Skip to content

Commit ff39530

Browse files
JoeAldingerJoeAldinger
authored
Merge pull request #88312 from JoeAldinger/OCPBUGS-42556
OCPBUGS-42556:backport of CNO changes in 4.14+
2 parents 5e0b9f7 + bb01f93 commit ff39530

File tree

5 files changed

+221
-7
lines changed

5 files changed

+221
-7
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1452,6 +1452,8 @@ Topics:
14521452
File: rollback-to-openshift-sdn
14531453
- Name: Converting to IPv4/IPv6 dual stack networking
14541454
File: converting-to-dual-stack
1455+
- Name: Configuring internal subnets
1456+
File: configure-ovn-kubernetes-subnets
14551457
- Name: Logging for egress firewall and network policy rules
14561458
File: logging-network-policy
14571459
- Name: Configuring IPsec encryption

‎modules/nw-operator-cr.adoc

Lines changed: 79 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,14 @@ ifdef::operator[]
259259
An object describing the IPsec mode for the cluster.
260260
endif::operator[]
261261

262+
|`ipv4`
263+
|`object`
264+
|Specifies a configuration object for IPv4 settings.
265+
266+
|`ipv6`
267+
|`object`
268+
|Specifies a configuration object for IPv6 settings.
269+
262270
|`policyAuditConfig`
263271
|`object`
264272
|Specify a configuration object for customizing network policy audit logging. If unset, the defaults audit log settings are used.
@@ -272,19 +280,50 @@ endif::operator[]
272280
While migrating egress traffic, you can expect some disruption to workloads and service traffic until the Cluster Network Operator (CNO) successfully rolls out the changes.
273281
====
274282

275-
|`v4InternalSubnet`
283+
|`v6InternalSubnet`
284+
|
285+
|====
286+
287+
.`ovnKubernetesConfig.ipv4` object
288+
[cols=".^2,.^2,.^6a",options="header"]
289+
|====
290+
|Field|Type|Description
291+
292+
|`internalTransitSwitchSubnet`
293+
|string
294+
|
295+
If your existing network infrastructure overlaps with the `100.88.0.0/16` IPv4 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. The subnet for the distributed transit switch that enables east-west traffic. This subnet cannot overlap with any other subnets used by OVN-Kubernetes or on the host itself. It must be large enough to accommodate one IP address per node in your cluster.
296+
297+
The default value is `100.88.0.0/16`.
298+
299+
|`internalJoinSubnet`
300+
|string
276301
|
277302
If your existing network infrastructure overlaps with the `100.64.0.0/16` IPv4 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster. For example, if the `clusterNetwork.cidr` value is `10.128.0.0/14` and the `clusterNetwork.hostPrefix` value is `/23`, then the maximum number of nodes is `2^(23-14)=512`.
278303

279-
This field cannot be changed after installation.
280-
|The default value is `100.64.0.0/16`.
304+
The default value is `100.64.0.0/16`.
281305

282-
|`v6InternalSubnet`
306+
|====
307+
308+
.`ovnKubernetesConfig.ipv6` object
309+
[cols=".^2,.^2,.^6a",options="header"]
310+
|====
311+
|Field|Type|Description
312+
313+
|`internalTransitSwitchSubnet`
314+
|string
283315
|
284316
If your existing network infrastructure overlaps with the `fd98::/48` IPv6 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster.
285317

286-
This field cannot be changed after installation.
287-
| The default value is `fd98::/48`.
318+
This field cannot be changed after installation. The default value is `fd98::/48`.
319+
320+
|`internalJoinSubnet`
321+
|string
322+
|
323+
If your existing network infrastructure overlaps with the `fd98::/64` IPv6 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster.
324+
325+
The default value is `fd98::/64`.
326+
288327
|====
289328

290329
// tag::policy-audit[]
@@ -342,6 +381,40 @@ If you set this field to `true`, you do not receive the performance benefits of
342381
|`object`
343382
|You can control IP forwarding for all traffic on OVN-Kubernetes managed interfaces by using the `ipForwarding` specification in the `Network` resource. Specify `Restricted` to only allow IP forwarding for Kubernetes related traffic. Specify `Global` to allow forwarding of all IP traffic. For new installations, the default is `Restricted`. For updates to {product-title} 4.14 or later, the default is `Global`.
344383

384+
|`ipv4`
385+
|`object`
386+
|Optional: Specify an object to configure the internal OVN-Kubernetes masquerade address for host to service traffic for IPv4 addresses.
387+
388+
|`ipv6`
389+
|`object`
390+
|Optional: Specify an object to configure the internal OVN-Kubernetes masquerade address for host to service traffic for IPv6 addresses.
391+
392+
|====
393+
394+
[id="gatewayconfig-ipv4-object_{context}"]
395+
.`gatewayConfig.ipv4` object
396+
[cols=".^2,.^2,.^6a",options="header"]
397+
|====
398+
|Field|Type|Description
399+
400+
|`internalMasqueradeSubnet`
401+
|`string`
402+
|
403+
The masquerade IPv4 addresses that are used internally to enable host to service traffic. The host is configured with these IP addresses as well as the shared gateway bridge interface. The default value is `169.254.169.0/29`.
404+
405+
|====
406+
407+
[id="gatewayconfig-ipv6-object_{context}"]
408+
.`gatewayConfig.ipv6` object
409+
[cols=".^2,.^2,.^6a",options="header"]
410+
|====
411+
|Field|Type|Description
412+
413+
|`internalMasqueradeSubnet`
414+
|`string`
415+
|
416+
The masquerade IPv6 addresses that are used internally to enable host to service traffic. The host is configured with these IP addresses as well as the shared gateway bridge interface. The default value is `fd69::/125`.
417+
345418
|====
346419

