Skip to content

Commit 43e001d

Browse files
jab-rhjab-rh
committed
OSDOCS-4969: Support changing internal OVN-Kubernetes range
This documents additional configuration fields for changing the internal IP address range used by OVN-Kubernetes for host to service traffic. This can be used to avoid collisions with existing IP address ranges. - https://issues.redhat.com/browse/OSDOCS-4969
1 parent 14ea14e commit 43e001d

File tree

5 files changed

+221
-8
lines changed

5 files changed

+221
-8
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1485,6 +1485,8 @@ Topics:
14851485
File: rollback-to-openshift-sdn
14861486
- Name: Converting to IPv4/IPv6 dual stack networking
14871487
File: converting-to-dual-stack
1488+
- Name: Configuring internal subnets
1489+
File: configure-ovn-kubernetes-subnets
14881490
- Name: Configure an external gateway on the default network
14891491
File: configuring-secondary-external-gateway
14901492
- Name: Configuring an egress IP address

‎modules/nw-operator-cr.adoc

Lines changed: 80 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,14 @@ ifdef::operator[]
254254
An object describing the IPsec mode for the cluster.
255255
endif::operator[]
256256

257+
|`ipv4`
258+
|`object`
259+
|Specifies a configuration object for IPv4 settings.
260+
261+
|`ipv6`
262+
|`object`
263+
|Specifies a configuration object for IPv6 settings.
264+
257265
|`policyAuditConfig`
258266
|`object`
259267
|Specify a configuration object for customizing network policy audit logging. If unset, the defaults audit log settings are used.
@@ -267,19 +275,50 @@ endif::operator[]
267275
While migrating egress traffic, you can expect some disruption to workloads and service traffic until the Cluster Network Operator (CNO) successfully rolls out the changes.
268276
====
269277

270-
|`v4InternalSubnet`
278+
|`v6InternalSubnet`
279+
|
280+
|====
281+
282+
.`ovnKubernetesConfig.ipv4` object
283+
[cols=".^2,.^2,.^6a",options="header"]
284+
|====
285+
|Field|Type|Description
286+
287+
|`internalTransitSwitchSubnet`
288+
|string
289+
|
290+
If your existing network infrastructure overlaps with the `100.88.0.0/16` IPv4 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. The subnet for the distributed transit switch that enables east-west traffic. This subnet cannot overlap with any other subnets used by OVN-Kubernetes or on the host itself. It must be large enough to accommodate one IP address per node in your cluster.
291+
292+
The default value is `100.88.0.0/16`.
293+
294+
|`internalJoinSubnet`
295+
|string
271296
|
272297
If your existing network infrastructure overlaps with the `100.64.0.0/16` IPv4 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster. For example, if the `clusterNetwork.cidr` value is `10.128.0.0/14` and the `clusterNetwork.hostPrefix` value is `/23`, then the maximum number of nodes is `2^(23-14)=512`.
273298

274-
This field cannot be changed after installation.
275-
|The default value is `100.64.0.0/16`.
299+
The default value is `100.64.0.0/16`.
276300

277-
|`v6InternalSubnet`
301+
|====
302+
303+
.`ovnKubernetesConfig.ipv6` object
304+
[cols=".^2,.^2,.^6a",options="header"]
305+
|====
306+
|Field|Type|Description
307+
308+
|`internalTransitSwitchSubnet`
309+
|string
278310
|
279-
If your existing network infrastructure overlaps with the `fd98::/48` IPv6 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster.
311+
If your existing network infrastructure overlaps with the `fd97::/64` IPv6 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. The subnet for the distributed transit switch that enables east-west traffic. This subnet cannot overlap with any other subnets used by OVN-Kubernetes or on the host itself. It must be large enough to accommodate one IP address per node in your cluster.
312+
313+
The default value is `fd97::/64`.
314+
315+
|`internalJoinSubnet`
316+
|string
317+
|
318+
If your existing network infrastructure overlaps with the `fd98::/64` IPv6 subnet, you can specify a different IP address range for internal use by OVN-Kubernetes. You must ensure that the IP address range does not overlap with any other subnet used by your {product-title} installation. The IP address range must be larger than the maximum number of nodes that can be added to the cluster.
319+
320+
The default value is `fd98::/64`.
280321

