Skip to content

Commit 5abbd3f

Browse files
ShaunaDiazShaunaDiaz
committed
OSDOCS-10711: add NW changes MicroShift
1 parent 074f127 commit 5abbd3f

6 files changed

+34
-29
lines changed

‎microshift_networking/microshift-cni.adoc‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ Using configuration files or custom scripts, you can configure the following net
2020
* You can change the maximum transmission unit (MTU) value.
2121
* You can configure firewall ingress and egress.
2222
* You can define network policies in the {microshift-short} cluster, including ingress and egress rules.
23+
* You can use the {microshift-short} Multus plug-in to chain other CNI plugins.
24+
* You can configure or remove the ingress router.
2325
2426
include::modules/microshift-cni-customization-matrix.adoc[leveloffset=+1]
2527

@@ -43,14 +45,6 @@ Networking features not available with {microshift-short} {product-version}:
4345
* IPsec: not supported
4446
* Hardware offload: not supported
4547

46-
[id="_additional-resources_microshift-cni_{context}"]
47-
[role="_additional-resources"]
48-
.Additional resources
49-
50-
* xref:../microshift_configuring/microshift-using-config-tools.adoc#microshift-using-config-tools_microshift-config-yaml[Using a YAML configuration file]
51-
52-
* xref:../microshift_networking/microshift-networking-settings.adoc#microshift-config-OVN-K_microshift-networking[Understanding networking settings]
53-
5448
[id="microshift-ip-forward_{context}"]
5549
== IP forward
5650
The host network `sysctl net.ipv4.ip_forward` kernel parameter is automatically enabled by the `ovnkube-master` container when started. This is required to forward incoming traffic to the CNI. For example, accessing the NodePort service from outside of a cluster fails if `ip_forward` is disabled.
@@ -70,3 +64,11 @@ include::modules/microshift-nw-components-svcs.adoc[leveloffset=+1]
7064
Bridge mappings allow provider network traffic to reach the physical network. Traffic leaves the provider network and arrives at the `br-int` bridge. A patch port between `br-int` and `br-ex` then allows the traffic to traverse to and from the provider network and the edge network. Kubernetes pods are connected to the `br-int` bridge through virtual ethernet pair: one end of the virtual ethernet pair is attached to the pod namespace, and the other end is attached to the `br-int` bridge.
7165

7266
include::modules/microshift-nw-topology.adoc[leveloffset=+1]
67+
68+
[id="_additional-resources_microshift-cni_{context}"]
69+
== Additional resources
70+
71+
* xref:../microshift_configuring/microshift-using-config-tools.adoc#microshift-config-yaml_microshift-configuring[Using a YAML configuration file]
72+
* xref:../microshift_networking/microshift-networking-settings.adoc#microshift-understanding-networking-settings[Understanding networking settings]
73+
* xref:../microshift_networking/microshift_multiple_networks/microshift-cni-multus.adoc#microshift-cni-multus[About using multiple networks]
74+
* xref:../microshift_networking/microshift_network_policy/microshift-network-policy-index.adoc#microshift-network-policies[About network policies]

‎microshift_networking/microshift-networking-settings.adoc‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,6 @@ Cluster Administrators have several options for exposing applications that run i
1616
1717
By default, Kubernetes allocates each pod an internal IP address for applications running within the pod. Pods and their containers can have traffic between them, but clients outside the cluster do not have direct network access to pods except when exposed with a service such as NodePort.
1818

19-
[NOTE]
20-
====
21-
To troubleshoot connection problems with the NodePort service, read about the known issue in the Release Notes.
22-
====
23-
2419
include::modules/microshift-configuring-ovn.adoc[leveloffset=+1]
2520

2621
include::modules/microshift-restart-ovnkube-master.adoc[leveloffset=+1]
@@ -39,10 +34,13 @@ include::modules/microshift-blocking-nodeport-access.adoc[leveloffset=+1]
3934

4035
include::modules/microshift-mDNS.adoc[leveloffset=+1]
4136

42-
include::modules/microshift-exposed-audit-ports.adoc[leveloffset=+1]
37+
[id="microshift-exposed-audit-ports_{context}"]
38+
== Auditing exposed network ports
39+
40+
On {microshift-short}, the host port can be opened by a workload in the following cases. You can check logs to view the network services.
4341

44-
include::modules/microshift-exposed-audit-ports-hostnetwork.adoc[leveloffset=+1]
42+
include::modules/microshift-exposed-audit-ports-hostnetwork.adoc[leveloffset=+2]
4543