347420
[id="nw-operator-cr-ipsec_{context}"]
@@ -362,7 +435,6 @@ a|Specifies the behavior of the IPsec implementation. Must be one of the followi
362435

363436
|====
364437

365-
366438
ifdef::operator[]
367439
[NOTE]
368440
====

‎modules/nw-ovn-kubernetes-change-join-subnet.adoc

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configure-ovn-kubernetes-subnets.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ovn-kubernetes-change-join-subnet_{context}"]
7+
= Configuring the OVN-Kubernetes join subnet
8+
9+
You can change the join subnet used by OVN-Kubernetes to avoid conflicting with any existing subnets already in use in your environment.
10+
11+
.Prerequisites
12+
13+
* Install the OpenShift CLI (`oc`).
14+
* Log in to the cluster with a user with `cluster-admin` privileges.
15+
* Ensure that the cluster uses the OVN-Kubernetes network plugin.
16+
17+
.Procedure
18+
19+
. To change the OVN-Kubernetes join subnet, enter the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc patch network.operator.openshift.io cluster --type='merge' \
24+
-p='{"spec":{"defaultNetwork":{"ovnKubernetesConfig":
25+
{"ipv4":{"internalJoinSubnet": "<join_subnet>"},
26+
"ipv6":{"internalJoinSubnet": "<join_subnet>"}}}}}'
27+
----
28+
+
29+
--
30+
where:
31+
32+
`<join_subnet>`:: Specifies an IP address subnet for internal use by OVN-Kubernetes. The subnet must be larger than the number of nodes in the cluster and it must be large enough to accommodate one IP address per node in the cluster. This subnet cannot overlap with any other subnets used by {product-title} or on the host itself. The default value for IPv4 is `100.64.0.0/16` and the default value for IPv6 is `fd98::/64`.
33+
--
34+
+
35+
.Example output
36+
[source,text]
37+
----
38+
network.operator.openshift.io/cluster patched
39+
----
40+
41+
.Verification
42+
43+
* To confirm that the configuration is active, enter the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc get network.operator.openshift.io \
48+
-o jsonpath="{.items[0].spec.defaultNetwork}"
49+
----
50+
+
51+
It can take up to 30 minutes for this change to take effect.
52+
+
53+
.Example output
54+
----
55+
{
56+
"ovnKubernetesConfig": {
57+
"ipv4": {
58+
"internalJoinSubnet": "100.64.1.0/16"
59+
},
60+
},
61+
"type": "OVNKubernetes"
62+
}
63+
----

‎modules/nw-ovn-kubernetes-change-transit-subnet.adoc

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configure-ovn-kubernetes-subnets.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ovn-kubernetes-change-transit-subnet_{context}"]
7+
= Configuring the OVN-Kubernetes transit subnet
8+
9+
You can change the transit subnet used by OVN-Kubernetes to avoid conflicting with any existing subnets already in use in your environment.
10+
11+
.Prerequisites
12+
13+
* Install the OpenShift CLI (`oc`).
14+
* Log in to the cluster with a user with `cluster-admin` privileges.
15+
* Ensure that the cluster uses the OVN-Kubernetes network plugin.
16+
17+
.Procedure
18+
19+
. To change the OVN-Kubernetes transit subnet, enter the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc patch network.operator.openshift.io cluster --type='merge' \
24+
-p='{"spec":{"defaultNetwork":{"ovnKubernetesConfig":
25+
{"ipv4":{"internalTransitSwitchSubnet": "<transit_subnet>"},
26+
"ipv6":{"internalTransitSwitchSubnet": "<transit_subnet>"}}}}}'
27+
----
28+
+
29+
--
30+
where:
31+
32+
`<transit_subnet>`:: Specifies an IP address subnet for the distributed transit switch that enables east-west traffic. This subnet cannot overlap with any other subnets used by OVN-Kubernetes or on the host itself. The default value for IPv4 is `100.88.0.0/16` and the default value for IPv6 is `fd97::/64`.
33+
--
34+
+
35+
.Example output
36+
[source,text]
37+
----
38+
network.operator.openshift.io/cluster patched
39+
----
40+
41+
.Verification
42+
43+
* To confirm that the configuration is active, enter the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc get network.operator.openshift.io \
48+
-o jsonpath="{.items[0].spec.defaultNetwork}"
49+
----
50+
+
51+
It can take up to 30 minutes for this change to take effect.
52+
+
53+
.Example output
54+
----
55+
{
56+
"ovnKubernetesConfig": {
57+
"ipv4": {
58+
"internalTransitSwitchSubnet": "100.88.1.0/16"
59+
},
60+
},
61+
"type": "OVNKubernetes"
62+
}
63+
----

‎networking/ovn_kubernetes_network_provider/configure-ovn-kubernetes-subnets.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="configure-ovn-kubernetes-subnets"]
3+
= Configuring OVN-Kubernetes internal IP address subnets
4+
include::_attributes/common-attributes.adoc[]
5+
:context: configure-ovn-kubernetes-subnets
6+
7+
toc::[]
8+
9+
[role="_abstract"]
10+
As a cluster administrator, you can change the IP address ranges that the OVN-Kubernetes network plugin uses for the join and transit subnets.
11+
12+
include::modules/nw-ovn-kubernetes-change-join-subnet.adoc[leveloffset=+1]
13+
14+
include::modules/nw-ovn-kubernetes-change-transit-subnet.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)