Skip to content

Commit 61e496b

Browse files
bburt-rhbburt-rh
authored
Merge pull request #68346 from kquinn1204/TELCODOCS-1511
Telcodocs 1511 Enabling ALLMULTI flag
2 parents ae39354 + ce719b3 commit 61e496b

10 files changed

+476
-38
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1252,8 +1252,8 @@ Topics:
12521252
File: configuring-cluster-network-range
12531253
- Name: Configuring IP failover
12541254
File: configuring-ipfailover
1255-
- Name: Configuring interface-level network sysctls
1256-
File: setting-interface-level-network-sysctls
1255+
- Name: Configuring system controls and interface attributes using the tuning plugin
1256+
File: configure-syscontrols-interface-tuning-cni
12571257
- Name: Using SCTP
12581258
File: using-sctp
12591259
Distros: openshift-enterprise,openshift-origin
@@ -1366,7 +1366,7 @@ Topics:
13661366
File: configuring-sriov-ib-attach
13671367
- Name: Adding a pod to an SR-IOV network
13681368
File: add-pod
1369-
- Name: Tuning sysctl settings on an SR-IOV network
1369+
- Name: Configuring interface-level network sysctl settings and all-multicast mode for SR-IOV networks
13701370
File: configuring-interface-sysctl-sriov-device
13711371
- Name: Using high performance multicast
13721372
File: using-sriov-multicast

‎modules/nw-cfg-config-all-multi-cni.adoc

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/setting-interface-level-network-sysctls.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="nw-enabling-all-multi-cni_{context}"]
6+
= Enabling all-multicast mode by using the tuning CNI
7+
8+
You can enable all-multicast mode by using the tuning Container Network Interface (CNI) meta plugin.
9+
10+
The following procedure describes how to configure the tuning CNI to enable the all-multicast mode.
11+
12+
.Procedure
13+
14+
. Create a network attachment definition, such as `tuning-example.yaml`, with the following content:
15+
+
16+
[source,yaml]
17+
----
18+
apiVersion: "k8s.cni.cncf.io/v1"
19+
kind: NetworkAttachmentDefinition
20+
metadata:
21+
name: <name> <1>
22+
namespace: default <2>
23+
spec:
24+
config: '{
25+
"cniVersion": "0.4.0", <3>
26+
"name": "<name>", <4>
27+
"plugins": [{
28+
"type": "<main_CNI_plugin>" <5>
29+
},
30+
{
31+
"type": "tuning", <6>
32+
"allmulti": true <7>
33+
}
34+
}
35+
]
36+
}
37+
----
38+
<1> Specifies the name for the additional network attachment to create. The name must be unique within the specified namespace.
39+
<2> Specifies the namespace that the object is associated with.
40+
<3> Specifies the CNI specification version.
41+
<4> Specifies the name for the configuration. Match the configuration name to the name value of the network attachment definition.
42+
<5> Specifies the name of the main CNI plugin to configure.
43+
<6> Specifies the name of the CNI meta plugin.
44+
<7> Changes the all-multicast mode of interface. If enabled, all multicast packets on the network will be received by the interface.
45+
+
46+
An example YAML file is shown here:
47+
+
48+
[source,yaml]
49+
----
50+
apiVersion: "k8s.cni.cncf.io/v1"
51+
kind: NetworkAttachmentDefinition
52+
metadata:
53+
name: setallmulti
54+
namespace: default
55+
spec:
56+
config: '{
57+
"cniVersion": "0.4.0",
58+
"name": "setallmulti",
59+
"plugins": [
60+
{
61+
"type": "bridge"
62+
},
63+
{
64+
"type": "tuning",
65+
"allmulti": true
66+
}
67+
]
68+
}'
69+
----
70+
71+
. Apply the settings specified in the YAML file by running the following command:
72+
+
73+
[source,terminal]
74+
----
75+
$ oc apply -f tuning-allmulti.yaml
76+
----
77+
+
78+
.Example output
79+
[source,terminal]
80+
----
81+
networkattachmentdefinition.k8s.cni.cncf.io/setallmulti created
82+
----
83+
84+
. Create a pod with a network attachment definition similar to that specified in the following `examplepod.yaml` sample file:
85+
+
86+
[source,yaml]
87+
----
88+
apiVersion: v1
89+
kind: Pod
90+
metadata:
91+
name: allmultipod
92+
namespace: default
93+
annotations:
94+
k8s.v1.cni.cncf.io/networks: setallmulti <1>
95+
spec:
96+
containers:
97+
- name: podexample
98+
image: centos
99+
command: ["/bin/bash", "-c", "sleep INF"]
100+
securityContext:
101+
runAsUser: 2000 <2>
102+
runAsGroup: 3000 <3>
103+
allowPrivilegeEscalation: false <4>
104+
capabilities: <5>
105+
drop: ["ALL"]
106+
securityContext:
107+
runAsNonRoot: true <6>
108+
seccompProfile: <7>
109+
type: RuntimeDefault
110+
----
111+
<1> Specifies the name of the configured `NetworkAttachmentDefinition`.
112+
<2> Specifies the user ID the container is run with.
113+
<3> Specifies which primary group ID the containers is run with.
114+
<4> Specifies if a pod can request privilege escalation. If unspecified, it defaults to `true`. This boolean directly controls whether the `no_new_privs` flag gets set on the container process.
115+
<5> Specifies the container capabilities. The `drop: ["ALL"]` statement indicates that all Linux capabilities are dropped from the pod, providing a more restrictive security profile.
116+
<6> Specifies that the container will run with a user with any UID other than 0.
117+
<7> Specifies the container's seccomp profile. In this case, the type is set to `RuntimeDefault`. Seccomp is a Linux kernel feature that restricts the system calls available to a process, enhancing security by minimizing the attack surface.
118+
119+
. Apply the settings specified in the YAML file by running the following command:
120+
+
121+
[source,terminal]
122+
----
123+
$ oc apply -f examplepod.yaml
124+
----
125+
126+
. Verify that the pod is created by running the following command:
127+
+
128+
[source,terminal]
129+
----
130+
$ oc get pod
131+
----
132+
+
133+
.Example output
134+
[source,terminal]
135+
----
136+
NAME READY STATUS RESTARTS AGE
137+
allmultipod 1/1 Running 0 23s
138+
----
139+
140+
. Log in to the pod by running the following command:
141+
+
142+
[source,terminal]
143+
----
144+
$ oc rsh allmultipod
145+
----
146+
147+
. List all the interfaces associated with the pod by running the following command:
148+
+
149+
[source,terminal]
150+
----
151+
sh-4.4# ip link
152+
----
153+
+
154+
.Example output
155+
[source,terminal]
156+
----
157+
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
158+
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
159+
2: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 8901 qdisc noqueue state UP mode DEFAULT group default
160+
link/ether 0a:58:0a:83:00:10 brd ff:ff:ff:ff:ff:ff link-netnsid 0 <1>
161+
3: net1@if24: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
162+
link/ether ee:9b:66:a4:ec:1d brd ff:ff:ff:ff:ff:ff link-netnsid 0 <2>
163+
----
164+
<1> `eth0@if22` is the primary interface
165+
<2> `net1@if24` is the secondary interface configured with the network-attachment-definition that supports the all-multicast mode (ALLMULTI flag)

