Skip to content

Commit b778196

Browse files
ShaunaDiazShaunaDiaz
authored
Merge pull request #101707 from ShaunaDiaz/OSDOCS-15649
OSDOCS-15649: modularizes CNI assembly MicroShift
2 parents a72a81a + 1052a78 commit b778196

10 files changed

+141
-63
lines changed

‎microshift_networking/microshift-cni.adoc‎

Lines changed: 7 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -6,62 +6,24 @@ include::_attributes/attributes-microshift.adoc[]
66

77
toc::[]
88

9-
The OVN-Kubernetes Container Network Interface (CNI) plugin is the default networking solution for a {microshift-short} node. OVN-Kubernetes is a virtualized network for pods and services that is based on Open Virtual Network (OVN).
9+
[role="_abstract"]
10+
You can use the OVN-Kubernetes Network Interface to create and manage network connections for internet-connected nodes.
1011

11-
* Default network configuration and connections are applied automatically in {microshift-short} with the `microshift-networking` RPM during installation.
12-
* A node that uses the OVN-Kubernetes network plugin also runs Open vSwitch (OVS) on the node.
13-
* OVN-K configures OVS on the node to implement the declared network configuration.
14-
* Host physical interfaces are not bound by default to the OVN-K gateway bridge, `br-ex`. You can use standard tools on the host for managing the default gateway, such as the Network Manager CLI (`nmcli`).
15-
* Changing the CNI is not supported on {microshift-short}.
16-
17-
Using configuration files or custom scripts, you can configure the following networking settings:
18-
19-
* You can use subnet CIDR ranges to allocate IP addresses to pods.
20-
* You can change the maximum transmission unit (MTU) value.
21-
* You can configure firewall ingress and egress.
22-
* You can define network policies in the {microshift-short}, including ingress and egress rules.
23-
* You can use the {microshift-short} Multus plugin to chain other CNI plugins.
24-
* You can configure or remove the ingress router.
12+
include::modules/microshift-default-networking-plugin.adoc[leveloffset=+1]
2513

2614
include::modules/microshift-cni-customization-matrix.adoc[leveloffset=+1]
2715

2816
include::modules/microshift-default-settings.adoc[leveloffset=+2]
2917

30-
[id="microshift-network-features_{context}"]
31-
== Network features
32-
Networking features available with {microshift-short} {product-version} include:
33-
34-
* Kubernetes network policy
35-
* Dynamic node IP
36-
* Custom gateway interface
37-
* Second gateway interface
38-
* Node network on specified host interface
39-
* Blocking external access to NodePort service on specific host interfaces
40-
41-
Networking features not available with {microshift-short} {product-version}:
42-
43-
* Egress IP/firewall/QoS: disabled
44-
* Hybrid networking: not supported
45-
* IPsec: not supported
46-
* Hardware offload: not supported
47-
48-
[id="microshift-ip-forward_{context}"]
49-
== IP forward
50-
The host network `sysctl net.ipv4.ip_forward` kernel parameter is automatically enabled by the `ovnkube-master` container when started. This is required to forward incoming traffic to the CNI. For example, accessing the NodePort service from outside of a node fails if `ip_forward` is disabled.
18+
include::modules/microshift-network-features.adoc[leveloffset=+1]
5119

52-
[id="microshift-network-performance_{context}"]
53-
== Network performance optimizations
54-
By default, three performance optimizations are applied to OVS services to minimize resource consumption:
20+
include::modules/microshift-ip-forward.adoc[leveloffset=+2]
5521

56-
* CPU affinity to `ovs-vswitchd.service` and `ovsdb-server.service`
57-
* `no-mlockall` to `openvswitch.service`
58-
* Limit handler and `revalidator` threads to `ovs-vswitchd.service`
22+
include::modules/microshift-network-performance.adoc[leveloffset=+1]
5923

6024
include::modules/microshift-nw-components-svcs.adoc[leveloffset=+1]
6125

62-
[id="microshift-bridge-mapping_{context}"]
63-
== Bridge mappings
64-
Bridge mappings allow provider network traffic to reach the physical network. Traffic leaves the provider network and arrives at the `br-int` bridge. A patch port between `br-int` and `br-ex` then allows the traffic to traverse to and from the provider network and the edge network. Kubernetes pods are connected to the `br-int` bridge through virtual ethernet pair: one end of the virtual ethernet pair is attached to the pod namespace, and the other end is attached to the `br-int` bridge.
26+
include::modules/microshift-bridge-mappings.adoc[leveloffset=+1]
6527

