You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
OVN-Kubernetes is the default networking solution for {microshift-short} deployments. OVN-Kubernetes is a virtualized network for pods and services that is based on Open Virtual Network (OVN). The OVN-Kubernetes Container Network Interface (CNI) plugin is the network plugin for the cluster. A cluster that uses the OVN-Kubernetes network plugin also runs Open vSwitch (OVS) on the node. OVN configures OVS on the node to implement the declared network configuration.
10
-
11
-
[id="microshift-network-topology_{context}"]
12
-
== Network topology
13
-
OVN-Kubernetes provides an overlay-based networking implementation. This overlay includes an OVS-based implementation of Service and NetworkPolicy. The overlay network uses the Geneve (Generic Network Virtualization Encapsulation) tunnel protocol. The pod maximum transmission unit (MTU) for the Geneve tunnel is set to a smaller value than the MTU of the physical interface on the host. This smaller MTU makes room for the required information that is added to the tunnel header before it is transmitted.
14
-
15
-
OVS runs as a systemd service on the {microshift-short} node. The OVS RPM package is installed as a dependency to the `microshift-networking` RPM package. OVS is started immediately when the `microshift-networking` RPM is installed.
16
-
17
-
.{product-title} network topology
18
-
image:317_RHbM_OVN_topology_0923.png[title="{microshift-short} uses an overlay-based networking implementation, details follow."]
=== Description of the connections in the network topology figure
41
-
* The north-south traffic between the network service and the OVN external switch `ext_microshift-dev`, is provided through the host kernel by the gateway bridge `br-ex`.
42
-
* The OVN gateway router `GR_microshift-dev` is connected to the external network switch `ext_microshift-dev` through the logical router port 4. Port 4 is attached with the node IP address 192.168.122.14.
43
-
* The join switch `join` connects the OVN gateway router `GR_microshift-dev` to the OVN cluster router `ovn_cluster_router`. The IP address range is 100.62.0.0/16.
44
-
** The OVN gateway router `GR_microshift-dev` connects to the OVN join switch `join` through the logical router port 3. Port 3 attaches with the internal IP address 100.64.0.2.
45
-
** The OVN cluster router `ovn_cluster_router` connects to the join switch `join` through the logical router port 2. Port 2 attaches with the internal IP address 100.64.0.1.
46
-
* The OVN cluster router `ovn_cluster_router` connects to the node switch `microshift-dev` through the logical router port 1. Port 1 is attached with the OVN cluster network IP address 10.42.0.1.
47
-
* The east-west traffic between the pods and the network service is provided by the OVN cluster router `ovn_cluster_router` and the node switch `microshift-dev`. The IP address range is 10.42.0.0/24.
48
-
* The east-west traffic between pods is provided by the node switch `microshift-dev` without network address translation (NAT).
49
-
* The north-south traffic between the pods and the external network is provided by the OVN cluster router `ovn_cluster_router` and the host network. This router is connected through the `ovn-kubernetes` management port `ovn-k8s-mp0`, with the IP address 10.42.0.2.
50
-
* All the pods are connected to the OVN node switch through their interfaces.
51
-
** In this example, Pod 1 and Pod 2 are connected to the node switch through `Interface 1` and `Interface 2`.
9
+
The OVN-Kubernetes Container Network Interface (CNI) plugin is the default networking solution for {microshift-short} clusters. OVN-Kubernetes is a virtualized network for pods and services that is based on Open Virtual Network (OVN).
52
10
53
-
[id="microshift-ip-forward_{context}"]
54
-
== IP forward
55
-
The host network `sysctl net.ipv4.ip_forward` kernel parameter is automatically enabled by the `ovnkube-master` container when started. This is required to forward incoming traffic to the CNI. For example, accessing the NodePort service from outside of a cluster fails if `ip_forward` is disabled.
11
+
* Default network configuration and connections are applied automatically in {microshift-short} with the `microshift-networking` RPM during installation.
12
+
* A cluster that uses the OVN-Kubernetes network plugin also runs Open vSwitch (OVS) on the node.
13
+
* OVN-K configures OVS on the node to implement the declared network configuration.
