Skip to content

Commit 56ac56c

Browse files
jab-rhjab-rh
authored
Merge pull request #49375 from jboxman-rh/OSDOCS-2175
OSDOCS-2175: Add optional migration of OpenShift SDN features
2 parents 75ecdc0 + 12d59f8 commit 56ac56c

File tree

4 files changed

+109
-7
lines changed

4 files changed

+109
-7
lines changed

‎modules/nw-egressnetworkpolicy-about.adoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,13 @@ endif::ovn[]
4646

4747
[IMPORTANT]
4848
====
49-
If your egress firewall includes a deny rule for `0.0.0.0/0`, access to your {product-title} API servers is blocked. To ensure that pods can access the {product-title} API servers, you must include the built-in join network `100.64.0.0/16` of Open Virtual Network (OVN) to allow access when using node ports together with an EgressFirewall. You must also include the IP address range that the API servers listen on in your egress firewall rules, as in the following example:
49+
If your egress firewall includes a deny rule for `0.0.0.0/0`, access to your {product-title} API servers is blocked. You must include the IP address range that the API servers listen on in your egress firewall rules.
50+
51+
ifdef::ovn[]
52+
If you use the OVN-Kubernetes network plug-in, you must include the built-in join network `100.64.0.0/16` to allow access when using node ports together with an egress firewall. If you changed this join network during cluster installation, use the value that you specified instead of `100.64.0.0/16`.
53+
endif::ovn[]
54+
55+
The following example illustrates the order of the egress firewall rules necessary to ensure API server access:
5056
5157
[source,yaml,subs="attributes+"]
5258
----

‎modules/nw-ovn-kubernetes-migration-about.adoc

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ A migration to the OVN-Kubernetes cluster network provider is supported on the f
1313
* Bare metal hardware
1414
* Amazon Web Services (AWS)
1515
* Google Cloud Platform (GCP)
16+
* IBM Cloud
1617
* Microsoft Azure
1718
* {rh-openstack-first}
1819
* {rh-virtualization-first}
@@ -25,17 +26,22 @@ The subnets assigned to nodes and the IP addresses assigned to individual pods a
2526

2627
While the OVN-Kubernetes network provider implements many of the capabilities present in the OpenShift SDN network provider, the configuration is not the same.
2728

29+
* If your cluster uses any of the following OpenShift SDN capabilities, the migration to OVN-Kubernetes migrates the configuration for these features as well:
30+
+
31+
--
32+
* Egress IPs
33+
* Egress firewall
34+
* Multicast
35+
--
36+
2837
* If your cluster uses any of the following OpenShift SDN capabilities, you must manually configure the same capability in OVN-Kubernetes:
2938
+
3039
--
3140
* Namespace isolation
32-
* Egress IP addresses
33-
* Egress network policies
3441
* Egress router pods
35-
* Multicast
3642
--
3743

38-
* If your cluster uses any part of the `100.64.0.0/16` IP address range, you cannot migrate to OVN-Kubernetes because it uses this IP address range internally.
44+
* If your cluster uses any part of the 100.64.0.0/16 IP address range, you must specify an alternative IP address range for OVN-Kubernetes during the migration to avoid a conflict because OVN-Kubernetes uses this IP address range internally.
3945

4046
The following sections highlight the differences in configuration between the aforementioned capabilities in OVN-Kubernetes and OpenShift SDN.
4147

@@ -54,6 +60,13 @@ If your cluster uses OpenShift SDN configured in either the multitenant or subne
5460
[id="egress-ip-addresses_{context}"]
5561
=== Egress IP addresses
5662

63+
OpenShift SDN supports two different Egress IP modes:
64+
65+
* In the _automatically assigned_ approach, an egress IP address range is assigned to a node.
66+
* In the _manually assigned_ approach, a list of one or more egress IP addresses is assigned to a node.
67+
68+
The migration process supports migrating Egress IP configurations that use the automatically assigned mode.
69+
5770
The differences in configuring an egress IP address between OVN-Kubernetes and OpenShift SDN is described in the following table:
5871

5972
.Differences in egress IP address configuration
@@ -90,7 +103,14 @@ The difference in configuring an egress network policy, also known as an egress
90103
* Create an `EgressNetworkPolicy` object in a namespace
91104
|===
92105

106+
[NOTE]
107+
====
108+
Because the name of an `EgressFirewall` object can only be set to `default`, after the migration all migrated `EgressNetworkPolicy` objects are named `default`, regardless of what the name was under OpenShift SDN.
109+
110+
If you subsequently rollback to OpenShift SDN, all `EgressNetworkPolicy` objects are named `default` as the prior name is lost.
111+
93112
For more information on using an egress firewall in OVN-Kubernetes, see "Configuring an egress firewall for a project".
113+
====
94114

95115
[discrete]
96116
[id="egress-router-pods_{context}"]