6628
include::modules/microshift-nw-topology.adoc[leveloffset=+1]
6729

‎modules/microshift-bridge-mappings.adoc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-cni.adoc.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="microshift-bridge-mappings_{context}"]
7+
= Bridge mappings
8+
9+
[role="_abstract"]
10+
Understand how provider network traffic reaches the physical network through bridge mappings. The following concepts apply:
11+
12+
* Traffic leaves the provider network and arrives at the `br-int` bridge.
13+
* A patch port between `br-int` and `br-ex` then allows the traffic to traverse to and from the provider network and the edge network.
14+
* Kubernetes pods are connected to the `br-int` bridge through a virtual ethernet pair. One end of the virtual ethernet pair is attached to the pod namespace, and the other end is attached to the `br-int` bridge.

‎modules/microshift-cni-customization-matrix.adoc‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,30 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-cni.adoc.adoc
14

25
:_mod-docs-content-type: REFERENCE
36
[id="microshift-nw-customization-matrix_{context}"]
47
= {microshift-short} networking configuration matrix
58

9+
[role="_abstract"]
610
The following table summarizes the status of networking features and capabilities that are either present as defaults, supported for configuration, or not available with the {microshift-short} service:
711

812
.{microshift-short} networking features and capabilities overview
913
[cols="50%,20%,30%",options="header"]
1014
|===
1115
|Network capability|Availability|Configuration supported
1216

13-
|Advertise address|Yes|Yes ^[1]^
17+
|Advertise address|Yes|Yes
1418

1519
|Kubernetes network policy|Yes|Yes
1620

1721
|Kubernetes network policy logs|Not available|N/A
1822

1923
|Load balancing|Yes|Yes
2024

21-
|Multicast DNS|Yes|Yes ^[2]^
25+
|Multicast DNS|Yes|Yes
2226

23-
|Network proxies|Yes ^[3]^|CRI-O
27+
|Network proxies|Yes|CRI-O
2428

2529
|Network performance|Yes|MTU configuration
2630

@@ -30,24 +34,31 @@ The following table summarizes the status of networking features and capabilitie
3034

3135
|Egress router|Not available|N/A
3236

33-
|Firewall|No ^[4]^|Yes
37+
|Firewall|No|Yes
3438

3539
|Hardware offloading|Not available|N/A
3640

3741
|Hybrid networking|Not available|N/A
3842

3943
|IPsec encryption for intra-cluster communication|Not available|N/A
4044

41-
|IPv6|Supported ^[5]^|N/A
45+
|IPv6|Supported|N/A
4246

43-
|Ingress router|Yes|Yes ^[6]^
47+
|Ingress router|Yes|Yes
4448

45-
|Multiple networks plug-in|Yes|Yes
49+
|Multiple networks plugin|Yes|Yes
4650
|===
4751

48-
1. If unset, the default value is set to the next immediate subnet after the service network. For example, when the service network is `10.43.0.0/16`, the `advertiseAddress` is set to `10.44.0.0/32`.
49-
2. You can use the multicast DNS protocol (mDNS) to allow name resolution and service discovery within a Local Area Network (LAN) using multicast exposed on the `5353/UDP` port.
50-
3. There is no built-in transparent proxying of egress traffic in {microshift-short}. Egress must be manually configured.
51-
4. Setting up the firewalld service is supported by {op-system-ostree}.
52-
5. IPv6 is supported in both single-stack and dual-stack networks with the OVN-Kubernetes network plugin. IPv6 can also be used by connecting to other networks with the {microshift-short} Multus CNI plugin.
53-
6. Configure by using the {microshift-short} `config.yaml` file.
52+
Additional details about networking capabilities::
53+
54+
* `Advertise address`: If unset, the default value is set to the next immediate subnet after the service network. For example, when the service network is `10.43.0.0/16`, the `advertiseAddress` is set to `10.44.0.0/32`.
55+
56+
* `Multicast DNS`: You can use the multicast DNS protocol (mDNS) to allow name resolution and service discovery within a Local Area Network (LAN) using multicast exposed on the `5353/UDP` port.
57+
58+
* `Network proxies`: There is no built-in transparent proxying of egress traffic in {microshift-short}. Egress must be manually configured.
59+
60+
* `Firewall`: Setting up the firewalld service is supported by {op-system-ostree}.
61+
62+
* `IPv6`: Is supported in both single-stack and dual-stack networks with the OVN-Kubernetes network plugin. You can also use IPv6 by connecting to other networks with the {microshift-short} Multus CNI plugin.
63+
64+
* `Ingress router`: Configure by using the {microshift-short} `config.yaml` file.

