Skip to content

Commit 145561c

Browse files
aireillyaireilly
committed
updates for CNF-846
removed CNI plugin details parapgraph typo review comments review comments updates updates, tweaks updates for CNF-846 updates from federico updated with latest comments updated with latest comments pod typo updates for Nikita plugins change for @djuran fixes to apply Ashley's review comments
1 parent 1d029f0 commit 145561c

8 files changed

+287
-4
lines changed

‎_topic_map.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -684,9 +684,11 @@ Topics:
684684
Topics:
685685
- Name: Understanding multiple networks
686686
File: understanding-multiple-networks
687-
- Name: Attaching a Pod to an additional network
687+
- Name: About virtual routing and forwarding
688+
File: about-virtual-routing-and-forwarding
689+
- Name: Attaching a pod to an additional network
688690
File: attaching-pod
689-
- Name: Removing a Pod from an additional network
691+
- Name: Removing a pod from an additional network
690692
File: removing-pod
691693
- Name: Configuring a bridge network
692694
File: configuring-bridge
@@ -704,6 +706,8 @@ Topics:
704706
File: remove-additional-network
705707
- Name: Configuring PTP
706708
File: configuring-ptp
709+
- Name: Assigning a secondary network to a VRF
710+
File: assigning-a-secondary-network-to-a-vrf
707711
- Name: Hardware networks
708712
Dir: hardware_networks
709713
Distros: openshift-enterprise,openshift-webscale,openshift-origin
@@ -720,7 +724,7 @@ Topics:
720724
File: configuring-sriov-net-attach
721725
- Name: Configuring an SR-IOV InfiniBand network attachment
722726
File: configuring-sriov-ib-attach
723-
- Name: Adding Pod to an SR-IOV network
727+
- Name: Adding a pod to an SR-IOV network
724728
File: add-pod
725729
- Name: Using high performance multicast
726730
File: using-sriov-multicast

‎modules/cnf-about-virtual-routing-and-forwarding.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// networking/multiple_networks/about-virtual-routing-and-forwarding.adoc
4+
5+
[id="cnf-about-virtual-routing-and-forwarding_{context}"]
6+
= About virtual routing and forwarding
7+
8+
Virtual routing and forwarding (VRF) devices combined with IP rules provide the ability to create virtual routing and forwarding domains. VRF reduces the number of permissions needed by CNF, and provides increased visibility of the network topology of secondary networks. VRF is used to provide multi-tenancy functionality, for example, where each tenant has its own unique routing tables and requires different default gateways.
9+
10+
Processes can bind a socket to the VRF device. Packets through the binded socket use the routing table associated with the VRF device. An important feature of VRF is that it impacts only OSI model layer 3 traffic and above so L2 tools, such as LLDP, are not affected. This allows higher priority IP rules such as policy based routing to take precedence over the VRF device rules directing specific traffic.
11+
12+
[id="cnf-benefits-secondary-networks-telecommunications-operators_{context}"]
13+
== Benefits of secondary networks for pods for telecommunications operators
14+
15+
In telecommunications use cases, each CNF can potentially be connected to multiple different networks sharing the same address space. These secondary networks can potentially conflict with the cluster's main network CIDR. Using the CNI VRF plug-in, network functions can be connected to different customers' infrastructure using the same IP address, keeping different customers isolated. IP addresses are overlapped with {product-title} IP space. The CNI VRF plug-in also reduces the number of permissions needed by CNF and increases the visibility of network topologies of secondary networks.

