You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/nw-about-multicast.adoc
+2-6Lines changed: 2 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,12 +28,8 @@ Multicast traffic between {product-title} pods is disabled by default. If you ar
28
28
ifdef::openshift-sdn[]
29
29
When using the OpenShift SDN network plug-in in `networkpolicy` isolation mode:
30
30
31
-
* Multicast packets sent by a pod will be delivered to all other pods in the
32
-
project, regardless of NetworkPolicy objects. Pods might be able to communicate
33
-
over multicast even when they cannot communicate over unicast.
34
-
* Multicast packets sent by a pod in one project will never be delivered to pods
35
-
in any other project, even if there are NetworkPolicy objects that allow
36
-
communication between the projects.
31
+
* Multicast packets sent by a pod will be delivered to all other pods in the project, regardless of `NetworkPolicy` objects. Pods might be able to communicate over multicast even when they cannot communicate over unicast.
32
+
* Multicast packets sent by a pod in one project will never be delivered to pods in any other project, even if there are `NetworkPolicy` objects that allow communication between the projects.
37
33
38
34
When using the OpenShift SDN network plug-in in `multitenant` isolation mode:
Copy file name to clipboardExpand all lines: modules/nw-configuring-high-performance-multicast-with-sriov.adoc
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ For applications such as streaming media, like Internet Protocol television (IPT
10
10
11
11
When using additional SR-IOV interfaces for multicast:
12
12
13
-
* Multicast packages must be sent or received by a Pod through the additional SR-IOV interface.
13
+
* Multicast packages must be sent or received by a pod through the additional SR-IOV interface.
14
14
* The physical network which connects the SR-IOV interfaces decides the
15
15
multicast routing and topology, which is not controlled by {product-title}.
16
16
@@ -26,7 +26,7 @@ The follow procedure creates an example SR-IOV interface for multicast.
26
26
27
27
.Procedure
28
28
29
-
. Create a SriovNetworkNodePolicy custom resource (CR):
29
+
. Create a `SriovNetworkNodePolicy` object:
30
30
+
31
31
[source,yaml]
32
32
----
@@ -46,7 +46,7 @@ spec:
46
46
rootDevices: ['0000:86:00.0']
47
47
----
48
48
49
-
. Create a SriovNetwork CR:
49
+
. Create a `SriovNetwork` object:
50
50
+
51
51
[source,yaml]
52
52
----
@@ -73,7 +73,7 @@ spec:
73
73
----
74
74
<1> If you choose to configure DHCP as IPAM, ensure that you provision the following default routes through your DHCP server: `224.0.0.0/5` and `232.0.0.0/5`. This is to override the static multicast route set by the default network provider.
The DNS Operator is deployed during installation as a Kubernetes `Deployment`.
15
14
16
-
. Use the `oc get` command to view the Deployment status:
15
+
The DNS Operator is deployed during installation with a `Deployment` object.
16
+
17
+
. Use the `oc get` command to view the deployment status:
17
18
+
18
19
[source,terminal]
19
20
----
@@ -26,9 +27,6 @@ $ oc get -n openshift-dns-operator deployment/dns-operator
26
27
NAME READY UP-TO-DATE AVAILABLE AGE
27
28
dns-operator 1/1 1 1 23h
28
29
----
29
-
ClusterOperator is the Custom Resource object which holds the current state
30
-
of an operator. This object is used by operators to convey their state to
31
-
the rest of the cluster.
32
30
33
31
. Use the `oc get` command to view the state of the DNS Operator:
34
32
+
@@ -44,7 +42,5 @@ NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE
44
42
dns 4.1.0-0.11 True False False 92m
45
43
----
46
44
+
47
-
`AVAILABLE`, `PROGRESSING` and `DEGRADED` provide information about the status of
48
-
the operator. `AVAILABLE` is `True` when at least 1 pod from the CoreDNS DaemonSet
49
-
is reporting an `Available` status condition.
45
+
`AVAILABLE`, `PROGRESSING` and `DEGRADED` provide information about the status of the operator. `AVAILABLE` is `True` when at least 1 pod from the CoreDNS daemon set reports an `Available` status condition.
Copy file name to clipboardExpand all lines: modules/nw-egress-ips-about.adoc
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -134,13 +134,13 @@ Egress IP addresses must not be configured in any Linux network configuration fi
134
134
Allowing additional IP addresses on the primary network interface might require extra configuration when using some cloud or VM solutions.
