Skip to content

Commit 79ca41c

Browse files
slovernslovern
authored
Merge pull request #99000 from kquinn1204/TELCODOCS-2274
Telcodocs 2274 D/S Docs: Support creating SriovNetworks in application namespace
2 parents e7bcf4c + 8e8e584 commit 79ca41c

File tree

6 files changed

+197
-2
lines changed

6 files changed

+197
-2
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1590,6 +1590,8 @@ Topics:
15901590
File: configuring-sriov-net-attach
15911591
- Name: Configuring an SR-IOV InfiniBand network attachment
15921592
File: configuring-sriov-ib-attach
1593+
- Name: Configuring SriovNetwork in application namespaces
1594+
File: configuring-namespaced-sriov-resources
15931595
- Name: Configuring an RDMA subsystem for SR-IOV
15941596
File: configuring-sriov-rdma-cni
15951597
- Name: Configuring interface-level network sysctl settings and all-multicast mode for SR-IOV networks

‎modules/nw-configuring-sriov-in-app-namespace.adoc‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/hardware_networks/configuring-sriov-device.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-configuring-sriov-in-app-namespace_{context}"]
7+
= Configuring SriovNetwork in application namespaces
8+
9+
When an SriovNetwork custom resource (CR) is deployed in an application namespace, do not define or populate the `spec.networkNamespace` field. In this scenario, the NetworkAttachmentDefinition will be created in the same namespace as the SriovNetwork CR.
10+
11+
The SR-IOV Network Operator webhook rejects the creation of an `SriovNetwork` resource in an application namespace if the `spec.networkNamespace` field is defined.
12+
13+
Follow this procedure to create an `SriovNetwork` resource in an application namespace and attach a pod to the additional network.
14+
15+
.Prerequisites
16+
17+
The following steps must be completed by a cluster administrator before an application owner can configure a namespaced SriovNetwork resource:
18+
19+
* The SR-IOV Network Operator is installed in the `openshift-sriov-network-operator` namespace.
20+
* Nodes with SR-IOV hardware are labeled for the operator to identify the nodes.
21+
22+
As an application owner you need to have administrator privileges on the application namespace.
23+
24+
.Procedure
25+
26+
. Specify the SR-IOV network device configuration for a node by creating an SR-IOV network node policy. The `SriovNetworkNodePolicy` object is created in the `openshift-sriov-network-operator` namespace to define the SR-IOV network device configuration for nodes. Example configuration for Intel DPK is as follows:
27+
+
28+
[source,yaml]
29+
----
30+
apiVersion: sriovnetwork.openshift.io/v1
31+
kind: SriovNetworkNodePolicy
32+
metadata:
33+
name: intel-dpdk-node-policy
34+
namespace: openshift-sriov-network-operator
35+
spec:
36+
resourceName: intelnics
37+
nodeSelector:
38+
feature.node.kubernetes.io/network-sriov.capable: "true"
39+
priority: 10
40+
numVfs: 4
41+
nicSelector:
42+
vendor: "8086"
43+
deviceID: "158b"
44+
pfNames: [""]
45+
deviceType: netdevice
46+
----
47+
48+
. Create an application namespace. For example, create a namespace named `sriov-app` by running the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ cat <<EOF | oc create -f -
53+
apiVersion: v1
54+
kind: Namespace
55+
metadata:
56+
name: sriov-app
57+
EOF
58+
----
59+
60+
. Create a YAML file, for example, `sriovnetwork.yaml`, to define the `SriovNetwork` object in the application namespace.
61+
+
62+
[source,yaml]
63+
----
64+
apiVersion: sriovnetwork.openshift.io/v1
65+
kind: SriovNetwork
66+
metadata:
67+
name: test-network
68+
namespace: sriov-app
69+
spec:
70+
resourceName: intelnics
71+
ipam:
72+
type: host-local
73+
subnet: "10.0.0.0/24"
74+
routes:
75+
- dst: "0.0.0.0/0"
76+
gw: "10.0.0.1"
77+
vlan: 10
78+
----
79+
* `namespace`: The value must match the name of the application namespace, for example, `sriov-app`.
80+
* `resourceName`: This value must match the `spec.resourceName` defined in the `SriovNetworkNodePolicy` created by the cluster administrator, which in the example is `intelnics`.
81+
82+
. Apply the YAML file to create the `SriovNetwork` object in the application namespace.
83+
+
84+
[source,terminal]
85+
----
86+
$ oc create -f sriovnetwork.yaml
87+
----
88+
+
89+
After an application owner has created the SriovNetwork resource, they can create a pod that uses the newly defined network. You attach a pod to the additional network by adding a specific annotation to the pod's YAML manifest.
90+
91+
. Create a YAML file, for example, `test-pod.yaml`, to define a pod that uses the new network attachment:
92+
+
93+
[source,yaml]
94+
----
95+
apiVersion: v1
96+
kind: Pod
97+
metadata:
98+
name: test-pod
99+
namespace: sriov-app
100+
annotations:
101+
k8s.v1.cni.cncf.io/networks: test-network
102+
spec:
103+
containers:
104+
- name: test-pod-container
105+
image: centos/tools
106+
command: ["/bin/bash", "-c", "sleep 3600"]
107+
----
108+
+
109+
* `namespace`: The namespace where the pod is created. This must be the same namespace where the `SriovNetwork` object is created.
110+
* `annotations`: `k8s.v1.cni.cncf.io/networks` specifies the additional network that the pod connects to. The value must match the `metadata.name` of the `SriovNetwork` object.
111+
112+
. Apply the YAML file to create the pod in the application namespace by running the following command:
113+
+
114+
[source,terminal]
115+
----
116+
$ oc create -f test-pod.yaml
117+
----
118+
119+
.Verification
120+
121+
. Verify that the NetworkAttachmentDefinition has been created in the same namespace by running the following command:
122+
+
123+
[source,terminal]
124+
----
125+
$ oc get net-attach-def -n sriov-app
126+
----
127+
+
128+
Where `sriov-app` is the application namespace where the `SriovNetwork` object is created.
129+
+
130+
.Example output
131+
+
132+
[source,terminal]
133+
----
134+
NAME AGE
135+
test-network 2m
136+
----
137+
138+
. Verify the pod is running and get its network status by describing the pod with the following command:
139+
+
140+
[source,terminal]
141+
----
142+
$ oc describe pod test-pod -n sriov-app
143+
----
144+
+
145+
Where `sriov-app` is the application namespace where the pod is created.
146+
+
147+
In the output, look for the `k8s.v1.cni.cncf.io/network-status` annotation. This shows the name of the network and the IP assigned to the pod on that interface.
148+
149+
. Check that the pod has the additional network interface by running the following command:
150+
+
151+
[source,terminal]
152+
----
153+
$ oc exec -it test-pod -n sriov-app -- ip a
154+
----
155+
+
156+
Look for a secondary network interface, for example `net1` or `eth1`, in addition to the default eth0 interface. The `net1` interface should have an IP address from the subnet you defined in the SriovNetwork object, for example `10.0.0.0/24`. This confirms the pod is using the new network attachment definition.
157+

