Skip to content

Commit beb203e

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #59954 from EricPonvelle/OSDOCS-3339_Network-Verification-Updates
OSDOCS-3339 - Adding network verfication content for OSD and ROSA
2 parents 878fdcf + 2b48eeb commit beb203e

13 files changed

+294
-6
lines changed

‎_topic_maps/_topic_map_osd.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,9 @@ Topics:
239239
Topics:
240240
- Name: Enabling multicast for a project
241241
File: enabling-multicast
242-
- Name: Configuring a cluster-wide proxy
242+
- Name: Network verification
243+
File: network-verification
244+
- Name: Configuring a cluster-wide proxy during installation
243245
File: configuring-cluster-wide-proxy
244246
- Name: CIDR range definitions
245247
File: cidr-range-definitions

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,9 @@ Topics:
334334
Topics:
335335
- Name: Enabling multicast for a project
336336
File: enabling-multicast
337-
- Name: Configuring a cluster-wide proxy
337+
- Name: Network verification
338+
File: network-verification
339+
- Name: Configuring a cluster-wide proxy during installation
338340
File: configuring-cluster-wide-proxy
339341
- Name: CIDR range definitions
340342
File: cidr-range-definitions

‎modules/automatic-network-verification-bypassing.adoc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network-verification.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="automatic-network-verification-bypassing_{context}"]
7+
= Automatic network verification bypassing
8+
9+
You can bypass the automatic network verification if you want to deploy
10+
ifdef::openshift-dedicated[]
11+
an {product-title}
12+
endif::openshift-dedicated[]
13+
ifdef::openshift-rosa[]
14+
a {product-title} (ROSA)
15+
endif::openshift-rosa[]
16+
cluster with known network configuration issues into an existing Virtual Private Cloud (VPC).
17+
18+
If you bypass the network verification when you create a cluster, the cluster has a limited support status. After installation, you can resolve the issues and then manually run the network verification. The limited support status is removed after the verification succeeds.
19+
20+
ifdef::openshift-rosa[]
21+
.Bypassing automatic network verification by using {cluster-manager}
22+
23+
endif::openshift-rosa[]
24+
When you install a cluster into an existing VPC by using {cluster-manager-first}, you can bypass the automatic verification by selecting *Bypass network verification* on the *Virtual Private Cloud (VPC) subnet settings* page.
25+
26+
ifdef::openshift-rosa[]
27+
.Bypassing automatic network verification by using the ROSA CLI
28+
29+
When you install a cluster into an existing VPC by using the `rosa create cluster` command, you can bypass the automatic verification by including the `--bypass-network-verify --force` arguments. The following example bypasses the network verification before creating a cluster:
30+
31+
[source,terminal]
32+
----
33+
$ rosa create cluster --cluster-name mycluster \
34+
--subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc \
35+
--bypass-network-verify --force
36+
----
37+
38+
[NOTE]
39+
====
40+
Alternatively, you can specify the `--interactive` argument and select the option in the interactive prompts to bypass the network verification checks.
41+
====
42+
endif::openshift-rosa[]

‎modules/rosa-sdpolicy-networking.adoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,10 @@ Red Hat site reliability engineers (SREs) do not monitor private network connect
7171
[id="rosa-sdpolicy-dns-forwarding_{context}"]
7272
== DNS forwarding
7373
For {product-title} clusters that have a private cloud network configuration, a customer can specify internal DNS servers available on that private connection, that should be queried for explicitly provided domains.
74+
75+
[id="rosa-sdpolicy-network-verification_{context}"]
76+
== Network verification
77+
78+
Network verification checks run automatically when you deploy a {product-title} cluster into an existing Virtual Private Cloud (VPC) or create an additional machine pool with a subnet that is new to your cluster. The checks validate your network configuration and highlight errors, enabling you to resolve configuration issues prior to deployment.
79+
80+
You can also run the network verification checks manually to validate the configuration for an existing cluster.

