Skip to content

Commit c8af3c4

Browse files
jab-rhjab-rh
authored
Merge pull request #61110 from jab-rh/OSDOCS-6264
OSDOCS-6264: OVN as Secondary Network GA
2 parents ad4ed3d + 50ed733 commit c8af3c4

7 files changed

+241
-44
lines changed

‎modules/configuration-ovnk-multi-network-policy.adoc

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/multiple_networks/configuring-additional-network.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="compatibility-with-multi-network-policy_{context}"]
7+
= Compatibility with multi-network policy
8+
9+
The multi-network policy API, which is provided by the `MultiNetworkPolicy` custom resource definition (CRD) in the `k8s.cni.cncf.io` API group, is compatible with an OVN-Kubernetes secondary network. When defining a network policy, the network policy rules that can be used depend on whether the OVN-Kubernetes secondary network defines the `subnets` field. Refer to the following table for details:
10+
11+
.Supported multi-network policy selectors based on `subnets` CNI configuration
12+
[cols=".^3,.^7",options="header"]
13+
|====
14+
a|`subnets` field specified|Allowed multi-network policy selectors
15+
16+
|
17+
Yes
18+
a|
19+
* `podSelector` and `namespaceSelector`
20+
* `ipBlock`
21+
22+
|
23+
No
24+
a|
25+
* `ipBlock`
26+
27+
|====
28+
29+
For example, the following multi-network policy is valid only if the `subnets` field is defined in the additional network CNI configuration for the additional network named `blue2`:
30+
31+
.Example multi-network policy that uses a pod selector
32+
[source,yaml]
33+
----
34+
apiVersion: k8s.cni.cncf.io/v1beta1
35+
kind: MultiNetworkPolicy
36+
metadata:
37+
name: allow-same-namespace
38+
annotations:
39+
k8s.v1.cni.cncf.io/policy-for: blue2
40+
spec:
41+
podSelector:
42+
ingress:
43+
- from:
44+
- podSelector: {}
45+
----
46+
47+
The following example uses the `ipBlock` network policy selector, which is always valid for an OVN-Kubernetes additional network:
48+
49+
.Example multi-network policy that uses an IP block selector
50+
[source,yaml]
51+
----
52+
apiVersion: k8s.cni.cncf.io/v1beta1
53+
kind: MultiNetworkPolicy
54+
metadata:
55+
name: ingress-ipblock
56+
annotations:
57+
k8s.v1.cni.cncf.io/policy-for: default/flatl2net
58+
spec:
59+
podSelector:
60+
matchLabels:
61+
name: access-control
62+
policyTypes:
63+
- Ingress
64+
ingress:
65+
- from:
66+
- ipBlock:
67+
cidr: 10.200.0.0/30
68+
----

‎modules/configuration-ovnk-network-plugin-json-object.adoc

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,40 +11,55 @@ The following table describes the configuration parameters for the OVN-Kubernete
1111

1212
|`cniVersion`
1313
|`string`
14-
|The CNI specification version. The required value is `0.3.1`.
14+
|
15+
The CNI specification version. The required value is `0.3.1`.
1516

1617
|`name`
1718
|`string`
18-
|The name of the network. These networks are not namespaced. For example, you can have a network named
19+
|
20+
The name of the network. These networks are not namespaced. For example, you can have a network named
1921
`l2-network` referenced from two different `NetworkAttachmentDefinitions` that exist on two different
2022
namespaces. This ensures that pods making use of the `NetworkAttachmentDefinition` on their own different
2123
namespaces can communicate over the same secondary network. However, those two different `NetworkAttachmentDefinitions` must also share the same network specific parameters such as `topology`, `subnets`, `mtu`, and `excludeSubnets`.
2224

2325
|`type`
2426
|`string`
25-
|The name of the CNI plugin to configure. The required value is `ovn-k8s-cni-overlay`.
27+
|
28+
The name of the CNI plugin to configure. This value must be set to `ovn-k8s-cni-overlay`.
2629

2730
|`topology`
2831
|`string`
29-
|The topological configuration for the network. The required value is `layer2`.
32+
|
33+
The topological configuration for the network. Must be one of `layer2` or `localnet`.
3034

3135
|`subnets`
3236
|`string`
33-
| The subnet to use for the network across the cluster. When specifying `layer2` for the `topology`, only include the CIDR for the node. For example, `10.100.200.0/24`.
37+
|
38+
The subnet to use for the network across the cluster. When specifying `layer2` for the `topology`, only include the CIDR for the node. For example, `10.100.200.0/24`.
3439

3540
For `"topology":"layer2"` deployments, IPv6 (`2001:DBB::/64`) and dual-stack (`192.168.100.0/24,2001:DBB::/64`) subnets are supported.
3641

