Skip to content

Commit 5cc3aea

Browse files
maxwelldbmaxwelldb
committed
OSDOCS-4100: IPv6 in secondary network interfaces (ShiftStack)
1 parent 90cda77 commit 5cc3aea

File tree

5 files changed

+173
-0
lines changed

5 files changed

+173
-0
lines changed

‎modules/installation-configuration-parameters.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -937,6 +937,8 @@ If you use a strict `anti-affinity` policy, an additional {rh-openstack} host is
937937

938938
|`controlPlane.platform.openstack.additionalNetworkIDs`
939939
|Additional networks that are associated with control plane machines. Allowed address pairs are not created for additional networks.
940+
941+
Additional networks that are attached to a control plane machine are also attached to the bootstrap node.
940942
|A list of one or more UUIDs as strings. For example, `fa806b2f-ac49-4bce-b9db-124bc64209bf`.
941943

942944
|`controlPlane.platform.openstack.additionalSecurityGroupIDs`

‎modules/nw-osp-pod-adding-connections-ipv6.adoc

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/network-configuration.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-osp-pod-adding-connections-ipv6_{context}"]
7+
= Adding IPv6 connectivity to pods on {rh-openstack}
8+
9+
After you enable IPv6 connectivity in pods, add connectivity to them by using a Container Network Interface (CNI) configuration.
10+
11+
.Procedure
12+
13+
. To edit the Cluster Network Operator (CNO), enter the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ oc edit networks.operator.openshift.io cluster
18+
----
19+
20+
. Specify your CNI configuration under the `spec` field. For example, the following configuration uses a SLAAC address mode with MACVLAN:
21+
+
22+
[source,yaml]
23+
----
24+
...
25+
spec:
26+
additionalNetworks:
27+
- name: ipv6
28+
namespace: ipv6 <1>
29+
rawCNIConfig: '{ "cniVersion": "0.3.1", "name": "ipv6", "type": "macvlan", "master": "ens4"}' <2>
30+
type: Raw
31+
----
32+
<1> Be sure to create pods in the same namespace.
33+
<2> The interface in the network attachment `"master"` field can differ from `"ens4"` when more networks are configured or when a different kernel driver is used.
34+
+
35+
[NOTE]
36+
====
37+
If you are using stateful address mode, include the IP Address Management (IPAM) in the CNI configuration.
38+
39+
DHCPv6 is not supported by Multus.
40+
====
41+
42+
. Save your changes and quit the text editor to commit your changes.
43+
44+
.Verification
45+
46+
* On a command line, enter the following command:
47+
+
48+
[source,terminal]
49+
----
50+
$ oc get network-attachment-definitions -A
51+
----
52+
+
53+
.Example output
54+
[source,terminal]
55+
----
56+
NAMESPACE NAME AGE
57+
ipv6 ipv6 21h
58+
----
59+
60+
You can now create pods that have secondary IPv6 connections.

‎modules/nw-osp-pod-connections-ipv6.adoc

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/network-configuration.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-osp-pod-connections-ipv6_{context}"]
7+
= Enabling IPv6 connectivity to pods on {rh-openstack}
8+
9+
To enable IPv6 connectivity between pods that have additional networks that are on different nodes, disable port security for the IPv6 port of the server. Disabling port security obviates the need to create allowed address pairs for each IPv6 address that is assigned to pods and enables traffic on the security group.
10+
11+
[IMPORTANT]
12+
====
13+
Only the following IPv6 additional network configurations are supported:
14+
15+
* SLAAC and host-device
16+
* SLAAC and MACVLAN
17+
* DHCP stateless and host-device
18+
* DHCP stateless and MACVLAN
19+
====
20+
21+
.Procedure
22+
23+
* On a command line, enter the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ openstack port set --no-security-group --disable-port-security <compute_ipv6_port>
28+
----
29+
+
30+
IMPORTANT: This command removes security groups from the port and disables port security. Traffic restrictions are removed entirely from the port.
31+
32+
where:
33+
34+
<compute_ipv6_port>:: Specifies the IPv6 port of the compute server.

‎modules/nw-osp-pod-creating-ipv6.adoc

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/network-configuration.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-osp-pod-creating-ipv6_{context}"]
7+
= Create pods that have IPv6 connectivity on {rh-openstack}
8+
9+
After you enable IPv6 connectivty for pods and add it to them, create pods that have secondary IPv6 connections.
10+
11+
.Procedure
12+
13+
. Define pods that use your IPv6 namespace and the annotation `k8s.v1.cni.cncf.io/networks: <additional_network_name>`, where `<additional_network_name` is the name of the additional network. For example, as part of a `Deployment` object:
14+
+
15+
[source,yaml]
16+
----
17+
apiVersion: apps/v1
18+
kind: Deployment
19+
metadata:
20+
name: hello-openshift
21+
namespace: ipv6
22+
spec:
23+
affinity:
24+
podAntiAffinity:
25+
requiredDuringSchedulingIgnoredDuringExecution:
26+
- labelSelector:
27+
matchExpressions:
28+
- key: app
29+
operator: In
30+
values:
31+
- hello-openshift
32+
replicas: 2
33+
selector:
34+
matchLabels:
35+
app: hello-openshift
36+
template:
37+
metadata:
38+
labels:
39+
app: hello-openshift
40+
annotations:
41+
k8s.v1.cni.cncf.io/networks: ipv6
42+
spec:
43+
securityContext:
44+
runAsNonRoot: true
45+
seccompProfile:
46+
type: RuntimeDefault
47+
containers:
48+
- name: hello-openshift
49+
securityContext:
50+
allowPrivilegeEscalation: false
51+
capabilities:
52+
drop:
53+
- ALL
54+
image: quay.io/openshift/origin-hello-openshift
55+
ports:
56+
- containerPort: 8080
57+
----
58+
59+
. Create the pod. For example, on a command line, enter the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc create -f <ipv6_enabled_resource>
64+
----
65+
66+
where:
67+
68+
<ipv6_enabled_resource>:: Specifies the file that contains your resource definition.

‎post_installation_configuration/network-configuration.adoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,12 @@ include::modules/installation-osp-kuryr-port-pools.adoc[leveloffset=+2]
124124
include::modules/installation-osp-kuryr-settings-active.adoc[leveloffset=+2]
125125
include::modules/nw-osp-enabling-ovs-offload.adoc[leveloffset=+2]
126126
include::modules/nw-osp-hardware-offload-attaching-network.adoc[leveloffset=+2]
127+
include::modules/nw-osp-pod-connections-ipv6.adoc[leveloffset=+2]
128+
include::modules/nw-osp-pod-adding-connections-ipv6.adoc[leveloffset=+2]
129+
130+
[role="_additional-resources"]
131+
.Additional resources
132+
133+
* xref:../networking/multiple_networks/configuring-additional-network.adoc#configuring-additional-network_configuration-additional-network-attachment[Configuration for an additional network attachment]
134+
135+
include::modules/nw-osp-pod-creating-ipv6.adoc[leveloffset=+2]

0 commit comments

Comments
 (0)