281-
This field cannot be changed after installation.
282-
| The default value is `fd98::/48`.
283322
|====
284323

285324
// tag::policy-audit[]
@@ -337,6 +376,40 @@ If you set this field to `true`, you do not receive the performance benefits of
337376
|`object`
338377
|You can control IP forwarding for all traffic on OVN-Kubernetes managed interfaces by using the `ipForwarding` specification in the `Network` resource. Specify `Restricted` to only allow IP forwarding for Kubernetes related traffic. Specify `Global` to allow forwarding of all IP traffic. For new installations, the default is `Restricted`. For updates to {product-title} 4.14 or later, the default is `Global`.
339378

379+
|`ipv4`
380+
|`object`
381+
|Optional: Specify an object to configure the internal OVN-Kubernetes masquerade address for host to service traffic for IPv4 addresses.
382+
383+
|`ipv6`
384+
|`object`
385+
|Optional: Specify an object to configure the internal OVN-Kubernetes masquerade address for host to service traffic for IPv6 addresses.
386+
387+
|====
388+
389+
[id="gatewayconfig-ipv4-object_{context}"]
390+
.`gatewayConfig.ipv4` object
391+
[cols=".^2,.^2,.^6a",options="header"]
392+
|====
393+
|Field|Type|Description
394+
395+
|`internalMasqueradeSubnet`
396+
|`string`
397+
|
398+
The masquerade IPv4 addresses that are used internally to enable host to service traffic. The host is configured with these IP addresses as well as the shared gateway bridge interface. The default value is `169.254.169.0/29`.
399+
400+
|====
401+
402+
[id="gatewayconfig-ipv6-object_{context}"]
403+
.`gatewayConfig.ipv6` object
404+
[cols=".^2,.^2,.^6a",options="header"]
405+
|====
406+
|Field|Type|Description
407+
408+
|`internalMasqueradeSubnet`
409+
|`string`
410+
|
411+
The masquerade IPv6 addresses that are used internally to enable host to service traffic. The host is configured with these IP addresses as well as the shared gateway bridge interface. The default value is `fd69::/125`.
412+
340413
|====
341414

342415
[id="nw-operator-cr-ipsec_{context}"]
@@ -357,7 +430,6 @@ a|Specifies the behavior of the IPsec implementation. Must be one of the followi
357430

358431
|====
359432

360-
361433
ifdef::operator[]
362434
[NOTE]
363435
====

‎modules/nw-ovn-kuberentes-change-join-subnet.adoc

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configure-ovn-kubernetes-subnets.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ovn-kubernetes-change-join-subnet_{context}"]
7+
= Configuring the OVN-Kubernetes join subnet
8+
9+
You can change the join subnet used by OVN-Kubernetes to avoid conflicting with any existing subnets already in use in your environment.
10+
11+
.Prerequisites
12+
13+
* Install the OpenShift CLI (`oc`).
14+
* Log in to the cluster with a user with `cluster-admin` privileges.
15+
* Ensure that the cluster uses the OVN-Kubernetes network plugin.
16+
17+
.Procedure
18+
19+
. To change the OVN-Kubernetes join subnet, enter the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc patch network.operator.openshift.io cluster --type='merge' \
24+
-p='{"spec":{"defaultNetwork":{"ovnKubernetesConfig":
25+
{"ipv4":{"internalJoinSubnet": "<join_subnet>"},
26+
"ipv6":{"internalJoinSubnet": "<join_subnet>"}}}}}'
27+
----
28+
+
29+
--
30+
where:
31+
32+
`<join_subnet>`:: Specifies an IP address subnet for internal use by OVN-Kubernetes. The subnet must be larger than the number of nodes in the cluster and it must be large enough to accommodate one IP address per node in the cluster. This subnet cannot overlap with any other subnets used by {product-title} or on the host itself. The default value for IPv4 is `100.64.0.0/16` and the default value for IPv6 is `fd98::/64`.
33+
--
34+
+
35+
.Example output
36+
[source,text]
37+
----
38+
network.operator.openshift.io/cluster patched
39+
----
40+
41+
.Verification
42+
43+
* To confirm that the configuration is active, enter the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc get network.operator.openshift.io \
48+
-o jsonpath="{.items[0].spec.defaultNetwork}"
49+
----
50+
+
51+
It can take up to 30 minutes for this change to take effect.
52+
+
53+
.Example output
54+
----
55+
{
56+
"ovnKubernetesConfig": {
57+
"ipv4": {
58+
"internalJoinSubnet": "100.64.1.0/16"
59+
},
60+
},
61+
"type": "OVNKubernetes"
62+
}
63+
----