‎modules/running-network-verification-manually-cli.adoc

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network-verification.adoc
4+
5+
:_content-type: PROCEDURE
6+
[discrete]
7+
[id="running-network-verification-manually-cli_{context}"]
8+
= Running the network verification manually using the CLI
9+
10+
You can manually run the network verification checks for an existing {product-title} (ROSA) cluster by using the ROSA CLI (`rosa`).
11+
12+
When you run the network verification, you can specify a set of VPC subnet IDs or a cluster name. If you are using a proxy service, you can specify a proxy URL.
13+
14+
.Prerequisites
15+
16+
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.
17+
* You have an existing ROSA cluster.
18+
* You are the cluster owner or you have the cluster editor role.
19+
20+
.Procedure
21+
22+
* Verify the network configuration by using one of the following methods:
23+
** Verify the network configuration by specifying the cluster name. The subnet IDs are automatically detected:
24+
+
25+
[source,terminal]
26+
----
27+
$ rosa verify network -c <cluster_name> <1>
28+
----
29+
<1> Replace `<cluster_name>` with the name of your cluster.
30+
+
31+
.Example output
32+
[source,terminal]
33+
----
34+
I: ✓ Network verification successful
35+
----
36+
+
37+
[TIP]
38+
====
39+
To output the full list of verification tests, you can include the `--debug` argument when you run `rosa verify network`.
40+
====
41+
+
42+
** Verify the network configuration by specifying the VPC subnets IDs:
43+
+
44+
[source,terminal]
45+
----
46+
$ rosa verify network --subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc
47+
----
48+
+
49+
.Example output
50+
[source,terminal]
51+
----
52+
E: Validating Subnet subnet-03146b9b52b6024cb egress
53+
E: X Egress failed to https://events.pagerduty.com
54+
----
55+
+
56+
** Verify the network configuration by specifying the VPC subnets IDs and a proxy URL:
57+
+
58+
[source,terminal]
59+
----
60+
$ rosa verify network --subnet-ids subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc \
61+
--additional-trust-bundle-file /path/to/ca.cert \
62+
--https-proxy <proxy_url> <1>
63+
----
64+
<1> Replace `<proxy_url>` with the URL of your proxy service, for example `\https://10.10.0.1`.
65+
+
66+
.Example output
67+
[source,terminal]
68+
----
69+
I: Using proxy configuration
70+
I: Subnet IDs detected: subnet-03146b9b52b6024cb,subnet-03146b9b52b2034cc
71+
72+
E: Validating Subnet subnet-03146b9b52b6024cb egress
73+
E: X Egress failed to https://events.pagerduty.com
74+
----

‎modules/running-network-verification-manually-ocm.adoc

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network-verification.adoc
4+
5+
:_content-type: PROCEDURE
6+
ifdef::openshift-dedicated[]
7+
[id="running-network-verification-manually-ocm_{context}"]
8+
= Running the network verification manually
9+
endif::openshift-dedicated[]
10+
ifdef::openshift-rosa[]
11+
[discrete]
12+
[id="running-network-verification-manually-ocm_{context}"]
13+
= Running the network verification manually using {cluster-manager}
14+
endif::openshift-rosa[]
15+
16+
You can manually run the network verification checks for an existing
17+
ifdef::openshift-dedicated[]
18+
{product-title}
19+
endif::openshift-dedicated[]
20+
ifdef::openshift-rosa[]
21+
{product-title} (ROSA)
22+
endif::openshift-rosa[]
23+
cluster by using {cluster-manager-first}.
24+
25+
.Prerequisites
26+
27+
* You have an existing
28+
ifdef::openshift-dedicated[]
29+
{product-title}
30+
endif::openshift-dedicated[]
31+
ifdef::openshift-rosa[]
32+
ROSA
33+
endif::openshift-rosa[]
34+
cluster.
35+
* You are the cluster owner or you have the cluster editor role.
36+
37+
.Procedure
38+
39+
. Navigate to {cluster-manager-url} and select your cluster.
40+
41+
. Select *Verify networking* from the *Actions* drop-down menu.

‎modules/running-network-verification-manually.adoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network-verification.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="running-network-verification-manually_{context}"]
7+
= Running the network verification manually
8+
9+
After installing a {product-title} (ROSA) cluster, you can run the network verification checks manually by using {cluster-manager-first} or the ROSA CLI (`rosa`).

‎modules/sdpolicy-networking.adoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,10 @@ Red Hat SREs do not monitor private network connections. Monitoring these connec
7979
[id="dns-forwarding_{context}"]
8080
== DNS forwarding
8181
For {product-title} clusters that have a private cloud network configuration, a customer can specify internal DNS servers available on that private connection that should be queried for explicitly provided domains.
82+
83+
[id="osd-network-verification_{context}"]
84+
== Network verification
85+
86+
Network verification checks run automatically when you deploy an {product-title} cluster into an existing Virtual Private Cloud (VPC) or create an additional machine pool with a subnet that is new to your cluster. The checks validate your network configuration and highlight errors, enabling you to resolve configuration issues prior to deployment.
87+
88+
You can also run the network verification checks manually to validate the configuration for an existing cluster.