46-
include::modules/microshift-exposed-audit-ports-hostport.adoc[leveloffset=+1]
44+
include::modules/microshift-exposed-audit-ports-hostport.adoc[leveloffset=+2]
4745

48-
include::modules/microshift-exposed-audit-ports-loadbalancer.adoc[leveloffset=+1]
46+
include::modules/microshift-exposed-audit-ports-loadbalancer.adoc[leveloffset=+2]

‎modules/microshift-cni-customization-matrix.adoc‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11

22
:_mod-docs-content-type: REFERENCE
33
[id="microshift-nw-customization-matrix_{context}"]
4-
= {microshift-short} networking customization matrix
4+
= {microshift-short} networking configuration matrix
55

66
The following table summarizes the status of networking features and capabilities that are either present as defaults, supported for configuration, or not available with the {microshift-short} service:
77

8-
.{microshift-short} networking capabilities and customization status
8+
.{microshift-short} networking features and capabilities overview
99
[cols="50%,20%,30%",options="header"]
1010
|===
11-
|Network feature|Availability|Customization supported
11+
|Network capability|Availability|Configuration supported
1212

1313
|Advertise address|Yes|Yes ^[1]^
1414

@@ -39,10 +39,15 @@ The following table summarizes the status of networking features and capabilitie
3939
|IPsec encryption for intra-cluster communication|Not available|N/A
4040

4141
|IPv6|Not available ^[5]^|N/A
42+
43+
|Ingress router|Yes|Yes ^[6]^
44+
45+
|Multiple networks plug-in|Yes|Yes
4246
|===
4347

4448
1. If unset, the default value is set to the next immediate subnet after the service network. For example, when the service network is `10.43.0.0/16`, the `advertiseAddress` is set to `10.44.0.0/32`.
4549
2. You can use the multicast DNS protocol (mDNS) to allow name resolution and service discovery within a Local Area Network (LAN) using multicast exposed on the `5353/UDP` port.
4650
3. There is no built-in transparent proxying of egress traffic in {microshift-short}. Egress must be manually configured.
4751
4. Setting up the firewalld service is supported by {op-system-ostree}.
48-
5. IPv6 is not available in any configuration.
52+
5. IPv6 is not supported. IPv6 can only be used by connecting to other networks with the {microshift-short} Multus CNI plugin.
53+
6. Configure by using the {microshift-short} `config.yaml` file.

‎modules/microshift-exposed-audit-ports-hostnetwork.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@
55
:_mod-docs-content-type: PROCEDURE
66
[id="microshift-exposed-audit-ports-hostnetwork_{context}"]
77

8-
== hostNetwork
8+
= hostNetwork
99

1010
When a pod is configured with the `hostNetwork:true` setting, the pod is running in the host network namespace. This configuration can independently open host ports. {microshift-short} component logs cannot be used to track this case, the ports are subject to firewalld rules. If the port opens in firewalld, you can view the port opening in the firewalld debug log.
1111

12-
.Prerequisites
12+
.Prerequisites
1313

1414
* You have root user access to your build host.
1515

‎modules/microshift-exposed-audit-ports-hostport.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="microshift-exposed-audit-ports-hostport_{context}"]
7-
== hostPort
7+
= hostPort
88

99
You can access the hostPort setting logs in {microshift-short}. The following logs are examples for the hostPort setting:
1010

1111
.Procedure
1212

13-
* You can access the logs by running the following command:
13+
* You can access the logs by running the following command:
1414
+
1515
[source,terminal]
1616
----

‎modules/microshift-exposed-audit-ports-loadbalancer.adoc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
//
33
// * microshift_networking/microshift-networking-settings.adoc
44

5-
:_mod-docs-content-type: PROCEDURE
5+
:_mod-docs-content-type: PROCEDURE
66
[id="microshift-exposed-audit-ports-loadbalancer_{context}"]
77

8-
== NodePort and LoadBalancer service
8+
= NodePort and LoadBalancer services
99

1010
OVN-Kubernetes opens host ports for `NodePort` and `LoadBalancer` service types. These services add iptables rules that take the ingress traffic from the host port and forwards it to the clusterIP. Logs for the `NodePort` and `LoadBalancer` services are presented in the following examples:
1111

12-
.Procedure
12+
.Procedure
1313

14-
. To access the name of your `ovnkube-master` pods, run the following command:
14+
. To access the name of your `ovnkube-master` pods, run the following command:
1515
+
1616
[source,terminal]
1717
----

0 commit comments

Comments
 (0)