Skip to content

Commit c2e6ae7

Browse files
kelbrown20kelbrown20
authored
Merge pull request #57678 from kelbrown20/OSDOCS-5458-netowork-plumbing-microshift
OSDOCS-5458: Networking doc improvements for MicroShift
2 parents bcaacfd + c876aaa commit c2e6ae7

File tree

4 files changed

+221
-1
lines changed

4 files changed

+221
-1
lines changed

‎microshift_networking/microshift-networking.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ include::modules/microshift-restart-ovnkube-master.adoc[leveloffset=+1]
2828
include::modules/microshift-http-proxy.adoc[leveloffset=+1]
2929
include::modules/microshift-cri-o-container-runtime.adoc[leveloffset=+1]
3030
include::modules/microshift-ovs-snapshot.adoc[leveloffset=+1]
31+
include::modules/microshift-deploying-a-load-balancer.adoc[leveloffset=+1]
32+
include::modules/microshift-blocking-nodeport-access.adoc[leveloffset=+1]
3133
include::modules/microshift-mDNS.adoc[leveloffset=+1]
3234

3335
[role="_additional-resources"]

‎modules/microshift-blocking-nodeport-access.adoc

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="microshift-blocking-nodeport-access_{context}"]
7+
= Blocking external access to the NodePort service on a specific host interface
8+
9+
OVN-Kubernetes does not restrict the host interface where a NodePort service can be accessed from outside a {product-title} node.
10+
The following procedure explains how to block the NodePort service on a specific host interface and restrict external access.
11+
12+
.Prerequisites
13+
14+
* You need access to the cluster as a user with the cluster-admin role.
15+
16+
.Procedure
17+
. Change the `NODEPORT` variable to the host port number assigned to your Kubernetes NodePort service by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ export NODEPORT=30700
22+
----
23+
. Change the `INTERFACE_IP` value to the IP address from the host interface that you want to block. For example:
24+
+
25+
[source,terminal]
26+
----
27+
$ export INTERFACE_IP=192.168.150.33
28+
----
29+
. Insert a new rule in the `nat` table PREROUTING chain to drop all packets that match the destination port and ip.
30+
+
31+
[source,terminal]
32+
----
33+
$ sudo nft -a insert rule ip nat PREROUTING tcp dport $NODEPORT ip daddr $INTERFACE_IP drop
34+
----
35+
. List the new rule by running the following command:
36+
+
37+
[source,terminal]
38+
----
39+
$ sudo nft -a list chain ip nat PREROUTING
40+
table ip nat {
41+
chain PREROUTING { # handle 1
42+
type nat hook prerouting priority dstnat; policy accept;
43+
tcp dport 30700 ip daddr 192.168.150.33 drop # handle 134
44+
counter packets 108 bytes 18074 jump OVN-KUBE-ETP # handle 116
45+
counter packets 108 bytes 18074 jump OVN-KUBE-EXTERNALIP # handle 114
46+
counter packets 108 bytes 18074 jump OVN-KUBE-NODEPORT # handle 112
47+
}
48+
}
49+
----
50+
+
51+
[NOTE]
52+
====
53+
Note your `handle` number of the newly added rule. You need to remove the `handle` number in the following step
54+
====
55+
. Remove the custom rule with the following sample command:
56+
+
57+
[source,terminal]
58+
----
59+
$ sudo nft -a delete rule ip nat PREROUTING handle 134
60+
----
61+

‎modules/microshift-configuring-ovn.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ mtu: 1400
6969

7070
|mtu
7171
|uint32
72-
|1400
72+
|auto
7373
|MTU value used for the pods
7474
|1300
7575
|===