‎modules/understanding-network-verification.adoc

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network-verification.adoc
4+
5+
:_content-type: CONCEPT
6+
ifdef::openshift-dedicated[]
7+
[id="osd-understanding-network-verification_{context}"]
8+
= Understanding network verification for {product-title} clusters
9+
endif::openshift-dedicated[]
10+
ifdef::openshift-rosa[]
11+
[id="rosa-understanding-network-verification_{context}"]
12+
= Understanding network verification for ROSA clusters
13+
endif::openshift-rosa[]
14+
15+
When you deploy
16+
ifdef::openshift-dedicated[]
17+
an {product-title}
18+
endif::openshift-dedicated[]
19+
ifdef::openshift-rosa[]
20+
a {product-title} (ROSA)
21+
endif::openshift-rosa[]
22+
cluster into an existing Virtual Private Cloud (VPC) or create an additional machine pool with a subnet that is new to your cluster, network verification runs automatically. This helps you identify and resolve configuration issues prior to deployment.
23+
24+
ifdef::openshift-dedicated[]
25+
When you prepare to install your cluster by using {cluster-manager-first}, the automatic checks run after you input a subnet into a subnet ID field on the *Virtual Private Cloud (VPC) subnet settings* page.
26+
endif::openshift-dedicated[]
27+
ifdef::openshift-rosa[]
28+
When you prepare to install your cluster by using {cluster-manager-first}, the automatic checks run after you input a subnet into a subnet ID field on the *Virtual Private Cloud (VPC) subnet settings* page. If you create your cluster by using the ROSA CLI (`rosa`) with the interactive mode, the checks run after you provide the required VPC network information. If you use the CLI without the interactive mode, the checks begin immediately prior to the cluster creation.
29+
endif::openshift-rosa[]
30+
31+
When you add a machine pool with a subnet that is new to your cluster, the automatic network verification checks the subnet to ensure that network connectivity is available before the machine pool is provisioned.
32+
33+
After automatic network verification completes, a record is sent to the service log. The record provides the results of the verification check, including any network configuration errors. You can resolve the identified issues before a deployment and the deployment has a greater chance of success.
34+
35+
You can also run the network verification manually for an existing cluster. This enables you to verify the network configuration for your cluster after making configuration changes. For steps to run the network verification checks manually, see _Running the network verification manually_.

‎networking/network-verification.adoc

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
:_content-type: ASSEMBLY
2+
ifdef::openshift-dedicated[]
3+
[id="osd-network-verification_{context}"]
4+
= Network verification for {product-title} clusters
5+
endif::openshift-dedicated[]
6+
ifdef::openshift-rosa[]
7+
[id="rosa-network-verification_{context}"]
8+
= Network verification for ROSA clusters
9+
endif::openshift-rosa[]
10+
include::_attributes/common-attributes.adoc[]
11+
ifdef::openshift-dedicated,openshift-rosa[]
12+
include::_attributes/attributes-openshift-dedicated.adoc[]
13+
endif::[]
14+
:context: network-verification
15+
16+
toc::[]
17+
18+
Network verification checks run automatically when you deploy
19+
ifdef::openshift-dedicated[]
20+
an {product-title}
21+
endif::openshift-dedicated[]
22+
ifdef::openshift-rosa[]
23+
a {product-title} (ROSA)
24+
endif::openshift-rosa[]
25+
cluster into an existing Virtual Private Cloud (VPC) or create an additional machine pool with a subnet that is new to your cluster. The checks validate your network configuration and highlight errors, enabling you to resolve configuration issues prior to deployment.
26+
27+
You can also run the network verification checks manually to validate the configuration for an existing cluster.
28+
29+
include::modules/understanding-network-verification.adoc[leveloffset=+1]
30+
31+
[id="scope-of-the-network-verification-checks_{context}"]
32+
== Scope of the network verification checks
33+
34+
The network verification includes checks for each of the following requirements:
35+
36+
* The parent Virtual Private Cloud (VPC) exists.
37+
* All specified subnets belong to the VPC.
38+
* The VPC has `enableDnsSupport` enabled.
39+
* The VPC has `enableDnsHostnames` enabled.
40+
ifdef::openshift-dedicated[]
41+
* Egress is available to the required domain and port combinations that are specified in the xref:../osd_planning/aws-ccs.adoc#osd-aws-privatelink-firewall-prerequisites_aws-ccs[AWS firewall prerequisites] section.
42+
endif::openshift-dedicated[]
43+
ifdef::openshift-rosa[]
44+
* Egress is available to the required domain and port combinations that are specified in the xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#osd-aws-privatelink-firewall-prerequisites_rosa-sts-aws-prereqs[AWS firewall prerequisites] section.
45+
endif::openshift-rosa[]
46+
47+
include::modules/automatic-network-verification-bypassing.adoc[leveloffset=+1]
48+
ifdef::openshift-dedicated[]
49+
include::modules/running-network-verification-manually-ocm.adoc[leveloffset=+1]
50+
endif::openshift-dedicated[]
51+
ifdef::openshift-rosa[]
52+
include::modules/running-network-verification-manually.adoc[leveloffset=+1]
53+
include::modules/running-network-verification-manually-ocm.adoc[leveloffset=+2]
54+
include::modules/running-network-verification-manually-cli.adoc[leveloffset=+2]
55+
endif::openshift-rosa[]

0 commit comments

Comments
 (0)