‎modules/microshift-default-networking-plugin.adoc‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-cni.adoc.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="microshift-default-networking-plugin_{context}"]
7+
= {microshift-short} default networking plugin
8+
9+
[role="_abstract"]
10+
The OVN-Kubernetes Container Network Interface (CNI) plugin is the default networking solution for a {microshift-short} node. OVN-Kubernetes is a virtualized network for pods and services that is based on Open Virtual Network (OVN).
11+
12+
* Changing the CNI is not supported on {microshift-short}.
13+
* Default network configuration and connections are applied automatically in {microshift-short} with the `microshift-networking` RPM during installation.
14+
* A node that uses the OVN-Kubernetes network plugin also runs Open vSwitch (OVS) on the node.
15+
* OVN-K configures OVS on the node to implement the declared network configuration.
16+
* Host physical interfaces are not bound by default to the OVN-K gateway bridge, `br-ex`. You can use standard tools on the host for managing the default gateway, such as the Network Manager CLI (`nmcli`).
17+
18+
Using configuration files or custom scripts, you can configure the following networking settings:
19+
20+
* You can use subnet CIDR ranges to allocate IP addresses to pods.
21+
* You can change the maximum transmission unit (MTU) value.
22+
* You can configure firewall ingress and egress.
23+
* You can define network policies in the {microshift-short}, including ingress and egress rules.
24+
* You can use the {microshift-short} Multus plugin to chain other CNI plugins.
25+
* You can configure or remove the ingress router.

‎modules/microshift-default-settings.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
// Module included in the following assemblies:
22
//
33
// * microshift_configuring/microshift-default-config-yaml.adoc
4+
// * microshift_networking/microshift-cni.adoc.adoc
45

56
:_mod-docs-content-type: CONCEPT
67
[id="microshift-yaml-default_{context}"]

‎modules/microshift-ip-forward.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-cni.adoc.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="microshift-ip-forward_{context}"]
7+
= IP forward
8+
9+
[role="_abstract"]
10+
You must use `ip_forward` to access network connectivity.
11+
12+
The host network `sysctl net.ipv4.ip_forward` kernel parameter is automatically enabled by the `ovnkube-master` container when started. This is required to forward incoming traffic to the CNI. For example, accessing the NodePort service from outside of a node fails if `ip_forward` is disabled.

‎modules/microshift-network-features.adoc‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-cni.adoc.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="microshift-network-features_{context}"]
7+
= Network features
8+
9+
[role="_abstract"]
10+
Understand which networking feature are available and which are not for your {microshift-short} deployments.
11+
12+
Networking features available with {microshift-short} {product-version} include:
13+
14+
* Kubernetes network policy
15+
* Dynamic node IP
16+
* Custom gateway interface
17+
* Second gateway interface
18+
* Node network on specified host interface
19+
* Blocking external access to NodePort service on specific host interfaces
20+
21+
Networking features not available with {microshift-short} {product-version}:
22+
23+
* Egress IP/firewall/QoS: disabled
24+
* Hybrid networking: not supported
25+
* IPsec: not supported
26+
* Hardware offload: not supported

‎modules/microshift-network-performance.adoc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-cni.adoc.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="microshift-network-performance_{context}"]
7+
= Network performance optimizations
8+
9+
[role="_abstract"]
10+
By default, three performance optimizations are applied to OVS services to minimize resource consumption:
11+
12+
* CPU affinity to `ovs-vswitchd.service` and `ovsdb-server.service`
13+
* `no-mlockall` to `openvswitch.service`
14+
* Limit handler and `revalidator` threads to `ovs-vswitchd.service`

‎modules/microshift-nw-components-svcs.adoc‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,16 @@
33
// * microshift_networking/microshift-cni.adoc
44

55
:_mod-docs-content-type: CONCEPT
6-
[id="microshift-network-comps-svcs_{context}"]
6+
[id="microshift-nw-components-svcs_{context}"]
77
= {microshift-short} networking components and services
8-
This brief overview describes networking components and their operation in {microshift-short}. The `microshift-networking` RPM is a package that automatically pulls in any networking-related dependencies and systemd services to initialize networking, for example, the `microshift-ovs-init` systemd service.
8+
9+
[role="_abstract"]
10+
Understand networking components and services and their operation in {microshift-short}.
11+
12+
[NOTE]
13+
====
14+
The `microshift-networking` RPM is a package that automatically pulls in any networking-related dependencies and systemd services to initialize networking, for example, the `microshift-ovs-init` systemd service.
15+
====
916

