Skip to content

Commit 7f39585

Browse files
mikemckiernanmikemckiernan
authored
Merge pull request #31896 from mikemckiernan/feat-egress-router-cr
OSDOCS-1855: OVN Egress Router
2 parents 2bf361c + a53eb5d commit 7f39585

7 files changed

+238
-144
lines changed

‎modules/nw-egress-router-about.adoc

Lines changed: 34 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ endif::[]
2121
[id="nw-egress-router-about_{context}"]
2222
= About an egress router pod
2323

24-
The {product-title} egress router pod redirects traffic to a specified remote server from a private source IP address that is not used for any other purpose. An egress router pod enables you to send network traffic to servers that are set up to allow access only from specific IP addresses.
24+
The {product-title} egress router pod redirects traffic to a specified remote server from a private source IP address that is not used for any other purpose. An egress router pod can send network traffic to servers that are set up to allow access only from specific IP addresses.
2525

2626
[NOTE]
2727
====
@@ -49,7 +49,7 @@ endif::openshift-sdn[]
4949
ifdef::ovn[]
5050
[NOTE]
5151
====
52-
The egress router CNI plug-in supports redirect mode only. This is a difference with the egress router implementation that you can deploy with OpenShift SDN. Unlike the egress router for OpenShift SDN, the egress router CNI plug-in does not support _HTTP proxy mode_ or _DNS proxy mode_.
52+
The egress router CNI plug-in supports redirect mode only. This is a difference with the egress router implementation that you can deploy with OpenShift SDN. Unlike the egress router for OpenShift SDN, the egress router CNI plug-in does not support HTTP proxy mode or DNS proxy mode.
5353
====
5454
endif::ovn[]
5555

@@ -73,6 +73,14 @@ An egress router is a pod that has two network interfaces. For example, the pod
7373

7474
Traffic that leaves the egress router exits through a node, but the packets
7575
have the MAC address of the `net1` interface from the egress router pod.
76+
77+
When you add an egress router custom resource, the Cluster Network Operator creates the following objects:
78+
79+
* The network attachment definition for the `net1` secondary network interface of the pod.
80+
81+
* A deployment for the egress router.
82+
83+
If you delete an egress router custom resource, the Operator deletes the two objects in the preceding list that are associated with the egress router.
7684
endif::ovn[]
7785

7886
[id="nw-egress-router-about-deployments_{context}"]
@@ -107,9 +115,9 @@ Specifically, ensure that the following are enabled:
107115
[id="nw-egress-router-about-failover_{context}"]
108116
== Failover configuration
109117

118+
ifdef::openshift-sdn[]
110119
To avoid downtime, you can deploy an egress router pod with a `Deployment` resource, as in the following example. To create a new `Service` object for the example deployment, use the `oc expose deployment/egress-demo-controller` command.
111120

112-
ifdef::openshift-sdn[]
113121
[source,yaml,subs="attributes+"]
114122
----
115123
apiVersion: apps/v1
@@ -134,36 +142,38 @@ spec:
134142
containers:
135143
...
136144
----
145+
<1> Ensure that replicas is set to `1`, because only one pod can use a given egress source IP address at any time. This means that only a single copy of the router runs on a node.
146+
147+
<2> Specify the `Pod` object template for the egress router pod.
137148
endif::openshift-sdn[]
138149

139150
ifdef::ovn[]
151+
To avoid downtime, the Cluster Network Operator deploys the egress router pod as a deployment resource. The deployment name is `egress-router-cni-deployment`. The pod that corresponds to the deployment has a label of `app=egress-router-cni`.
152+
153+
To create a new service for the deployment, use the `oc expose deployment/egress-router-cni-deployment --port <port_number>` command or create a file like the following example:
154+
140155
[source,yaml,subs="attributes+"]
141156
----
142-
apiVersion: apps/v1
143-
kind: Deployment
157+
apiVersion: v1
158+
kind: Service
144159
metadata:
145-
name: egress-demo-controller
160+
name: app-egress
146161
spec:
147-
replicas: 1 <1>
162+
ports:
163+
- name: tcp-8080
164+
protocol: TCP
165+
port: 8080
166+
- name: tcp-8443
167+
protocol: TCP
168+
port: 8443
169+
- name: udp-80
170+
protocol: UDP
171+
port: 80
172+
type: ClusterIP
148173
selector:
149-
matchLabels:
150-
name: egress-router
151-
template:
152-
metadata:
153-
name: egress-router
154-
labels:
155-
name: egress-router
156-
annotations:
157-
k8s.v1.cni.cncf.io/networks: egress-router-redirect
158-
spec: <2>
159-
containers:
160-
- name: egress-router-redirect
161-
image: {egress-pod-image-name}
174+
app: egress-router-cni
162175
----
163176
endif::ovn[]
164-
<1> Ensure that replicas is set to `1`, because only one pod can use a given egress source IP address at any time. This means that only a single copy of the router runs on a node.
165-
166-
<2> Specify the `Pod` object template for the egress router pod.
167177