‎modules/nw-ovn-kubernetes-migration.adoc

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,19 +38,54 @@ $ oc get Network.config.openshift.io cluster -o yaml > cluster-openshift-sdn.yam
3838
[source,terminal]
3939
----
4040
$ oc patch Network.operator.openshift.io cluster --type='merge' \
41-
--patch '{ "spec": { "migration": {"networkType": "OVNKubernetes" } } }'
41+
--patch '{ "spec": { "migration": { "networkType": "OVNKubernetes" } } }'
4242
----
4343
+
4444
[NOTE]
4545
====
4646
This step does not deploy OVN-Kubernetes immediately. Instead, specifying the `migration` field triggers the Machine Config Operator (MCO) to apply new machine configs to all the nodes in the cluster in preparation for the OVN-Kubernetes deployment.
4747
====
4848

49+
. Optional: You can disable automatic migration of several OpenShift SDN capabilities to the OVN-Kubernetes equivalents:
50+
+
51+
--
52+
* Egress IPs
53+
* Egress firewall
54+
* Multicast
55+
--
56+
+
57+
To disable automatic migration of the configuration for any of the previously noted OpenShift SDN features, specify the following keys:
58+
+
59+
[source,terminal]
60+
----
61+
$ oc patch Network.operator.openshift.io cluster --type='merge' \
62+
--patch '{
63+
"spec": {
64+
"migration": {
65+
"networkType": "OVNKubernetes",
66+
"features": {
67+
"egressIP": <bool>,
68+
"egressFirewall": <bool>,
69+
"multicast": <bool>
70+
}
71+
}
72+
}
73+
}'
74+
----
75+
+
76+
where:
77+
+
78+
--
79+
`bool`: Specifies whether to enable migration of the feature. The default is `true`.
80+
--
81+
4982
. Optional: You can customize the following settings for OVN-Kubernetes to meet your network infrastructure requirements:
5083
+
5184
--
5285
* Maximum transmission unit (MTU)
5386
* Geneve (Generic Network Virtualization Encapsulation) overlay network port
87+
* OVN-Kubernetes IPv4 internal subnet
88+
* OVN-Kubernetes IPv6 internal subnet
5489
--
5590
+
5691
To customize either of the previously noted settings, enter and customize the following command. If you do not need to change the default value, omit the key from the patch.
@@ -63,15 +98,23 @@ $ oc patch Network.operator.openshift.io cluster --type=merge \
6398
"defaultNetwork":{
6499
"ovnKubernetesConfig":{
65100
"mtu":<mtu>,
66-
"genevePort":<port>
101+
"genevePort":<port>,
102+
"v4InternalSubnet":"<ipv4_subnet>",
103+
"v6InternalSubnet":"<ipv6_subnet>"
67104
}}}}'
68105
----
69106
+
107+
where:
108+
+
70109
--
71110
`mtu`::
72111
The MTU for the Geneve overlay network. This value is normally configured automatically, but if the nodes in your cluster do not all use the same MTU, then you must set this explicitly to `100` less than the smallest node MTU value.
73112
`port`::
74113
The UDP port for the Geneve overlay network. If a value is not specified, the default is `6081`. The port cannot be the same as the VXLAN port that is used by OpenShift SDN. The default value for the VXLAN port is `4789`.
114+
`ipv4_subnet`::
115+
An IPv4 address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster. The default value is `100.64.0.0/16`.
116+
`ipv6_subnet`::
117+
An IPv6 address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster. The default value is `fd98::/48`.
75118
--
76119
+
77120
.Example patch command to update `mtu` field

‎modules/nw-ovn-kubernetes-rollback.adoc

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,39 @@ $ oc patch Network.config.openshift.io cluster --type='merge' \
5151
--patch '{ "spec": { "networkType": "OpenShiftSDN" } }'
5252
----
5353

54+
. Optional: You can disable automatic migration of several OVN-Kubernetes capabilities to the OpenShift SDN equivalents:
55+
+
56+
--
57+
* Egress IPs
58+
* Egress firewall
59+
* Multicast
60+
--
61+
+
62+
To disable automatic migration of the configuration for any of the previously noted OpenShift SDN features, specify the following keys:
63+
+
64+
[source,terminal]
65+
----
66+
$ oc patch Network.operator.openshift.io cluster --type='merge' \
67+
--patch '{
68+
"spec": {
69+
"migration": {
70+
"networkType": "OpenShiftSDN",
71+
"features": {
72+
"egressIP": <bool>,
73+
"egressFirewall": <bool>,
74+
"multicast": <bool>
75+
}
76+
}
77+
}
78+
}'
79+
----
80+
+
81+
where:
82+
+
83+
--
84+
`bool`: Specifies whether to enable migration of the feature. The default is `true`.
85+
--
86+
5487
. Optional: You can customize the following settings for OpenShift SDN to meet your network infrastructure requirements:
5588
+
5689
--

0 commit comments

Comments
 (0)