14
+
* Host physical interfaces are not bound by default to the OVN-K gateway bridge, `br-ex`. You can use standard tools on the host for managing the default gateway, such as the Network Manager CLI (`nmcli`).
15
+
* Changing the CNI is not supported on {microshift-short}.
56
16
57
-
[id="microshift-network-performance_{context}"]
58
-
== Network performance optimizations
59
-
By default, three performance optimizations are applied to OVS services to minimize resource consumption:
17
+
Using configuration files or custom scripts, you can configure the following networking settings:
60
18
61
-
* CPU affinity to `ovs-vswitchd.service` and `ovsdb-server.service`
62
-
* `no-mlockall` to `openvswitch.service`
63
-
* Limit handler and `revalidator` threads to `ovs-vswitchd.service`
19
+
* You can use subnet CIDR ranges to allocate IP addresses to pods.
20
+
* You can change the maximum transmission unit (MTU) value.
21
+
* You can configure firewall ingress and egress.
22
+
* You can define network policies in the {microshift-short} cluster, including ingress and egress rules.
Networking features available with {product-title} {product-version} include:
30
+
Networking features available with {microshift-short} {product-version} include:
68
31
69
32
* Kubernetes network policy
70
33
* Dynamic node IP
34
+
* Custom gateway interface
35
+
* Second gateway interface
71
36
* Cluster network on specified host interface
37
+
* Blocking external access to NodePort service on specific host interfaces
72
38
73
-
Networking features not available with {product-title} {product-version}:
39
+
Networking features not available with {microshift-short} {product-version}:
74
40
75
-
* Egress IP/firewall/qos: disabled
41
+
* Egress IP/firewall/QoS: disabled
76
42
* Hybrid networking: not supported
77
43
* IPsec: not supported
78
44
* Hardware offload: not supported
79
45
80
-
//Q: are there immutable network settings we should tell users about?
81
-
[id="microshift-network-comps-svcs_{context}"]
82
-
== {microshift-short} networking components and services
83
-
This brief overview describes networking components and their operation in {microshift-short}. The `microshift-networking` RPM is a package that automatically pulls in any networking-related dependencies and systemd services to initialize networking, for example, the `microshift-ovs-init` systemd service.
NetworkManager is required to set up the initial gateway bridge on the {microshift-short} node. The NetworkManager and `NetworkManager-ovs` RPM packages are installed as dependencies to the `microshift-networking` RPM package, which contains the necessary configuration files. NetworkManager in {microshift-short} uses the `keyfile` plugin and is restarted after installation of the `microshift-networking` RPM package.
50
+
* xref:../microshift_configuring/microshift-using-config-tools.adoc#microshift-using-config-tools_microshift-config-yaml[Using a YAML configuration file]
87
51
88
-
microshift-ovs-init::
89
-
The `microshift-ovs-init.service` is installed by the `microshift-networking` RPM package as a dependent systemd service to microshift.service. It is responsible for setting up the OVS gateway bridge.
Two OVN-Kubernetes daemon sets are rendered and applied by {microshift-short}.
93
-
94
-
* *ovnkube-master*
95
-
Includes the `northd`, `nbdb`, `sbdb` and `ovnkube-master` containers.
54
+
[id="microshift-ip-forward_{context}"]
55
+
== IP forward
56
+
The host network `sysctl net.ipv4.ip_forward` kernel parameter is automatically enabled by the `ovnkube-master` container when started. This is required to forward incoming traffic to the CNI. For example, accessing the NodePort service from outside of a cluster fails if `ip_forward` is disabled.
96
57
97
-
* *ovnkube-node*
98
-
The ovnkube-node includes the OVN-Controller container.
99
-
+
100
-
After {microshift-short} boots, the OVN-Kubernetes daemon sets are deployed in the `openshift-ovn-kubernetes` namespace.