135
135
====
136
136
137
-
You can assign egress IP addresses to namespaces by setting the `egressIPs` parameter of the `NetNamespace` resource. After an egress IP is associated with a project, OpenShift SDN allows you to assign egress IPs to hosts in two ways:
137
+
You can assign egress IP addresses to namespaces by setting the `egressIPs` parameter of the `NetNamespace` object. After an egress IP is associated with a project, OpenShift SDN allows you to assign egress IPs to hosts in two ways:
138
138
139
139
* In the _automatically assigned_ approach, an egress IP address range is assigned to a node.
140
140
* In the _manually assigned_ approach, a list of one or more egress IP address is assigned to a node.
141
141
142
142
Namespaces that request an egress IP address are matched with nodes that can host those egress IP addresses, and then the egress IP addresses are assigned to those nodes.
143
-
If the `egressIPs` parameter is set on a `NetNamespace` resource, but no node hosts that egress IP address, then egress traffic from the namespace will be dropped.
143
+
If the `egressIPs` parameter is set on a `NetNamespace` object, but no node hosts that egress IP address, then egress traffic from the namespace will be dropped.
144
144
145
145
High availability of nodes is automatic.
146
146
If a node that hosts an egress IP address is unreachable and there are nodes that are able to host that egress IP address, then the egress IP address will move to a new node.
Copy file name to clipboardExpand all lines: modules/nw-externalip-about.adoc
+19-19Lines changed: 19 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,22 +5,22 @@
5
5
[id="nw-externalip-about_{context}"]
6
6
= About ExternalIP
7
7
8
-
For non-cloud environments, {product-title} supports the assignment of external IP addresses to a Service `spec.externalIPs` field through the *ExternalIP* facility.
9
-
This exposes an additional virtual IP address, assigned to the Service, that can be outside the service network defined for the cluster.
10
-
A Service configured with an external IP functions similarly to a Service with `type=NodePort`, allowing you to direct traffic to a local node for load balancing.
8
+
For non-cloud environments, {product-title} supports the assignment of external IP addresses to a `Service` object `spec.externalIPs` field through the *ExternalIP* facility.
9
+
This exposes an additional virtual IP address, assigned to the service, that can be outside the service network defined for the cluster.
10
+
A service configured with an external IP functions similarly to a service with `type=NodePort`, allowing you to direct traffic to a local node for load balancing.
11
11
12
12
You must configure your networking infrastructure to ensure that the external IP address blocks that you define are routed to the cluster.
13
13
14
14
{product-title} extends the ExternalIP functionality in Kubernetes by adding the following capabilities:
15
15
16
16
- Restrictions on the use of external IP addresses through a configurable policy
17
-
- Allocation of an external IP address automatically to a Service upon request
17
+
- Allocation of an external IP address automatically to a service upon request
18
18
19
-
By default, only a user with `cluster-admin` privileges can create a Service with `spec.externalIPs[]` set to IP addresses defined within an external IP address block.
19
+
By default, only a user with `cluster-admin` privileges can create a `Service` object with `spec.externalIPs[]` set to IP addresses defined within an external IP address block.
20
20
21
21
[WARNING]
22
22
====
23
-
Disabled by default, use of ExternalIP functionality can be a security risk, because in-cluster traffic to an external IP address is directed to that Service.
23
+
Disabled by default, use of ExternalIP functionality can be a security risk, because in-cluster traffic to an external IP address is directed to that service.
24
24
This could allow cluster users to intercept sensitive traffic destined for external resources.
25
25
====
26
26
@@ -33,19 +33,19 @@ For cloud deployments, use the load balancer services for automatic deployment o
33
33
You can assign an external IP address in the following ways:
34
34
35
35
Automatic assignment of an external IP::
36
-
{product-title} automatically assigns an IP address from the `autoAssignCIDRs` CIDR block to the `spec.externalIPs[]` array when you create a Service with `spec.type=LoadBalancer` set.
37
-
In this case, {product-title} implements a non-cloud version of the load balancer Service type and assigns IP addresses to the services.
36
+
{product-title} automatically assigns an IP address from the `autoAssignCIDRs` CIDR block to the `spec.externalIPs[]` array when you create a `Service` object with `spec.type=LoadBalancer` set.
37
+
In this case, {product-title} implements a non-cloud version of the load balancer service type and assigns IP addresses to the services.
38
38
Automatic assignment is disabled by default and must be configured by a cluster administrator as described in the following section.
39
39
40
40
Manual assignment of an external IP::
41
-
{product-title} uses the IP addresses assigned to the `spec.externalIPs[]` array when you create a Service. You cannot specify an IP address that is already in use by another Service.
41
+
{product-title} uses the IP addresses assigned to the `spec.externalIPs[]` array when you create a `Service` object. You cannot specify an IP address that is already in use by another service.