‎modules/microshift-deploying-a-load-balancer.adoc

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="microshift-deploying-a-load-balancer_{context}"]
7+
= Deploying a TCP load balancer on a workload
8+
9+
{product-title} offers a built-in implementation of network load balancers. The following example procedure uses the node IP address as the external IP address for the `LoadBalancer` service configuration file.
10+
11+
.Prerequisites
12+
13+
* You installed the OpenShift CLI (`oc`)
14+
* You need access to the cluster as a user with the cluster-admin role.
15+
* You installed a cluster on an infrastructure configured with the OVN-Kubernetes network plugin.
16+
* The `KUBECONFIG` environment variable is set.
17+
18+
.Procedure
19+
20+
. Verify that your pods are running by running the following command:
21+
+
22+
[source,terminal]
23+
----
24+
$ oc get pods -A
25+
----
26+
27+
. Create a namespace by running the following commands:
28+
+
29+
[source,terminal]
30+
----
31+
$ NAMESPACE=nginx-lb-test
32+
----
33+
+
34+
[source,terminal]
35+
----
36+
$ oc create ns $NAMESPACE
37+
----
38+
. The following example deploys three replicas of the test `nginx` application in your namespace.
39+
+
40+
[source,terminal]
41+
----
42+
$ oc apply -n $NAMESPACE -f - <<EOF
43+
apiVersion: v1
44+
kind: ConfigMap
45+
metadata:
46+
name: nginx
47+
data:
48+
headers.conf: |
49+
add_header X-Server-IP \$server_addr always;
50+
---
51+
apiVersion: apps/v1
52+
kind: Deployment
53+
metadata:
54+
name: nginx
55+
spec:
56+
replicas: 3
57+
selector:
58+
matchLabels:
59+
app: nginx
60+
template:
61+
metadata:
62+
labels:
63+
app: nginx
64+
spec:
65+
containers:
66+
- image: quay.io/packit/nginx-unprivileged
67+
imagePullPolicy: Always
68+
name: nginx
69+
ports:
70+
- containerPort: 8080
71+
volumeMounts:
72+
- name: nginx-configs
73+
subPath: headers.conf
74+
mountPath: /etc/nginx/conf.d/headers.conf
75+
securityContext:
76+
allowPrivilegeEscalation: false
77+
seccompProfile:
78+
type: RuntimeDefault
79+
capabilities:
80+
drop: ["ALL"]
81+
runAsNonRoot: true
82+
volumes:
83+
- name: nginx-configs
84+
configMap:
85+
name: nginx
86+
items:
87+
- key: headers.conf
88+
path: headers.conf
89+
EOF
90+
----
91+
92+
. You can verify that the three sample replicas started successfully by running the following command:
93+
+
94+
[source,terminal]
95+
----
96+
$ oc get pods -n $NAMESPACE
97+
----
98+
99+
. Create a `LoadBalancer` service for the `nginx` test application with the following sample commands:
100+
+
101+
[source,terminal]
102+
----
103+
$ oc create -n $NAMESPACE -f - <<EOF
104+
apiVersion: v1
105+
kind: Service
106+
metadata:
107+
name: nginx
108+
spec:
109+
ports:
110+
- port: 81
111+
targetPort: 8080
112+
selector:
113+
app: nginx
114+
type: LoadBalancer
115+
EOF
116+
----
117+
+
118+
[NOTE]
119+
====
120+
You must ensure that the `port` parameter is a host port that is not occupied by other `LoadBalancer` services or {product-title} components
121+
====
122+
123+
. To verify that the service file exists and the external IP address is properly assigned, and the external IP is identical to the node IP, run the following command:
124+
+
125+
[source,terminal]
126+
----
127+
$ oc get svc -n $NAMESPACE
128+
----
129+
+
130+
.Example output
131+
[source,terminal]
132+
----
133+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
134+
nginx LoadBalancer 10.43.183.104 192.168.1.241 81:32434/TCP 2m
135+
----
136+
137+
.Verification
138+
139+
* The following command forms five connections to the `nginx` application using the external IP address of the `LoadBalancer` service config. You can verify that the load balancer sends requests to all the running applications with the following command:
140+
+
141+
[source,terminal]
142+
----
143+
EXTERNAL_IP=192.168.1.241
144+
seq 5 | xargs -Iz curl -s -I http://$EXTERNAL_IP:81 | grep X-Server-IP
145+
----
146+
+
147+
Your output should contain different IP addresses, this shows that the load balancer is successfully distributing the traffic to the applications.
148+
+
149+
.Example output
150+
[source,terminal]
151+
----
152+
X-Server-IP: 10.42.0.41
153+
X-Server-IP: 10.42.0.41
154+
X-Server-IP: 10.42.0.43
155+
X-Server-IP: 10.42.0.41
156+
X-Server-IP: 10.42.0.43
157+
----

0 commit comments

Comments
 (0)