‎modules/nw-cfg-tuning-interface-cni.adoc

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
// * networking/setting-interface-level-network-sysctls.adoc
44
:_mod-docs-content-type: PROCEDURE
55
[id="nw-configuring-tuning-cni_{context}"]
6-
= Configuring the tuning CNI
6+
= Configuring system controls by using the tuning CNI
77

8-
The following procedure configures the tuning CNI to change the interface-level network `net.ipv4.conf.IFNAME.accept_redirects` sysctl. This example enables accepting and sending ICMP-redirected packets.
8+
The following procedure configures the tuning CNI to change the interface-level network `net.ipv4.conf.IFNAME.accept_redirects` sysctl. This example enables accepting and sending ICMP-redirected packets. In the tuning CNI meta plugin configuration, the interface name is represented by the `IFNAME` token and is replaced with the actual name of the interface at runtime.
99

1010
.Procedure
1111

@@ -40,9 +40,9 @@ spec:
4040
<4> Specifies the name for the configuration. It is recommended to match the configuration name to the name value of the network attachment definition.
4141
<5> Specifies the name of the main CNI plugin to configure.
4242
<6> Specifies the name of the CNI meta plugin.
43-
<7> Specifies the sysctl to set.
43+
<7> Specifies the sysctl to set. The interface name is represented by the `IFNAME` token and is replaced with the actual name of the interface at runtime.
4444
+
45-
An example yaml file is shown here:
45+
An example YAML file is shown here:
4646
+
4747
[source,yaml]
4848
----
@@ -68,7 +68,7 @@ spec:
6868
}'
6969
----
7070

71-
. Apply the yaml by running the following command:
71+
. Apply the YAML by running the following command:
7272
+
7373
[source,terminal]
7474
----

0 commit comments

Comments
 (0)