ sudo systemctl restart rpm-ostreed.service

      Copy to Clipboard Toggle word wrap

Procedure

1. Add the following settings to the /etc/systemd/system/crio.service.d/00-proxy.conf file:

   Environment=NO_PROXY="localhost,127.0.0.1"
   Environment=HTTP_PROXY="http://$PROXY_USER:$PROXY_PASSWORD@$PROXY_SERVER:$PROXY_PORT/"
   Environment=HTTPS_PROXY="http://$PROXY_USER:$PROXY_PASSWORD@$PROXY_SERVER:$PROXY_PORT/"

   Copy to Clipboard Toggle word wrap

2. Reload the configuration settings:

   $ sudo systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

3. Restart the CRI-O service to apply the settings:

   $ sudo systemctl restart crio

   Copy to Clipboard Toggle word wrap

Procedure

1. Verify that your pods are running by running the following command:

   $ oc get pods -A

   Copy to Clipboard Toggle word wrap

2. Create the example namespace by running the following commands:

   $ NAMESPACE=nginx-lb-test

   Copy to Clipboard Toggle word wrap

   $ oc create ns $NAMESPACE

   Copy to Clipboard Toggle word wrap

3. The following example deploys three replicas of the test nginx application in your namespace:

   $ oc apply -n $NAMESPACE -f - <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: nginx
   data:
     headers.conf: |
       add_header X-Server-IP  \$server_addr always;
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: nginx
   spec:
     replicas: 3
     selector:
       matchLabels:
         app: nginx
     template:
       metadata:
         labels:
           app: nginx
       spec:
         containers:
         - image: quay.io/packit/nginx-unprivileged
           imagePullPolicy: Always
           name: nginx
           ports:
           - containerPort: 8080
           volumeMounts:
           - name: nginx-configs
             subPath: headers.conf
             mountPath: /etc/nginx/conf.d/headers.conf
           securityContext:
             allowPrivilegeEscalation: false
             seccompProfile:
               type: RuntimeDefault
             capabilities:
               drop: ["ALL"]
             runAsNonRoot: true
         volumes:
           - name: nginx-configs
             configMap:
               name: nginx
               items:
                 - key: headers.conf
                   path: headers.conf
   EOF

   Copy to Clipboard Toggle word wrap

4. You can verify that the three sample replicas started successfully by running the following command:

   $ oc get pods -n $NAMESPACE

   Copy to Clipboard Toggle word wrap

5. Create a LoadBalancer service for the nginx test application with the following sample commands:

   $ oc create -n $NAMESPACE -f - <<EOF
   apiVersion: v1
   kind: Service
   metadata:
     name: nginx
   spec:
     ports:
     - port: 81
       targetPort: 8080
     selector:
       app: nginx
     type: LoadBalancer
   EOF

   Copy to Clipboard Toggle word wrap
   Note

   You must ensure that the port parameter is a host port that is not occupied by other LoadBalancer services or Red Hat build of MicroShift components.

6. Verify that the service file exists, that the external IP address is properly assigned, and that the external IP is identical to the node IP by running the following command:

   $ oc get svc -n $NAMESPACE

   Copy to Clipboard Toggle word wrap

   Example output

   NAME    TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)        AGE
   nginx   LoadBalancer   10.43.183.104   192.168.1.241   81:32434/TCP   2m

   Copy to Clipboard Toggle word wrap

Procedure

1. Change the NODEPORT variable to the host port number assigned to your Kubernetes NodePort service by running the following command:

   # export NODEPORT=30700

   Copy to Clipboard Toggle word wrap

2. Change the INTERFACE_IP value to the IP address from the host interface that you want to block. For example:

   # export INTERFACE_IP=192.168.150.33

   Copy to Clipboard Toggle word wrap

3. Insert a new rule in the nat table PREROUTING chain to drop all packets that match the destination port and IP address. For example:

   $ sudo nft -a insert rule ip nat PREROUTING tcp dport $NODEPORT ip daddr $INTERFACE_IP drop

   Copy to Clipboard Toggle word wrap

4. List the new rule by running the following command:

   $ sudo nft -a list chain ip nat PREROUTING
   table ip nat {
   	chain PREROUTING { # handle 1
   		type nat hook prerouting priority dstnat; policy accept;
   		tcp dport 30700 ip daddr 192.168.150.33 drop # handle 134
   		counter packets 108 bytes 18074 jump OVN-KUBE-ETP # handle 116
   		counter packets 108 bytes 18074 jump OVN-KUBE-EXTERNALIP # handle 114
   		counter packets 108 bytes 18074 jump OVN-KUBE-NODEPORT # handle 112
   	}
   }

   Copy to Clipboard Toggle word wrap
   Note

   Note the handle number of the newly added rule. You need to remove the handle number in the following step.

5. Remove the custom rule with the following sample command:

   $ sudo nft -a delete rule ip nat PREROUTING handle 134

   Copy to Clipboard Toggle word wrap

Procedure

1. Optional: Check for firewalld on your system by running the following command:

   $ rpm -q firewalld

   Copy to Clipboard Toggle word wrap

2. If the firewalld service is not installed, run the following command:

   $ sudo dnf install -y firewalld

   Copy to Clipboard Toggle word wrap

3. To start the firewall, run the following command:

   $ sudo systemctl enable firewalld --now

   Copy to Clipboard Toggle word wrap

Procedure

1. Use one of the following commands to set the IP address range:

   1. Configure the IP address range with default values by running the following command:

      $ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=10.42.0.0/16

      Copy to Clipboard Toggle word wrap

   2. Configure the IP address range with custom values by running the following command:

      $ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=<custom IP range>

      Copy to Clipboard Toggle word wrap

2. To allow internal traffic from pods through the network gateway, run the following command:

   $ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1

   Copy to Clipboard Toggle word wrap