Skip to content

Commit 2639adc

Browse files
mburke5678mburke5678
authored
Merge pull request #53799 from ShaunaDiaz/OSDOCS-4693
OSDOCS-4693: Update firewall docs to allow MicroShift API
2 parents 9438426 + adee5e9 commit 2639adc

20 files changed

+253
-165
lines changed

‎microshift_networking/microshift-networking.adoc

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,16 @@ include::modules/microshift-configuring-ovn.adoc[leveloffset=+1]
2222
include::modules/microshift-http-proxy.adoc[leveloffset=+1]
2323
include::modules/microshift-cri-o-container-runtime.adoc[leveloffset=+1]
2424
include::modules/microshift-ovs-snapshot.adoc[leveloffset=+1]
25-
include::modules/microshift-firewall-config.adoc[leveloffset=+1]
2625
include::modules/microshift-mDNS.adoc[leveloffset=+1]
26+
27+
include::modules/microshift-firewall-config.adoc[leveloffset=+1]
28+
include::modules/microshift-firewalld-install.adoc[leveloffset=+1]
29+
include::modules/microshift-firewall-req-settings.adoc[leveloffset=+1]
30+
include::modules/microshift-firewall-opt-settings.adoc[leveloffset=+1]
31+
include::modules/microshift-firewall-allow-traffic.adoc[leveloffset=+1]
32+
include::modules/microshift-firewall-verify-settings.adoc[leveloffset=+1]
33+
include::modules/microshift-firewall-known-issue.adoc[leveloffset=+1]
34+
35+
[role="_additional-resources"]
36+
.Additional resources
37+
* link:https://https://access.redhat.com/documentation/en-us/microshift/4.12/toubleshooting/index[Troubleshooting and known issues].

‎modules/about-microshift.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
// Module included in the following assemblies:
22
//
3-
// microshift/understanding-microshift.adoc
3+
// microshift/understanding-microshift.adoc
44

55
[id="con-about-microshift_{context}"]
6-
= About MicroShift
6+
= About {product-title}
77

88
Working with low-resource field environments and hardware presents many challenges not experienced with cloud computing. {product-title} enables you to solve problems for edge devices by:
99

10-
* Overcoming the operational challenge of minimal system resources, for example, a {op-system-chip} with {op-system-ram}.
10+
* Overcoming the operational challenge of minimal system resources, for example, a {op-system-chip}.
1111
* Addressing the environmental challenges of severe networking constraints such as low or no connectivity.
1212
* Meeting the physical constraint of hard-to-access locations by installing your system images directly on edge devices.
1313
* Building on and integrating with edge-optimized operating systems such as {op-system-first}.

‎modules/microshift-configuring-ovn.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
:_content-type: PROCEDURE
66
[id="microshift-config-OVN-K_{context}"]
7-
== Configuring OVN-Kubernetes
7+
= Configuring OVN-Kubernetes
88
An OVN-Kubernetes config file can be written to `/etc/microshift/ovn.yaml`. {product-title} will use default OVN-Kubernetes configuration values if an OVN-Kubernetes config file is not customized.
99

1010
.Default `ovn.yaml` config values:

‎modules/microshift-cri-o-container-runtime.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
:_content-type: PROCEDURE
66
[id="microshift-CRI-O-container-engine_{context}"]
7-
== CRI-O container runtime
7+
= CRI-O container runtime
88
To use an HTTP(S) proxy in `CRI-O`, you need to set the `HTTP_PROXY` and `HTTPS_PROXY` environment variables. You can also set the `NO_PROXY` variable to exclude a list of hosts from being proxied.
99

1010
.Procedure

‎modules/microshift-firewall-allow-traffic.adoc

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="microshift-firewall-network-traffic_{context}"]
7+
= Allowing network traffic through the firewall
8+
You can allow network traffic through the firewall by first configuring the IP address range with either default or custom values, and then allowing internal traffic from pods through the network gateway by inserting the DNS server.
9+
10+
.Procedure
11+
12+
.. To configure the IP address range with default values, run the following command:
13+
+
14+
[source,terminal]
15+
----
16+
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
17+
----
18+
19+
.. Alternatively, you can configure the IP address range with custom values by running the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=<custom IP range>
24+
----
25+
26+
.. To allow internal traffic from pods through the network gateway, run the following command:
27+
+
28+
[source, terminal]
29+
----
30+
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1
31+
----
32+
33+
[id="microshift-firewall-applying-settings_{context}"]
34+
== Applying firewall settings
35+
After you have finished configuring, run the following command to restart the firewall and apply settings:
36+
37+
[source,terminal]
38+
----
39+
$ sudo firewall-cmd --reload
40+
----

