Skip to content

Commit fd80506

Browse files
mburke5678mburke5678
authored
Merge pull request #52114 from JoeAldinger/OSDOCS-4072
OSDOCS-4072: adds ingress firewall node operator
2 parents 3d05c75 + 3d63fa3 commit fd80506

10 files changed

+522
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1026,6 +1026,9 @@ Topics:
10261026
- Name: Understanding the Ingress Operator
10271027
File: ingress-operator
10281028
Distros: openshift-enterprise,openshift-origin
1029+
- Name: Understanding the Ingress Node Firewall Operator
1030+
File: ingress-node-firewall-operator
1031+
Distros: openshift-enterprise,openshift-origin
10291032
- Name: Configuring the Ingress Controller for manual DNS management
10301033
File: ingress-controller-dnsmgt
10311034
Distros: openshift-enterprise,openshift-origin

‎modules/nw-infw-operator-config-object.adoc

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ingress-node-firewall-operator.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="nw-infw-operator-config-object_{context}"]
7+
== Ingress Node Firewall configuration object
8+
9+
The fields for the Ingress Node Firewall configuration object are described in the following table:
10+
11+
.Ingress Node Firewall Configuration object
12+
[cols=".^2,.^2,.^6a",options="header"]
13+
|====
14+
|Field|Type|Description
15+
16+
|`metadata.name`
17+
|`string`
18+
|The name of the CR object. The name of the firewall rules object must be `ingressnodefirewallconfig`.
19+
20+
|`metadata.namespace`
21+
|`string`
22+
|Namespace for the Ingress Firewall Operator CR object. The `IngressNodeFirewallConfig` CR must be created inside the `openshift-ingress-node-firewall` namespace.
23+
24+
|`spec.nodeSelector`
25+
|`string`
26+
|
27+
A node selection constraint used to target nodes through specified node labels. For example:
28+
29+
[source,yaml]
30+
----
31+
spec:
32+
nodeSelector:
33+
node-role.kubernetes.io/worker: ""
34+
----
35+
36+
[NOTE]
37+
====
38+
One label used in `nodeSelector` must match a label on the nodes in order for the daemon set to start. For example, if the node labels `node-role.kubernetes.io/worker` and `node-type.kubernetes.io/vm` are applied to a node, then at least one label must be set using `nodeSelector` for the daemon set to start.
39+
====
40+
41+
|====
42+
43+
[NOTE]
44+
====
45+
The Operator consumes the CR and creates an ingress node firewall daemon set on all the nodes that match the `nodeSelector`.
46+
====
47+
48+
[discrete]
49+
[id="nw-ingress-node-firewall-example-cr-2_{context}"]
50+
== Ingress Node Firewall Operator example configuration
51+
52+
A complete Ingress Node Firewall Configuration is specified in the following example:
53+
54+
.Example Ingress Node Firewall Configuration object
55+
[source,yaml]
56+
----
57+
apiVersion: ingressnodefirewall.openshift.io/v1alpha1
58+
kind: IngressNodeFirewallConfig
59+
metadata:
60+
name: ingressnodefirewallconfig
61+
namespace: openshift-ingress-node-firewall
62+
spec:
63+
nodeSelector:
64+
node-role.kubernetes.io/worker: ""
65+
----
66+
67+
[NOTE]
68+
====
69+
The Operator consumes the CR and creates an ingress node firewall daemon set on all the nodes that match the `nodeSelector`.
70+
====

‎modules/nw-infw-operator-cr.adoc

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ingress-node-firewall-operator.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="nw-infw-operator-cr_{context}"]
7+
= Ingress Node Firewall Operator
8+
9+
The Ingress Node Firewall Operator provides ingress firewall rules at a node level by deploying the daemon set to nodes you specify and manage in the firewall configurations. To deploy the daemon set, you create an `IngressNodeFirewallConfig` custom resource (CR). The Operator applies the `IngressNodeFirewallConfig` CR to create ingress node firewall daemon set `daemon`, which run on all nodes that match the `nodeSelector`.
10+
11+
You configure `rules` of the `IngressNodeFirewall` CR and apply them to clusters using the `nodeSelector` and setting values to "true".
12+
13+
[IMPORTANT]
14+
====
15+
The Ingress Node Firewall Operator supports only stateless firewall rules.
16+
17+
The maximum transmission units (MTU) parameter is 4Kb (kilobytes) in {product-title} {product-version}.
18+
19+
Network interface controllers (NICs) that do not support native XDP drivers will run at a lower performance.
20+
====

‎modules/nw-infw-operator-deploying.adoc

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ingress-node-firewall-operator.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="nw-infw-operator-deploying_{context}"]
7+
= Deploying Ingress Node Firewall Operator
8+
9+
.Prerequisite
10+
* The Ingress Node Firewall Operator is installed.
11+
12+
.Procedure
13+
14+
To delploy the Ingress Node Firewall Operator, create a `IngressNodeFirewallConfig` custom resource that will deploy the Operator's daemon set. You can deploy one or multiple `IngressNodeFirewall` CRDs to nodes by applying firewall rules.
15+
16+
. Create the `IngressNodeFirewallConfig` inside the `openshift-ingress-node-firewall` namespace named `ingressnodefirewallconfig`.
17+
18+
. Run the following command to deploy Ingress Node Firewall Operator rules:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc apply -f rule.yaml
23+
----