42
42
43
43
[id="configuration-externalip_{context}"]
44
44
== Configuration for ExternalIP
45
45
46
46
Use of an external IP address in {product-title} is governed by the following fields in the `Network.config.openshift.io` CR named `cluster`:
47
47
48
-
* `spec.externalIP.autoAssignCIDRs` defines an IP address block used by the load balancer when choosing an external IP address for the service. {product-title} supports only a single IP address block for automatic assignment. This can be simpler than having to manage the port space of a limited number of shared IP addresses when manually assigning ExternalIPs to services. If automatic assignment is enabled, a Service with `spec.type=LoadBalancer` is allocated an external IP address.
48
+
* `spec.externalIP.autoAssignCIDRs` defines an IP address block used by the load balancer when choosing an external IP address for the service. {product-title} supports only a single IP address block for automatic assignment. This can be simpler than having to manage the port space of a limited number of shared IP addresses when manually assigning ExternalIPs to services. If automatic assignment is enabled, a `Service` object with `spec.type=LoadBalancer` is allocated an external IP address.
49
49
* `spec.externalIP.policy` defines the permissible IP address blocks when manually specifying an IP address. {product-title} does not apply policy rules to IP address blocks defined by `spec.externalIP.autoAssignCIDRs`.
50
50
51
51
If routed correctly, external traffic from the configured external IP address block can reach service endpoints through any TCP or UDP port that the service exposes.
@@ -65,9 +65,9 @@ of the ports exposed by other services.
65
65
To use IP address blocks defined by `autoAssignCIDRs` in {product-title}, you must configure the necessary IP address assignment and routing for your host network.
66
66
====
67
67
68
-
The following YAML describes a Service with an external IP configured:
68
+
The following YAML describes a service with an external IP address configured:
69
69
70
-
.Example Service object with `spec.externalIPs[]` set
70
+
.Example `Service` object with `spec.externalIPs[]` set
71
71
[source,yaml]
72
72
----
73
73
apiVersion: v1
@@ -115,22 +115,22 @@ The policy object has the following shape:
115
115
116
116
When configuring policy restrictions, the following rules apply:
117
117
118
-
- If `policy={}` is set, then creating a Service with `spec.ExternalIPs[]` set will fail. This is the default for {product-title}.
119
-
- If `policy=null` is set, then creating a Service with `spec.ExternalIPs[]` set to any IP address is allowed.
118
+
- If `policy={}` is set, then creating a `Service` object with `spec.ExternalIPs[]` set will fail. This is the default for {product-title}.
119
+
- If `policy=null` is set, then creating a `Service` object with `spec.ExternalIPs[]` set to any IP address is allowed.
120
120
- If `policy` is set and either `policy.allowedCIDRs[]` or `policy.rejectedCIDRs[]` is set, the following rules apply:
121
121
122
122
* If `allowedCIDRs[]` and `rejectedCIDRs[]` are both set, then `rejectedCIDRs[]` has precedence over `allowedCIDRs[]`.
123
-
* If `allowedCIDRs[]` is set, creating a Service with `spec.ExternalIPs[]` will succeed only if the specified IP addresses are allowed.
124
-
* If `rejectedCIDRs[]` is set, creating a Service with `spec.ExternalIPs[]` will succeed only if the specified IP addresses are not rejected.
123
+
* If `allowedCIDRs[]` is set, creating a `Service` object with `spec.ExternalIPs[]` will succeed only if the specified IP addresses are allowed.
124
+
* If `rejectedCIDRs[]` is set, creating a `Service` object with `spec.ExternalIPs[]` will succeed only if the specified IP addresses are not rejected.
125
125
126
126
[id="example-policy-objects_{context}"]
127
127
== Example policy objects
128
128
129
129
The examples that follow demonstrate several different policy configurations.
130
130
131
-
- In the following example, the policy prevents {product-title} from creating any Service with an external IP address specified:
131
+
- In the following example, the policy prevents {product-title} from creating any service with an external IP address specified:
132
132
+
133
-
.Example policy to reject any value specified for Service `spec.externalIPs[]`
133
+
.Example policy to reject any value specified for `Service` object `spec.externalIPs[]`
134
134
[source,yaml]
135
135
----
136
136
apiVersion: config.openshift.io/v1
@@ -165,7 +165,7 @@ spec:
165
165
- In the following example, `policy` is set to `null`.
166
166
If set to `null`, when inspecting the configuration object by entering `oc get networks.config.openshift.io -o yaml`, the `policy` field will not appear in the output.
167
167
+
168
-
.Example policy to allow any value specified for Service `spec.externalIPs[]`
168
+
.Example policy to allow any value specified for `Service` object `spec.externalIPs[]`
0 commit comments