42+
When omitted, the logical switch implementing the network only provides layer 2 communication, and users must configure IP addresses for the pods. Port security only prevents MAC spoofing.
43+
3744
|`mtu`
3845
|`string`
39-
|The maximum transmission unit (MTU) to the specified value. The default value, `1300`, is automatically set by the kernel.
46+
|
47+
The maximum transmission unit (MTU). The default value, `1300`, is automatically set by the kernel.
4048

4149
|`netAttachDefName`
4250
|`string`
43-
|The metadata `namespace` and `name` of the network attachment definition object where this
51+
|
52+
The metadata `namespace` and `name` of the network attachment definition object where this
4453
configuration is included. For example, if this configuration is defined in a `NetworkAttachmentDefinition` in namespace `ns1` named `l2-network`, this should be set to `ns1/l2-network`.
4554

4655
|`excludeSubnets`
4756
|`string`
48-
|A comma-separated list of CIDRs and IPs. IPs are removed from the assignable IP pool, and are never passed to the pods. When omitted, the logical switch implementing the network only provides layer 2 communication, and users must configure IPs for the pods. Port security only prevents MAC spoofing.
57+
|
58+
A comma-separated list of CIDRs and IP addresses. IP addresses are removed from the assignable IP address pool and are never passed to the pods.
59+
60+
|`vlanID`
61+
|`integer`
62+
|
63+
If topology is set to `localnet`, the specified VLAN tag is assigned to traffic from this additional network. The default is to not assign a VLAN tag.
4964

50-
|====
65+
|====

‎modules/configuring-layer-two-switched-topology.adoc

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
:_content-type: CONCEPT
66
[id="configuration-layer-two-switched-topology_{context}"]
7-
= Configuration for a switched topology
7+
= Configuration for a layer 2 switched topology
88

99
The switched (layer 2) topology networks interconnect the workloads through a cluster-wide logical switch. This configuration can be used for IPv6 and dual-stack deployments.
1010

@@ -13,18 +13,18 @@ The switched (layer 2) topology networks interconnect the workloads through a cl
1313
Layer 2 switched topology networks only allow for the transfer of data packets between pods within a cluster.
1414
====
1515

16-
The following `NetworkAttachmentDefinition` custom resource definition (CRD) YAML describes the fields needed to configure a switched secondary network.
16+
The following JSON example configures a switched secondary network:
1717

18-
[source,yaml]
18+
[source,json]
19+
----
20+
{
21+
"cniVersion": "0.3.1",
22+
"name": "l2-network",
23+
"type": "ovn-k8s-cni-overlay",
24+
"topology":"layer2",
25+
"subnets": "10.100.200.0/24",
26+
"mtu": 1300,
27+
"netAttachDefName": "ns1/l2-network",
28+
"excludeSubnets": "10.100.200.0/29"
29+
}
1930
----
20-
{
21-
"cniVersion": "0.3.1",
22-
"name": "l2-network",
23-
"type": "ovn-k8s-cni-overlay",
24-
"topology":"layer2",
25-
"subnets": "10.100.200.0/24",
26-
"mtu": 1300,
27-
"netAttachDefName": "ns1/l2-network",
28-
"excludeSubnets": "10.100.200.0/29"
29-
}
30-
----

‎modules/configuring-localnet-switched-topology.adoc

Lines changed: 95 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,22 +6,103 @@
66
[id="configuration-localnet-switched-topology_{context}"]
77
= Configuration for a localnet switched topology
88

9+
// To accommodate a link to the NMstate Operator, the content in this module
10+
// is split with tags. The tag includes don't pull in the module header above.
11+
12+
// tag::localnet-intro[]
913
The switched (localnet) topology interconnects the workloads through a cluster-wide logical switch to a physical network.
14+
// end::localnet-intro[]
15+
16+
// tag::localnet-content[]
17+
You must map an additional network to the OVN bridge to use it as an OVN-Kubernetes additional network. Bridge mappings allow network traffic to reach the physical network. A bridge mapping associates a physical network name, also known as an interface label, to a bridge created with Open vSwitch (OVS).
18+
19+
You can create an `NodeNetworkConfigurationPolicy` object, part of the `nmstate.io/v1` API group, to declaratively create the mapping. This API is provided by the NMState Operator. By using this API you can apply the bridge mapping to nodes that match your specified `nodeSelector` expression, such as `node-role.kubernetes.io/worker: ''`.
20+
21+
When attaching an additional network, you can either use the existing `br-ex` bridge or create a new bridge. Which approach to use depends on your specific network infrastructure.
22+
23+
- If your nodes include only a single network interface, you must use the existing bridge. This network interface is owned and managed by OVN-Kubernetes and you must not remove it from the `br-ex` bridge or alter the interface configuration. If you remove or alter the network interface, your cluster network will stop working correctly.
24+
- If your nodes include several network interfaces, you can attach a different network interface to a new bridge, and use that for your additional network. This approach provides for traffic isolation from your primary cluster network.
25+
26+
The `localnet1` network is mapped to the `br-ex` bridge in the following example:
27+
28+
.Example mapping for sharing a bridge
29+
[source,yaml]
30+
----
31+
apiVersion: nmstate.io/v1
32+
kind: NodeNetworkConfigurationPolicy
33+
metadata:
34+
name: mapping <1>
35+
spec:
36+
nodeSelector:
37+
node-role.kubernetes.io/worker: '' <2>
38+
desiredState:
39+
ovn:
40+
bridge-mappings:
41+
- localnet: localnet1 <3>
42+
bridge: br-ex <4>
43+
state: present <5>
44+
----
45+
<1> The name for the configuration object.
46+
<2> A node selector that specifies the nodes to apply the node network configuration policy to.
47+
<3> The name for the additional network from which traffic is forwarded to the OVS bridge. This additional network must match the name of the `spec.config.name` field of the `NetworkAttachmentDefinition` object that defines the OVN-Kubernetes additional network.
48+
<4> The name of the OVS bridge on the node. This value is required only if you specify `state: present`.
49+
<5> The state for the mapping. Must be either `present` to add the bridge or `absent` to remove the bridge. The default value is `present`.
1050