‎modules/nw-infw-operator-installing.adoc

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ingress-node-firewall-operator.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="installing-infw-operator_{context}"]
7+
= Installing the Ingress Node Firewall Operator
8+
9+
As a cluster administrator, you can install the Ingress Node Firewall Operator by using the {product-title} CLI or the web console.
10+
11+
[id="install-operator-cli_{context}"]
12+
== Installing the Ingress Node Firewall Operator using the CLI
13+
14+
As a cluster administrator, you can install the Operator using the CLI.
15+
16+
.Prerequisites
17+
18+
* You have installed the OpenShift CLI (`oc`).
19+
* You have an account with administrator privileges.
20+
21+
.Procedure
22+
23+
. To create the `openshift-ingress-node-firewall` namespace, enter the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ cat << EOF| oc create -f -
28+
apiVersion: v1
29+
kind: Namespace
30+
metadata:
31+
labels:
32+
pod-security.kubernetes.io/enforce: privileged
33+
pod-security.kubernetes.io/enforce-version: v1.24
34+
name: openshift-ingress-node-firewall
35+
EOF
36+
----
37+
38+
. To create an `OperatorGroup` CR, enter the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ cat << EOF| oc create -f -
43+
apiVersion: operators.coreos.com/v1
44+
kind: OperatorGroup
45+
metadata:
46+
name: ingress-node-firewall-operators
47+
namespace: openshift-ingress-node-firewall
48+
EOF
49+
----
50+
51+
. Subscribe to the Ingress Node Firewall Operator.
52+
53+
.. To create a `Subscription` CR for the Ingress Node Firewall Operator, enter the following command:
54+
+
55+
[source,terminal]
56+
----
57+
$ cat << EOF| oc create -f -
58+
apiVersion: operators.coreos.com/v1alpha1
59+
kind: Subscription
60+
metadata:
61+
name: ingress-node-firewall-sub
62+
namespace: openshift-ingress-node-firewall
63+
spec:
64+
name: ingress-node-firewall
65+
channel: stable
66+
source: redhat-operators
67+
sourceNamespace: openshift-marketplace
68+
EOF
69+
----
70+
71+
. To verify that the Operator is installed, enter the following command:
72+
+
73+
[source,terminal]
74+
----
75+
$ oc get ip -n openshift-ingress-node-firewall
76+
----
77+
+
78+
.Example output
79+
[source,terminal]
80+
----
81+
NAME CSV APPROVAL APPROVED
82+
install-5cvnz ingress-node-firewall.4.12.0-202211122336 Automatic true
83+
----
84+
85+
. To verify the version of the Operator, enter the following command:
86+
87+
+
88+
[source,terminal]
89+
----
90+
$ oc get csv -n openshift-ingress-node-firewall
91+
----
92+
+
93+
.Example output
94+
[source,terminal]
95+
----
96+
NAME DISPLAY VERSION REPLACES PHASE
97+
ingress-node-firewall.4.12.0-202211122336 Ingress Node Firewall Operator 4.12.0-202211122336 ingress-node-firewall.4.12.0-202211102047 Succeeded
98+
----
99+
100+
[id="install-operator-web-console_{context}"]
101+
== Installing the Ingress Node Firewall Operator using the web console
102+
103+
As a cluster administrator, you can install the Operator using the web console.
104+
105+
.Prerequisites
106+
107+
* You have installed the OpenShift CLI (`oc`).
108+
* You have an account with administrator privileges.
109+
110+
.Procedure
111+
112+
113+
. Install the Ingress Node Firewall Operator:
114+
115+
.. In the {product-title} web console, click *Operators* -> *OperatorHub*.
116+
117+
.. Select *Ingress Node Firewall Operator* from the list of available Operators, and then click *Install*.
118+
119+
.. On the *Install Operator* page, under *Installed Namespace*, select *Operator recommended Namespace*.
120+
121+
.. Click *Install*.
122+
123+
. Verify that the Ingress Node Firewall Operator is installed successfully:
124+
125+
.. Navigate to the *Operators* -> *Installed Operators* page.
126+
127+
.. Ensure that *Ingress Node Firewall Operator* is listed in the *openshift-ingress-node-firewall* project with a *Status* of *InstallSucceeded*.
128+
+
129+
[NOTE]
130+
====
131+
During installation an Operator might display a *Failed* status.
132+
If the installation later succeeds with an *InstallSucceeded* message, you can ignore the *Failed* message.
133+
====
134+
135+
+
136+
If the Operator does not have a *Status* of *InstallSucceeded*, troubleshoot using the following steps:
137+
138+
+
139+
* Inspect the *Operator Subscriptions* and *Install Plans* tabs for any failures or errors under *Status*.
140+
* Navigate to the *Workloads* -> *Pods* page and check the logs for pods in the `openshift-ingress-node-firewall` project.
141+
* Check the namespace of the YAML file. If the annotation is missing, you can add the annotation `workload.openshift.io/allowed=management` to the Operator namespace with the following command:
142+
+
143+
[source,terminal]
144+
----
145+
$ oc annotate ns/openshift-ingress-node-firewall workload.openshift.io/allowed=management
146+
----
147+
+
148+
[NOTE]
149+
====
150+
For {sno} clusters, the `openshift-ingress-node-firewall` namespace requires the `workload.openshift.io/allowed=management` annotation.
151+
====

0 commit comments

Comments
 (0)