‎modules/microshift-firewall-config.adoc

Lines changed: 2 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Module included in the following assemblies:
22
//
3-
// * microshift_configuring/microshift-networking.adoc
3+
// * microshift_networking/microshift-networking.adoc
44

55
:_content-type: CONCEPT
66
[id="microshift-firewall-config_{context}"]
@@ -22,136 +22,4 @@ The Kubernetes pod that uses host network
2222
[IMPORTANT]
2323
====
2424
{product-title} pods must have access to the internal CoreDNS component and API servers.
25-
====
26-
27-
[id="microshift-firewall-install_{context}"]
28-
== Installing the `firewalld` service
29-
To install and run the `firewalld` service, run the following commands:
30-
31-
.Procedure
32-
33-
. To install the `firewalld` service:
34-
+
35-
[source,terminal]
36-
----
37-
$ sudo dnf install -y firewalld
38-
----
39-
40-
. To initiate the firewall:
41-
+
42-
[source,terminal]
43-
----
44-
$ sudo systemctl enable firewalld --now
45-
----
46-
47-
[id="microshift-required-settings_{context}"]
48-
== Required settings
49-
An IP address range for pods is a required part of the firewall configuration. You can use the default values or customize the IP address range. You must also configure pod access to the internal CoreDNS component.
50-
51-
.Required settings
52-
[cols="1,1",options="header"]
53-
|===
54-
^| IR Range ^| Description
55-
56-
|10.42.0.0/16
57-
|Host network pod access to CoreDNS and {product-title} API
58-
59-
|169.254.169.1
60-
|Host network pod access to {product-title} API Server
61-
|===
62-
63-
.Procedure
64-
65-
. Run the following commands to allow network traffic by first configuring the IP address range with either default or custom values, then allow internal traffic from pods through the network gateway by inserting the DNS server.
66-
67-
.. To use default values for the IP address range:
68-
+
69-
[source,terminal]
70-
----
71-
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
72-
----
73-
74-
.. To allow internal traffic from pods through the network gateway:
75-
+
76-
[source, terminal]
77-
----
78-
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1
79-
----
80-
81-
. To use custom values for the IP address range:
82-
+
83-
[source,terminal]
84-
----
85-
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=<custom IP range>
86-
----
87-
88-
. To allow internal traffic from pods through the network gateway:
89-
+
90-
[source,terminal]
91-
----
92-
$ sudo firewall-offline-cmd --permanent --zone=trusted --add-source=169.254.169.1
93-
----
94-
95-
. Reload the firewall rules:
96-
+
97-
[source, terminal]
98-
----
99-
$ sudo firewall-cmd --reload
100-
----
101-
102-
[id="microshift-firewall-optional-settings_{context}"]
103-
== Optional settings
104-
105-
.Procedure
106-
107-
. To add customized ports to your firewall configuration, use the following command syntax:
108-
+
109-
[source,terminal]
110-
----
111-
$ sudo firewall-offline-cmd --permanent --zone=public --add-port=<port number>/<port protocol>
112-
----
113-
+
114-
.Optional ports
115-
[option="header"]
116-
|===
117-
|Port(s)|Protocol(s)|Description
118-
119-
|80
120-
|TCP
121-
|HTTP port used to serve applications through the {ocp} router.
122-
123-
|443
124-
|TCP
125-
|HTTPS port used to serve applications through the {ocp} router.
126-
127-
|5353
128-
|UDP
129-
|mDNS service to respond for {ocp} route mDNS hosts.
130-
131-
|30000-32767
132-
|TCP
133-
|Port range reserved for NodePort services; can be used to expose applications on the LAN.
134-
135-
|30000-32767
136-
|UDP
137-
|Port range reserved for NodePort services; can be used to expose applications on the LAN.
138-
139-
|6443
140-
|TCP
141-
|HTTPS API port for the {product-title} API.
142-
|===
143-
144-
=== Known firewall issue
145-
To avoid breaking traffic flows with a firewall restart, execute firewall commands before starting OVN-Kubernetes pods. OVN-Kubernetes makes use of iptable rules for some traffic flows, such as those using the NodePort service. The iptable rules are generated and inserted by the `ovnkube-master` container, but are deleted when the firewall restarts. The absence of the iptable rules breaks traffic flows. If firewall commands have to be executed after OVN-Kubernetes pods have started, manually restart the `ovnkube-master` pod to trigger a reconciliation of the iptable rules.
146-
//See Troubleshooting for a detailed procedure. Need hard link to troubleshooting section
147-
148-
[id="microshift-firewall-applying-settings_{context}"]
149-
== Applying firewall settings
150-
After you have finished configuring, run the following command to restart the firewall and apply settings:
151-
152-
[source,terminal]
153-
----
154-
$ sudo firewall-offline-cmd --reload
155-
----
156-
157-
//Q: How do we verify? What should we see after running this command?
25+
====