11-
The following `NetworkAttachmentDefinition` custom resource definition (CRD) YAML describes the fields needed to configure a localnet secondary network.
51+
In the following example, the `localnet2` network interface is attached to the `ovs-br1` bridge. Through this attachment, the network interface is available to the OVN-Kubernetes network plugin as an additional network.
1252

53+
.Example mapping for nodes with multiple interfaces
1354
[source,yaml]
1455
----
15-
{
16-
"cniVersion": "0.3.1",
17-
"name": "ns1-localnet-network",
18-
"type": "ovn-k8s-cni-overlay",
19-
"topology":"localnet",
20-
"subnets": "202.10.130.112/28",
21-
"vlanID": 33,
22-
"mtu": 1500,
23-
"netAttachDefName": "ns1/localnet-network"
24-
"excludeSubnets": "10.100.200.0/29"
25-
26-
}
27-
----
56+
apiVersion: nmstate.io/v1
57+
kind: NodeNetworkConfigurationPolicy
58+
metadata:
59+
name: ovs-br1-multiple-networks <1>
60+
spec:
61+
nodeSelector:
62+
node-role.kubernetes.io/worker: '' <2>
63+
desiredState:
64+
interfaces:
65+
- name: ovs-br1 <3>
66+
description: |-
67+
A dedicated OVS bridge with eth1 as a port
68+
allowing all VLANs and untagged traffic
69+
type: ovs-bridge
70+
state: up
71+
bridge:
72+
options:
73+
stp: true
74+
port:
75+
- name: eth1 <4>
76+
ovn:
77+
bridge-mappings:
78+
- localnet: localnet2 <5>
79+
bridge: ovs-br1 <6>
80+
state: present <7>
81+
----
82+
<1> The name for the configuration object.
83+
<2> A node selector that specifies the nodes to apply the node network configuration policy to.
84+
<3> A new OVS bridge, separate from the default bridge used by OVN-Kubernetes for all cluster traffic.
85+
<4> A network device on the host system to associate with this new OVS bridge.
86+
<5> The name for the additional network from which traffic is forwarded to the OVS bridge. This additional network must match the name of the `spec.config.name` field of the `NetworkAttachmentDefinition` object that defines the OVN-Kubernetes additional network.
87+
<6> The name of the OVS bridge on the node. This value is required only if you specify `state: present`.
88+
<7> The state for the mapping. Must be either `present` to add the bridge or `absent` to remove the bridge. The default value is `present`.
89+
90+
This declarative approach is recommended because the NMState Operator applies additional network configuration to all nodes specified by the node selector automatically and transparently.
91+
92+
The following JSON example configures a localnet secondary network:
93+
94+
[source,json]
95+
----
96+
{
97+
"cniVersion": "0.3.1",
98+
"name": "ns1-localnet-network",
99+
"type": "ovn-k8s-cni-overlay",
100+
"topology":"localnet",
101+
"subnets": "202.10.130.112/28",
102+
"vlanID": 33,
103+
"mtu": 1500,
104+
"netAttachDefName": "ns1/localnet-network"
105+
"excludeSubnets": "10.100.200.0/29"
106+
}
107+
----
108+
// end::localnet-content[]

‎modules/configuring-ovnk-additional-networks.adoc

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,28 @@
66
[id="configuration-ovnk-additional-networks_{context}"]
77
= Configuration for an OVN-Kubernetes additional network
88