‎modules/nw-introduction-namespaced-sriov.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/hardware_networks/configuring-namespaced-sriov-resources.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="introduction-to-namespaced-sriovnetwork-resources_{context}"]
7+
= An introduction to namespaced SriovNetwork resources
8+
9+
SR-IOV networks can be created and managed directly within application namespaces. This capability provides application owners with fine-grained control over network configurations, simplifying their workflow.
10+
11+
This approach offers several key advantages that enhance the user experience:
12+
13+
* Increased Autonomy and Control: Application owners gain direct control over their network configurations, eliminating the need for a cluster administrator to create `SriovNetwork` objects on their behalf.
14+
* Enhanced Security: By allowing users to manage resources within their own namespaces, the feature improves security and provides better separation between applications. This also helps avoid the unintentional misconfiguration of other applications' NetworkAttachmentDefinition objects.
15+
* Simplified Permissions: Managing `SriovNetwork` resources directly in their own namespaces simplifies user permissions. This streamlines the workflow and reduces the operational overhead for developers.

‎modules/nw-sriov-network-object.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ ifdef::ocp-sriov-net[]
4949
endif::ocp-sriov-net[]
5050
----
5151
<1> A name for the object. The SR-IOV Network Operator creates a `NetworkAttachmentDefinition` object with same name.
52-
<2> The namespace where the SR-IOV Network Operator is installed.
52+
<2> The namespace where the SR-IOV Network Operator is installed. You can also install the SR-IOV Network Operator in any namespace.
5353
<3> The value for the `spec.resourceName` parameter from the `SriovNetworkNodePolicy` object that defines the SR-IOV hardware for this additional network.
54-
<4> The target namespace for the `SriovNetwork` object. Only {object} in the target namespace can attach to the additional network.
54+
<4> The target namespace for the SriovNetwork object. Only pods in the target namespace can attach to the additional network. When installing the SR-IOV Network Operator in a namespace other than `openshift-sriov-network-operator`, you must not configure this field..
5555
<5> Optional: A Virtual LAN (VLAN) ID for the additional network. The integer value must be from `0` to `4095`. The default value is `0`.
5656
<6> Optional: The spoof check mode of the VF. The allowed values are the strings `"on"` and `"off"`.
5757
+

‎networking/hardware_networks/configuring-namespaced-sriov-resources.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="configuring-namespaced-sriov-resources"]
3+
= Configuring namespaced SR-IOV resources
4+
include::_attributes/common-attributes.adoc[]
5+
:context: configuring-namespaced-sriov-resources
6+
7+
toc::[]
8+
9+
[role="_abstract"]
10+
Namespaced SriovNetwork Resources allow application owners to create and manage their own SriovNetwork resources directly within their namespaces, rather than relying on a cluster administrator to do it in a shared operator namespace. This method simplifies permissions, improves security, and provides better separation between applications.
11+
12+
// An introduction to namespaced SriovNetwork resources
13+
include::modules/nw-introduction-namespaced-sriov.adoc[leveloffset=+1]
14+
15+
// Configuring SriovNetwork in application namespaces
16+
include::modules/nw-configuring-sriov-in-app-namespace.adoc[leveloffset=+2]
17+

‎networking/hardware_networks/configuring-sriov-net-attach.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ Before you perform any tasks in the following documentation, ensure that you xre
1313
// Ethernet device configuration object
1414
include::modules/nw-sriov-network-object.adoc[leveloffset=+1]
1515

16+
[role="_additional-resources"]
17+
.Additional resources
18+
xref:../../networking/hardware_networks/configuring-namespaced-sriov-resources.adoc#introduction-to-namespaced-sriovnetwork-resources_configuring-namespaced-sriov-resources[Configuring namespaced SR-IOV resources]
19+
1620
// Creating a configuration for assignment of dual-stack IP addresses dynamically
1721
include::modules/nw-multus-configure-dualstack-ip-address.adoc[leveloffset=+2]
1822

0 commit comments

Comments
 (0)