168178
// Clear temporary attributes
169179
ifdef::openshift-sdn[]
@@ -173,4 +183,4 @@ endif::[]
173183
ifdef::ovn[]
174184
:!ovn:
175185
:!egress-pod-image-name:
176-
endif::[]
186+
endif::[]

‎modules/nw-egress-router-cr.adoc

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/deploying-egress-router-ovn-redirection.adoc
4+
5+
ifeval::["{context}" == "deploying-egress-router-ovn-redirection"]
6+
:redirect:
7+
:router-type: redirect
8+
endif::[]
9+
:router-name: egress-router-{router-type}
10+
11+
[id="nw-egress-router-ovn-cr_{context}"]
12+
= Egress router custom resource
13+
14+
Define the configuration for an egress router pod in an egress router custom resource. The following YAML describes the fields for the configuration of an egress router in {router-type} mode:
15+
16+
// cluster-network-operator/manifests/0000_70_cluster-network-operator_01_egr_crd.yaml
17+
[source,yaml,subs="attributes+"]
18+
----
19+
apiVersion: network.operator.openshift.io/v1
20+
kind: EgressRouter
21+
metadata:
22+
name: <egress_router_name>
23+
namespace: <namespace> <.>
24+
spec:
25+
addresses: [ <.>
26+
{
27+
ip: "<egress_router>", <.>
28+
gateway: "<egress_gateway>" <.>
29+
}
30+
]
31+
mode: Redirect
32+
redirect: {
33+
redirectRules: [ <.>
34+
{
35+
destinationIP: "<egress_destination>",
36+
port: <egress_router_port>,
37+
targetPort: <target_port>, <.>
38+
protocol: <network_protocol> <.>
39+
},
40+
...
41+
],
42+
fallbackIP: "<egress_destination>" <.>
43+
}
44+
----
45+
// openshift/api:networkoperator/v1/001-egressrouter.crd.yaml
46+
<.> Optional: The `namespace` field specifies the namespace to create the egress router in. If you do not specify a value in the file or on the command line, the `default` namespace is used.
47+
48+
<.> The `addresses` field specifies the IP addresses to configure on the secondary network interface.
49+
50+
<.> The `ip` field specifies the reserved source IP address and netmask from the physical network that the node is on to use with egress router pod. Use CIDR notation to specify the IP address and netmask.
51+
52+
<.> The `gateway` field specifies the IP address of the network gateway.
53+
54+
<.> Optional: The `redirectRules` field specifies a combination of egress destination IP address, egress router port, and protocol. Incoming connections to the egress router on the specified port and protocol are routed to the destination IP address.
55+
56+
<.> Optional: The `targetPort` field specifies the network port on the destination IP address. If this field is not specified, traffic is routed to the same network port that it arrived on.
57+
58+
<.> The `protocol` field supports TCP, UDP, or SCTP.
59+
60+
<.> Optional: The `fallbackIP` field specifies a destination IP address. If you do not specify any redirect rules, the egress router sends all traffic to this fallback IP address. If you specify redirect rules, any connections to network ports that are not defined in the rules are sent by the egress router to this fallback IP address. If you do not specify this field, the egress router rejects connections to network ports that are not defined in the rules.
61+
62+
.Example egress router specification
63+
[source,yaml,subs="attributes+"]
64+
----
65+
apiVersion: network.operator.openshift.io/v1
66+
kind: EgressRouter
67+
metadata:
68+
name: {router-name}
69+
spec:
70+
networkInterface: {
71+
macvlan: {
72+
mode: "bridge"
73+
}
74+
}
75+
addresses: [
76+
{
77+
ip: "192.168.12.99/24",
78+
gateway: "192.168.12.1"
79+
}
80+
]
81+
mode: Redirect
82+
redirect: {
83+
redirectRules: [
84+
{
85+
destinationIP: "10.0.0.99",
86+
port: 80,
87+
protocol: UDP
88+
},
89+
{
90+
destinationIP: "203.0.113.26",
91+
port: 8080,
92+
targetPort: 80,
93+
protocol: TCP
94+
},
95+
{
96+
destinationIP: "203.0.113.27",
97+
port: 8443,
98+
targetPort: 443,
99+
protocol: TCP
100+
}
101+
]
102+
}
103+
----
104+
105+
// clear temporary attributes
106+
:!router-name:
107+
:!router-type:
108+
ifdef::redirect[]
109+
:!redirect:
110+
endif::[]

‎modules/nw-egress-router-network-attachment.adoc

Lines changed: 0 additions & 50 deletions
This file was deleted.

0 commit comments

Comments
 (0)