9-
The {openshift-networking} OVN-Kubernetes network plugin allows the configuration of secondary network interfaces for pods. To configure secondary network interfaces, you must define the configurations in the `NetworkAttachmentDefinition` custom resource definition (CRD).
9+
The {openshift-networking} OVN-Kubernetes network plugin allows the configuration of secondary network interfaces for pods. To configure secondary network interfaces, you must define the configurations in the `NetworkAttachmentDefinition` custom resource (CR).
1010

11-
:FeatureName: Configuration for an OVN-Kubernetes additional network
12-
include::snippets/technology-preview.adoc[]
11+
You can configure an OVN-Kubernetes additional network in either _layer 2_ or _localnet_ topologies.
12+
13+
- A layer 2 topology supports east-west cluster traffic, but does not allow access to the underlying physical network.
14+
- A localnet topology allows connections to the physical network, but requires additional configuration of the underlying Open vSwitch (OVS) bridge on cluster nodes.
1315
1416
The following sections provide example configurations for each of the topologies that OVN-Kubernetes currently allows for secondary networks.
1517

1618
[NOTE]
1719
====
18-
Networks names must be unique. For example, creating multiple `NetworkAttachmentDefinition` CRDs with different configurations that reference the same network is unsupported.
19-
====
20+
Networks names must be unique. For example, creating multiple `NetworkAttachmentDefinition` CRs with different configurations that reference the same network is unsupported.
21+
====
22+
23+
[id="configuration-additional-network-types-supported-platforms_{context}"]
24+
== Supported platforms for OVN-Kubernetes additional network
25+
26+
You can use an OVN-Kubernetes additional network with the following supported platforms:
27+
28+
- Bare metal
29+
- {ibmpowerProductName}
30+
- {ibmzProductName}
31+
- {linuxoneProductName}
32+
- VMware vSphere
33+
- {rh-openstack-first}

‎networking/multiple_networks/configuring-additional-network.adoc

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,13 +139,32 @@ include::modules/nw-multus-tap-object.adoc[leveloffset=+2]
139139

140140
* For more information about enabling an SELinux boolean on a node, see xref:../../nodes/nodes/nodes-nodes-managing.adoc#nodes-nodes-working-setting-booleans_nodes-nodes-managing[Setting SELinux booleans]
141141

142+
// Set of includes pertains to OVN-Kubernetes additional network
142143
include::modules/configuring-ovnk-additional-networks.adoc[leveloffset=+2]
143144
include::modules/configuration-ovnk-network-plugin-json-object.adoc[leveloffset=+3]
145+
include::modules/configuration-ovnk-multi-network-policy.adoc[leveloffset=+3]
146+
144147
//include::modules/configuring-layer-three-routed-topology.adoc[leveloffset=+3]
145148
include::modules/configuring-layer-two-switched-topology.adoc[leveloffset=+3]
146-
//include::modules/configuring-localnet-switched-topology.adoc[leveloffset=+3]
149+
150+
[id="{context}_ovn-kubernetes-configuration-for-a-localnet-topology"]
151+
==== Configuration for a localnet topology
152+
153+
include::modules/configuring-localnet-switched-topology.adoc[tag=localnet-intro]
154+
155+
// Workaround lack of xref in modules
156+
[id="{context}_configuration-additional-network-types-prerequisites"]
157+
===== Prerequisites for configuring OVN-Kubernetes additional network
158+
159+
- The NMState Operator is installed. For more information, see xref:../../networking/k8s_nmstate/k8s-nmstate-about-the-k8s-nmstate-operator.adoc#k8s-nmstate-about-the-k8s-nmstate-operator[About the Kubernetes NMState Operator].
160+
161+
[id="{context}_configuration-additional-network-interface"]
162+
===== Configuration for an OVN-Kubernetes additional network mapping
163+
164+
include::modules/configuring-localnet-switched-topology.adoc[tag=localnet-content]
147165
include::modules/configuring-pods-secondary-network.adoc[leveloffset=+3]
148166
include::modules/configuring-pods-static-ip.adoc[leveloffset=+3]
167+
// end OVN-Kubernetes includes
149168

150169
include::modules/nw-multus-ipam-object.adoc[leveloffset=+1]
151170

‎networking/multiple_networks/configuring-multi-network-policy.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
As a cluster administrator, you can configure multi-network for additional networks. You can specify multi-network policy for SR-IOV and macvlan additional networks. Macvlan additional networks are fully supported. Other types of additional networks, such as ipvlan, are not supported.
9+
As a cluster administrator, you can configure multi-network for additional networks. You can specify multi-network policy for SR-IOV, macvlan, and OVN-Kubernetes additional networks. Macvlan additional networks are fully supported. Other types of additional networks, such as ipvlan, are not supported.
1010

1111
[IMPORTANT]
1212
====

0 commit comments

Comments
 (0)