‎modules/cnf-assigning-a-secondary-network-to-a-vrf.adoc‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
// Module included in the following assemblies:
2+
//
3+
// networking/multiple_networks/assigning-a-secondary-network-to-a-vrf.adoc
4+
5+
6+
[id="cnf-assigning-a-secondary-network-to-a-vrf_{context}"]
7+
= Assigning a secondary network to a VRF
8+
9+
As a cluster administrator, you can configure an additional network for your VRF domain by using the CNI VRF plug-in. The virtual network created by this plug-in is associated with a physical interface that you specify.
10+
11+
[id="cnf-creating-an-additional-network-attachment-with-the-cni-vrf-plug-in_{context}"]
12+
== Creating an additional network attachment with the CNI VRF plug-in
13+
14+
The Cluster Network Operator (CNO) manages additional network definitions. When you specify an additional network to create, the CNO creates the `NetworkAttachmentDefinition` custom resource (CR) automatically.
15+
16+
[NOTE]
17+
====
18+
Do not edit the `NetworkAttachmentDefinition` CRs that the Cluster Network Operator manages. Doing so might disrupt network traffic on your additional network.
19+
====
20+
21+
.Prerequisites
22+
23+
* Install the {product-title} CLI (oc).
24+
* Log in to the OpenShift cluster as a user with cluster-admin privileges.
25+
26+
.Procedure
27+
28+
. Create the CNO CR by running the following command:
29+
+
30+
[source,terminal]
31+
----
32+
$ oc edit networks.operator.openshift.io cluster
33+
----
34+
. Extend the CR that you are creating by adding the `rawCNIConfig` configuration for the additional network, as in the example CR below. The following YAML configures the CNI VRF plug-in:
35+
+
36+
[source,yaml]
37+
----
38+
apiVersion: operator.openshift.io/v1
39+
kind: Network
40+
metadata:
41+
name: cluster
42+
spec:
43+
additionalNetworks:
44+
- name: test-network-1
45+
namespace: test-1
46+
type: Raw
47+
rawCNIConfig: '{
48+
"cniVersion": "0.3.1",
49+
"name": "macvlan-vrf",
50+
"plugins": [ <1>
51+
{
52+
"type": "macvlan", <2>
53+
"master": "eth1",
54+
"ipam": {
55+
"type": "static",
56+
"addresses": [
57+
{
58+
"address": "191.168.1.23/24"
59+
}
60+
]
61+
}
62+
},
63+
{
64+
"type": "vrf",
65+
"vrfname": "example-vrf-name", <3>
66+
"table": 1001 <4>
67+
}]
68+
}'
69+
----
70+
<1> `plugins` must be a list. The first item in the list must be secondary network underpinning the VRF network. The second item in the list is the VRF plugin configuration.
71+
<2> `type` must be set to `vrf`.
72+
<3> `vrfname` is the name of the VRF that the interface is assigned to. If it does not exist in the pod, it is created.
73+
<4> `table` is the routing table ID. Optional. By default, the `tableid` parameter is used. If it is not specified, the CNI assigns a free routing table ID to the VRF.
74+
+
75+
[NOTE]
76+
====
77+
VRF will function correctly only when the resource is of type `netdevice`.
78+
====
79+
. Save your changes and quit the text editor to commit your changes.
80+
. Confirm that the CNO created the `NetworkAttachmentDefinition` CR by running the following command. Replace `<namespace>` with the namespace that you specified when configuring the network attachment. There might be a delay before the CNO creates the CR.
81+
+
82+
[source,terminal]
83+
----
84+
$ oc get network-attachment-definitions -n <namespace>
85+
----
86+
+
87+
.Example output
88+
[source,terminal]
89+
----
90+
NAME AGE
91+
additional-network-1 14m
92+
----
93+
94+
.Verifying that the additional VRF network attachment is successful
95+
96+
To verify that the VRF CNI is correctly configured and the additional network attachment is attached, do the following:
97+
98+
. Create a network that uses the VRF CNI.
99+
. Assign the network to a pod.
100+
. Verify that the pod network attachment is connected to the VRF additional network. SSH into the pod and run the following command:
101+
+
102+
[source,terminal]
103+
----
104+
$ ip vrf show
105+
----
106+
+
107+
.Example output
108+
+
109+
[source,terminal]
110+
----
111+
Name Table
112+
-----------------------
113+
red 10
114+
----
115+
. Confirm the VRF interface is master of the secondary interface:
116+
+
117+
[source,terminal]
118+
----
119+
$ ip link
120+
----
121+
+
122+
.Example output
123+
+
124+
[source,terminal]
125+
----
126+
5: net1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master red state UP mode
127+
----
128+