58
+
[id="microshift-network-performance_{context}"]
59
+
== Network performance optimizations
60
+
By default, three performance optimizations are applied to OVS services to minimize resource consumption:
101
61
102
-
Packaging::
103
-
OVN-Kubernetes manifests and startup logic are built into {microshift-short}. The systemd services and configurations included in `microshift-networking` RPM are:
62
+
* CPU affinity to `ovs-vswitchd.service` and `ovsdb-server.service`
63
+
* `no-mlockall` to `openvswitch.service`
64
+
* Limit handler and `revalidator` threads to `ovs-vswitchd.service`
104
65
105
-
* `/etc/NetworkManager/conf.d/microshift-nm.conf` for NetworkManager.service
106
-
* `/etc/systemd/system/ovs-vswitchd.service.d/microshift-cpuaffinity.conf` for ovs-vswitchd.service
Bridge mappings allow provider network traffic to reach the physical network. Traffic leaves the provider network and arrives at the `br-int` bridge. A patch port between `br-int` and `br-ex` then allows the traffic to traverse to and from the provider network and the edge network. Kubernetes pods are connected to the `br-int` bridge through virtual ethernet pair: one end of the virtual ethernet pair is attached to the pod namespace, and the other end is attached to the `br-int` bridge.
The following table summarizes the status of networking features and capabilities that are either present as defaults, supported for configuration, or not available with the {microshift-short} service:
7
+
8
+
.{microshift-short} networking capabilities and customization status
|IPsec encryption for intra-cluster communication|Not available|N/A
40
+
41
+
|IPv6|Not available ^[5]^|N/A
42
+
|===
43
+
44
+
1. If unset, the default value is set to the next immediate subnet after the service network. For example, when the service network is `10.43.0.0/16`, the `advertiseAddress` is set to `10.44.0.0/32`.
45
+
2. You can use the multicast DNS protocol (mDNS) to allow name resolution and service discovery within a Local Area Network (LAN) using multicast exposed on the `5353/UDP` port.
46
+
3. There is no built-in transparent proxying of egress traffic in {microshift-short}. Egress must be manually configured.
47
+
4. Setting up the firewalld service is supported by {op-system-ostree}.
Copy file name to clipboardExpand all lines: modules/microshift-config-yaml.adoc
+2-54Lines changed: 2 additions & 54 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,65 +6,13 @@
6
6
[id="microshift-config-yaml_{context}"]
7
7
= Using a YAML configuration file
8
8
9
-
On start up, {microshift-short} searches the system-wide `/etc/microshift/` directory for a configuration file named `config.yaml`. To use custom configurations, you must create the configuration file and specify any settings that should override the defaults before starting {microshift-short}.
10
-
11
-
[id="microshift-yaml-default_{context}"]
12
-
== Default settings
13
-
If you do not create a `config.yaml` file, the default values are used. The following example shows the default configuration settings.
14
-
15
-
* You can use the following command to see the default values:
16
-
+
17
-
[source,terminal]
18
-
----
19
-
$ microshift show-config
20
-
----
21
-
+
22
-
.Default values example output in YAML form
23
-
[source,yaml]
24
-
----
25
-
dns:
26
-
baseDomain: microshift.example.com <1>
27
-
network:
28
-
clusterNetwork:
29
-
- 10.42.0.0/16 <2>
30
-
serviceNetwork:
31
-
- 10.43.0.0/16 <3>
32
-
serviceNodePortRange: 30000-32767 <4>
33
-
node:
34
-
hostnameOverride: "" <5>
35
-
nodeIP: "" <6>
36
-
apiServer:
37
-
advertiseAddress: 10.44.0.0 <7>
38
-
subjectAltNames: [] <8>
39
-
debugging:
40
-
logLevel: "Normal" <9>
41
-
----
42
-
<1> Base domain of the cluster. All managed DNS records will be subdomains of this base.
43
-
<2> A block of IP addresses from which Pod IP addresses are allocated.
44
-
<3> A block of virtual IP addresses for Kubernetes services.
45
-
<4> The port range allowed for Kubernetes services of type NodePort.
46
-
<5> The name of the node. The default value is the hostname.
47
-
<6> The IP address of the node. The default value is the IP address of the default route.
48
-
<7> A string that specifies the IP address from which the API server is advertised to members of the cluster. The default value is calculated based on the address of the service network.
49
-
<8> Subject Alternative Names for API server certificates.
50
-
<9> Log verbosity. Valid values for this field are `Normal`, `Debug`, `Trace`, or `TraceAll`.