‎modules/microshift-firewall-known-issue.adoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="microshift-firewall-known-issue_{context}"]
7+
= Known firewall issue
8+
* To avoid breaking traffic flows with a firewall reload or restart, execute firewall commands before starting {product-title}. The CNI driver in {product-title} makes use of iptable rules for some traffic flows, such as those using the NodePort service. The iptable rules are generated and inserted by the CNI driver, but are deleted when the firewall reloads or restarts. The absence of the iptable rules breaks traffic flows. If firewall commands have to be executed after {product-title} is running, manually restart `ovnkube-master` pod in the `openshift-ovn-kubernetes` namespace to reset the rules controlled by the CNI driver.

‎modules/microshift-firewall-opt-settings.adoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: PROCEDURE
6+
7+
[id="microshift-firewall-optional-settings_{context}"]
8+
= Optional port settings
9+
10+
.Procedure
11+
12+
. To add customized ports to your firewall configuration, use the following command syntax:
13+
+
14+
[source,terminal]
15+
----
16+
$ sudo firewall-cmd --permanent --zone=public --add-port=<port number>/<port protocol>
17+
----
18+
+
19+
.Optional ports
20+
[option="header"]
21+
|===
22+
|Port(s)|Protocol(s)|Description
23+
24+
|80
25+
|TCP
26+
|HTTP port used to serve applications through the {ocp} router.
27+
28+
|443
29+
|TCP
30+
|HTTPS port used to serve applications through the {ocp} router.
31+
32+
|5353
33+
|UDP
34+
|mDNS service to respond for {ocp} route mDNS hosts.
35+
36+
|30000-32767
37+
|TCP
38+
|Port range reserved for NodePort services; can be used to expose applications on the LAN.
39+
40+
|30000-32767
41+
|UDP
42+
|Port range reserved for NodePort services; can be used to expose applications on the LAN.
43+
44+
|6443
45+
|TCP
46+
|HTTPS API port for the {product-title} API.
47+
|===
48+
49+
The following are examples of commands used when requiring external access through the firewall to services running on {product-title}, such as port 6443 for the API server, for example, ports 80 and 443 for applications exposed through the router.
50+
51+
.Example commands
52+
53+
* Configuring a port for the {product-title} API server:
54+
+
55+
[source, terminal]
56+
----
57+
$ sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
58+
----
59+
60+
* Configuring ports for applications exposed through the router:
61+
+
62+
[source, terminal]
63+
----
64+
$ sudo firewall-cmd --permanent --zone=public --add-port=80/tcp
65+
----
66+
+
67+
[source, terminal]
68+
----
69+
$ sudo firewall-cmd --permanent --zone=public --add-port=443/tcp
70+
----
71+

‎modules/microshift-firewall-req-settings.adoc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="microshift-required-settings_{context}"]
7+
= Required firewall settings
8+
An IP address range for the cluster network must be enabled during firewall configuration. You can use the default values or customize the IP address range. If you choose to customize the cluster network IP address range from the default `10.42.0.0/16` setting, you must also use the same custom range in the firewall configuration.
9+
10+
.Firewall IP address settings
11+
[cols="3",options="header"]
12+
|===
13+
|IP Range
14+
|Firewall rule required
15+
|Description
16+
17+
|10.42.0.0/16
18+
|No
19+
|Host network pod access to other pods
20+
21+
|169.254.169.1
22+
|Yes
23+
|Host network pod access to {product-title} API server
24+
|===
25+
26+
The following are examples of commands for settings that are mandatory for firewall configuration:
27+
28+
.Example commands
29+
30+
* Configure host network pod access to other pods:
31+
+
32+
[source, terminal]
33+
----
34+
$ sudo firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
35+
----
36+
37+
* Configure host network pod access to services backed by Host endpoints, such as the {product-title} API:
38+
+
39+
[source, terminal]
40+
----
41+
$ sudo firewall-cmd --permanent --zone=trusted --add-source=169.254.169.1
42+
----

‎modules/microshift-firewall-verify-settings.adoc

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="microshift-firewall-verifying-settings_{context}"]
7+
= Verifying firewall settings
8+
After you have restarted the firewall, you can verify your settings by listing them.
9+
10+
.Procedure
11+
12+
* To verify rules added in the default public zone, such as ports-related rules, run the following command:
13+
+
14+
[source,terminal]
15+
----
16+
$ sudo firewall-cmd --list-all
17+
----
18+
19+
* To verify rules added in the trusted zone, such as IP-range related rules, run the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ sudo firewall-cmd --zone=trusted --list-all
24+
----

0 commit comments

Comments
 (0)