‎modules/cnf-assigning-a-sriov-network-to-a-vrf.adoc‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
// Module included in the following assemblies:
2+
//
3+
//networking/hardware_networks/configuring-sriov-device.adoc
4+
5+
[id="cnf-assigning-a-sriov-network-to-a-vrf_{context}"]
6+
= Assigning an SR-IOV network to a VRF
7+
8+
As a cluster administrator, you can assign an SR-IOV network interface to your VRF domain by using the CNI VRF plug-in.
9+
10+
To do this, add the VRF configuration to the optional `metaPlugins` parameter of the `SriovNetwork` resource.
11+
12+
[id="cnf-creating-an-additional-sriov-network-with-vrf-plug-in_{context}"]
13+
== Creating an additional SR-IOV network attachment with the CNI VRF plug-in
14+
15+
The SR-IOV Network Operator manages additional network definitions. When you specify an additional SR-IOV network to create, the SR-IOV Network Operator creates the `NetworkAttachmentDefinition` custom resource (CR) automatically.
16+
17+
[NOTE]
18+
====
19+
Do not edit `NetworkAttachmentDefinition` custom resources that the SR-IOV Network Operator manages. Doing so might disrupt network traffic on your additional network.
20+
====
21+
22+
.Prerequisites
23+
* Install the {product-title} CLI (oc).
24+
* Log in to the {product-title} cluster as a user with cluster-admin privileges.
25+
26+
.Procedure
27+
. Create the `SriovNetwork` CR by running the following command:
28+
+
29+
[source,terminal]
30+
----
31+
$ oc create sriovnetwork.openshift.io cluster
32+
----
33+
. Extend the CR that you are creating by adding the `metaPlugins` configuration for the additional network you are creating, as in the following example CR.
34+
. Save your changes and quit the text editor to commit your changes. The following YAML configures the `SriovNetwork` object:
35+
+
36+
[source,yaml]
37+
----
38+
apiVersion: sriovnetwork.openshift.io/v1
39+
kind: SriovNetwork
40+
metadata:
41+
name: example-network
42+
namespace: additional-sriov-network-1
43+
spec:
44+
ipam: |
45+
{
46+
"type": "host-local",
47+
"subnet": "10.56.217.0/24",
48+
"rangeStart": "10.56.217.171",
49+
"rangeEnd": "10.56.217.181",
50+
"routes": [{
51+
"dst": "0.0.0.0/0"
52+
}],
53+
"gateway": "10.56.217.1"
54+
}
55+
vlan: 0
56+
resourceName: intelnics
57+
metaPlugins : |
58+
{
59+
"type": "vrf", <1>
60+
"vrfname": "example-vrf-name" <2>
61+
}
62+
----
63+
<1> `type` must be set to `vrf`.
64+
<2> `vrfname` is the name of the VRF that the interface is assigned to. If it does not exist in the pod, it is created.
65+
66+
.Verify the `NetworkAttachmentDefinition` CR is successfully created
67+
Confirm that the SR-IOV Network Operator created the `NetworkAttachmentDefinition` CR by running the following command. Replace `<namespace>` with the namespace that you specified when configuring the network attachment. There might be a delay before the SR-IOV Network Operator creates the CR.
68+
69+
[source,terminal]
70+
----
71+
$ oc get network-attachment-definitions -n <namespace>
72+
----
73+
74+
.Example output
75+
[source,terminal]
76+
----
77+
NAME AGE
78+
additional-sriov-network-1 14m
79+
----
80+
81+
.Verifying that the additional SR-IOV network attachment is successful
82+
83+
To verify that the VRF CNI is correctly configured and the additional SR-IOV network attachment is attached, do the following:
84+
85+
. Create an SR-IOV network that uses the VRF CNI.
86+
. Assign the network to a pod.
87+
. Verify that the pod network attachment is connected to the SR-IOV additional network. SSH into the pod and run the following command:
88+
+
89+
[source,terminal]
90+
----
91+
$ ip vrf show
92+
----
93+
+
94+
.Example output
95+
[source,terminal]
96+
----
97+
Name Table
98+
-----------------------
99+
red 10
100+
----
101+
. Confirm the VRF interface is master of the secondary interface:
102+
+
103+
[source,terminal]
104+
----
105+
$ ip link
106+
----
107+
+
108+
.Example output
109+
[source,terminal]
110+
----
111+
5: net1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master red state UP mode
112+
----
113+

‎networking/hardware_networks/configuring-sriov-device.adoc‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,10 @@ You can configure a Single Root I/O Virtualization (SR-IOV) device in your clust
1010
include::modules/nw-sriov-networknodepolicy-object.adoc[leveloffset=+1]
1111
// A direct companion to nw-sriov-networknodepolicy-object
1212
include::modules/nw-sriov-nic-partitioning.adoc[leveloffset=+2]
13-
1413
include::modules/nw-sriov-configuring-device.adoc[leveloffset=+1]
14+
:FeatureName: CNI VRF plug-in
15+
include::modules/technology-preview.adoc[leveloffset=+1]
16+
include::modules/cnf-assigning-a-sriov-network-to-a-vrf.adoc[leveloffset=+1]
1517

1618
[id="configuring-sriov-device-next-steps"]
1719
== Next steps

‎networking/multiple_networks/about-virtual-routing-and-forwarding.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[id="about-virtual-routing-and-forwarding"]
2+
= About virtual routing and forwarding
3+
include::modules/common-attributes.adoc[]
4+
:context: about-virtual-routing-and-forwarding
5+
6+
toc::[]
7+
8+
include::modules/cnf-about-virtual-routing-and-forwarding.adoc[leveloffset=+1]

‎networking/multiple_networks/assigning-a-secondary-network-to-a-vrf.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[id="assigning-a-secondary-network-to-a-vrf"]
2+
= Assigning a secondary network to a VRF
3+
include::modules/common-attributes.adoc[]
4+
:context: assigning-a-secondary-network-to-a-vrf
5+
6+
toc::[]
7+
8+
:FeatureName: CNI VRF plug-in
9+
include::modules/technology-preview.adoc[leveloffset=+1]
10+
11+
include::modules/cnf-assigning-a-secondary-network-to-a-vrf.adoc[leveloffset=+1]

‎networking/multiple_networks/understanding-multiple-networks.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,5 @@ A macvlan additional network can be configured in two ways:
6464
- xref:../../networking/multiple_networks/configuring-macvlan.adoc#configuring-macvlan[Configuring a macvlan-based additional network]
6565

6666
* *SR-IOV*: xref:../../networking/hardware_networks/about-sriov.adoc#about-sriov[Configuring an SR-IOV based additional network] allows pods to attach to a virtual function (VF) interface on SR-IOV capable hardware on the host system.
67+
68+
include::modules/nw-multus-remove-pod.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)