9
+
On start up, {microshift-short} searches the system-wide `/etc/microshift/` directory for a configuration file named `config.yaml`. To use custom configurations, you must create the configuration file and specify any settings that are expected to override the defaults before starting {microshift-short}.
51
10
52
11
[id="microshift-yaml-custom_{context}"]
53
12
== Custom settings
54
-
To create custom configurations, you must create a `config.yaml` file in the `/etc/microshift/` directory, then change any settings that should override the defaults before starting or restarting {microshift-short}.
13
+
To create custom configurations, you must create a `config.yaml` file in the `/etc/microshift/` directory, and then change any settings that are expected to override the defaults before starting or restarting {microshift-short}.
55
14
56
15
[IMPORTANT]
57
16
====
58
17
Restart {microshift-short} after changing any configuration settings to have them take effect. The `config.yaml` file is read only when {microshift-short} starts.
59
18
====
60
-
61
-
[id="microshift-yaml-advertiseAddress_{context}"]
62
-
=== advertiseAddress
63
-
The `apiserver.advertiseAddress` flag specifies the IP address on which to advertise the API server to members of the cluster. This address must be reachable by the cluster. You can set a custom IP address here, but you must also add the IP address to a host interface. Customizing this parameter preempts {microshift-short} from adding a default IP address to the `br-ex` network interface.
64
-
65
-
[IMPORTANT]
66
-
====
67
-
If you customize the `advertiseAddress` IP address, make sure it is reachable by the cluster when {microshift-short} starts by adding the IP address to a host interface.
68
-
====
69
-
70
-
If unset, the default value is `10.44.0.0/32`. It will be set to the next immediate subnet after the service network. For example, when the service network is `10.43.0.0/16`, the `advertiseAddress` is set to `10.44.0.0/32`.
If you do not create a `config.yaml` file, default values are used. The following example shows the default configuration settings.
11
+
12
+
* To see the default values, run the following command:
13
+
+
14
+
[source,terminal]
15
+
----
16
+
$ microshift show-config
17
+
----
18
+
+
19
+
.Default values example output in YAML form
20
+
[source,yaml]
21
+
----
22
+
dns:
23
+
baseDomain: microshift.example.com <1>
24
+
network:
25
+
clusterNetwork:
26
+
- 10.42.0.0/16 <2>
27
+
serviceNetwork:
28
+
- 10.43.0.0/16 <3>
29
+
serviceNodePortRange: 30000-32767 <4>
30
+
node:
31
+
hostnameOverride: "" <5>
32
+
nodeIP: "" <6>
33
+
apiServer:
34
+
advertiseAddress: 10.44.0.0/32 <7>
35
+
subjectAltNames: [] <8>
36
+
debugging:
37
+
logLevel: "Normal" <9>
38
+
----
39
+
<1> Base domain of the cluster. All managed DNS records will be subdomains of this base.
40
+
<2> A block of IP addresses from which Pod IP addresses are allocated.
41
+
<3> A block of virtual IP addresses for Kubernetes services.
42
+
<4> The port range allowed for Kubernetes services of type NodePort.
43
+
<5> The name of the node. The default value is the hostname.
44
+
<6> The IP address of the node. The default value is the IP address of the default route.
45
+
<7> A string that specifies the IP address from which the API server is advertised to members of the cluster. The default value is calculated based on the address of the service network.
46
+
<8> Subject Alternative Names for API server certificates.
47
+
<9> Log verbosity. Valid values for this field are `Normal`, `Debug`, `Trace`, or `TraceAll`.
The `apiserver.advertiseAddress` flag specifies the IP address on which to advertise the API server to members of the cluster. This address must be reachable by the cluster. You can set a custom IP address here, but you must also add the IP address to a host interface. Customizing this parameter preempts {microshift-short} from adding a default IP address to the `br-ex` network interface.
10
+
11
+
[IMPORTANT]
12
+
====
13
+
If you customize the `advertiseAddress` IP address, make sure it is reachable by the cluster when {microshift-short} starts by adding the IP address to a host interface.
14
+
====
15
+
16
+
If unset, the default value is set to the next immediate subnet after the service network. For example, when the service network is `10.43.0.0/16`, the `advertiseAddress` is set to `10.44.0.0/32`.
0 commit comments