1017
NetworkManager::
1118
NetworkManager is required to set up the initial gateway bridge on the {microshift-short} node. The NetworkManager and `NetworkManager-ovs` RPM packages are installed as dependencies to the `microshift-networking` RPM package, which contains the necessary configuration files. NetworkManager in {microshift-short} uses the `keyfile` plugin and is restarted after installation of the `microshift-networking` RPM package.
@@ -32,4 +39,4 @@ OVN-Kubernetes manifests and startup logic are built into {microshift-short}. Th
3239
* `/etc/systemd/system/ovsdb-server.service.d/microshift-cpuaffinity.conf` for `ovs-server.service`
3340
* `/usr/bin/configure-ovs-microshift.sh` for `microshift-ovs-init.service`
3441
* `/usr/bin/configure-ovs.sh` for `microshift-ovs-init.service`
35-
* `/etc/crio/crio.conf.d/microshift-ovn.conf` for the CRI-O service
42+
* `/etc/crio/crio.conf.d/microshift-ovn.conf` for the CRI-O service

‎modules/microshift-nw-topology.adoc‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,11 @@
55
:_mod-docs-content-type: CONCEPT
66
[id="microshift-network-topology_{context}"]
77
= Network topology
8-
OVN-Kubernetes provides an overlay-based networking implementation. This overlay includes an OVS-based implementation of Service and NetworkPolicy. The overlay network uses the Geneve (Generic Network Virtualization Encapsulation) tunnel protocol. The pod maximum transmission unit (MTU) for the Geneve tunnel is set to the default route MTU if it is not configured.
8+
9+
[role="_abstract"]
10+
OVN-Kubernetes provides an overlay-based networking implementation. This overlay includes an OVS-based implementation of `Service` and `NetworkPolicy` resources.
11+
12+
The overlay network uses the Geneve (Generic Network Virtualization Encapsulation) tunnel protocol. The pod maximum transmission unit (MTU) for the Geneve tunnel is set to the default route MTU if it is not configured.
913

1014
To configure the MTU, you must set an equal-to or less-than value than the MTU of the physical interface on the host. A less-than value for the MTU makes room for the required information that is added to the tunnel header before it is transmitted.
1115

@@ -14,13 +18,14 @@ To configure the MTU, you must set an equal-to or less-than value than the MTU o
1418
The MTU value of the OVN overlay networking in {microshift-short} must be 100 bytes smaller than the MTU value of the base network. If no MTU value is configured, {microshift-short} autoconfigures the value using the MTU value of the default gateway (Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6)) of the host. If the auto-configuration does not work correctly, the MTU value can be configured manually. For example, if the MTU value of the network is `9000`, the OVN MTU size must be set to `8900`.
1519
====
1620

17-
OVS runs as a systemd service on the {microshift-short} node. The OVS RPM package is installed as a dependency to the `microshift-networking` RPM package. OVS is started immediately when the `microshift-networking` RPM is installed.
21+
OVS runs as a systemd service on the {microshift-short} node. The OVS RPM package is installed as a dependency to the `microshift-networking` RPM package. OVS starts immediately when the `microshift-networking` RPM is installed.
1822

1923
.{product-title} network topology
2024
image:317_RHbM_OVN_topology_0923.png[title="{microshift-short} uses an overlay-based networking implementation, details follow."]
2125

2226
[id="microshift-description-ovn-logical-components_{context}"]
2327
== Description of the OVN logical components of the virtualized network
28+
2429
OVN node switch::
2530
A virtual switch named `<node-name>`. The OVN node switch is named according to the hostname of the node.
2631
** In this example, the `node-name` is `microshift-dev`.
@@ -40,6 +45,7 @@ A virtual switch named `ext_<node-name>.`
4045

4146
[id="microshift-description-connections-network-topology_{context}"]
4247
== Description of the connections in the network topology figure
48+
4349
* The north-south traffic between the network service and the OVN external switch `ext_microshift-dev` is provided through the host kernel by the gateway bridge `br-ex`.
4450
* The OVN gateway router `GR_microshift-dev` is connected to the external network switch `ext_microshift-dev` through the logical router port 4. Port 4 is attached with the node IP address 192.168.122.14.
4551
* The join switch `join` connects the OVN gateway router `GR_microshift-dev` to the OVN cluster router `ovn_cluster_router`. The IP address range is 100.62.0.0/16.

0 commit comments

Comments
 (0)