Chapter 5. Assigning a secondary network to a VRF

Procedure

1. Create the Network custom resource (CR) for the additional network attachment and insert the rawCNIConfig configuration for the secondary network, as in the following example CR. Save the YAML as the file additional-network-attachment.yaml.

   apiVersion: operator.openshift.io/v1
   kind: Network
   metadata:
     name: cluster
   spec:
     additionalNetworks:
       - name: test-network-1
         namespace: additional-network-1
         type: Raw
         rawCNIConfig: '{
           "cniVersion": "0.3.1",
           "name": "macvlan-vrf",
           "plugins": [  

   1

   
           {
             "type": "macvlan",
             "master": "eth1",
             "ipam": {
                 "type": "static",
                 "addresses": [
                 {
                     "address": "191.168.1.23/24"
                 }
                 ]
             }
           },
           {
             "type": "vrf", 

   2

   
             "vrfname": "vrf-1",  

   3

   
             "table": 1001   

   4

   
           }]
         }'

   Copy to Clipboard Toggle word wrap

   1

   plugins must be a list. The first item in the list must be the secondary network underpinning the VRF network. The second item in the list is the VRF plugin configuration.

   2

   type must be set to vrf.

   3

   vrfname is the name of the VRF that the interface is assigned to. If it does not exist in the pod, it is created.

   4

   Optional. table is the routing table ID. By default, the tableid parameter is used. If it is not specified, the CNI assigns a free routing table ID to the VRF.

   Note

   VRF functions correctly only when the resource is of type netdevice.

2. Create the Network resource:

   $ oc create -f additional-network-attachment.yaml

   Copy to Clipboard Toggle word wrap

3. Confirm that the CNO created the NetworkAttachmentDefinition CR by running the following command. Replace <namespace> with the namespace that you specified when configuring the network attachment, for example, additional-network-1. The expected output shows the name of the NAD CR and the creation age in minutes.

   $ oc get network-attachment-definitions -n <namespace>

   Copy to Clipboard Toggle word wrap
   Note

   There might be a delay before the CNO creates the CR.

Verification

1. Create a pod and assign it to the secondary network with the VRF instance:

   1. Create a YAML file that defines the Pod resource:

      Example pod-additional-net.yaml file

      apiVersion: v1
      kind: Pod
      metadata:
       name: pod-additional-net
       annotations:
         k8s.v1.cni.cncf.io/networks: '[
             {
                     "name": "test-network-1" 

      1

      
             }
       ]'
      spec:
       containers:
       - name: example-pod-1
         command: ["/bin/bash", "-c", "sleep 9000000"]
         image: centos:8

      Copy to Clipboard Toggle word wrap

      1

      Specify the name of the secondary network with the VRF instance.

   2. Create the Pod resource by running the following command. The expected output shows the name of the Pod resource and the creation age in minutes.

      $ oc create -f pod-additional-net.yaml

      Copy to Clipboard Toggle word wrap

2. Verify that the pod network attachment is connected to the VRF secondary network. Start a remote session with the pod and run the following command. The expected output shows the name of the VRF interface and its unique ID in the routing table.

   $ ip vrf show

   Copy to Clipboard Toggle word wrap

3. Confirm that the VRF interface is the controller for the secondary interface:

   $ ip link

   Copy to Clipboard Toggle word wrap

   Example output

   5: net1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master red state UP mode

   Copy to Clipboard Toggle word wrap