‎modules/nw-ovn-kuberentes-change-transit-subnet.adoc

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/configure-ovn-kubernetes-subnets.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ovn-kubernetes-change-transit-subnet_{context}"]
7+
= Configuring the OVN-Kubernetes transit subnet
8+
9+
You can change the transit subnet used by OVN-Kubernetes to avoid conflicting with any existing subnets already in use in your environment.
10+
11+
.Prerequisites
12+
13+
* Install the OpenShift CLI (`oc`).
14+
* Log in to the cluster with a user with `cluster-admin` privileges.
15+
* Ensure that the cluster uses the OVN-Kubernetes network plugin.
16+
17+
.Procedure
18+
19+
. To change the OVN-Kubernetes transit subnet, enter the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc patch network.operator.openshift.io cluster --type='merge' \
24+
-p='{"spec":{"defaultNetwork":{"ovnKubernetesConfig":
25+
{"ipv4":{"internalTransitSwitchSubnet": "<transit_subnet>"},
26+
"ipv6":{"internalTransitSwitchSubnet": "<transit_subnet>"}}}}}'
27+
----
28+
+
29+
--
30+
where:
31+
32+
`<transit_subnet>`:: Specifies an IP address subnet for the distributed transit switch that enables east-west traffic. This subnet cannot overlap with any other subnets used by OVN-Kubernetes or on the host itself. The default value for IPv4 is `100.88.0.0/16` and the default value for IPv6 is `fd97::/64`.
33+
--
34+
+
35+
.Example output
36+
[source,text]
37+
----
38+
network.operator.openshift.io/cluster patched
39+
----
40+
41+
.Verification
42+
43+
* To confirm that the configuration is active, enter the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc get network.operator.openshift.io \
48+
-o jsonpath="{.items[0].spec.defaultNetwork}"
49+
----
50+
+
51+
It can take up to 30 minutes for this change to take effect.
52+
+
53+
.Example output
54+
----
55+
{
56+
"ovnKubernetesConfig": {
57+
"ipv4": {
58+
"internalTransitSwitchSubnet": "100.88.1.0/16"
59+
},
60+
},
61+
"type": "OVNKubernetes"
62+
}
63+
----

‎networking/ovn_kubernetes_network_provider/configure-ovn-kubernetes-subnets.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="configure-ovn-kubernetes-subnets"]
3+
= Configuring OVN-Kubernetes internal IP address subnets
4+
include::_attributes/common-attributes.adoc[]
5+
:context: configure-ovn-kubernetes-subnets
6+
7+
toc::[]
8+
9+
[role="_abstract"]
10+
As a cluster administrator, you can change the IP address ranges that the OVN-Kubernetes network plugin uses for the join and transit subnets.
11+
12+
include::modules/nw-ovn-kuberentes-change-join-subnet.adoc[leveloffset=+1]
13+
include::modules/nw-ovn-kuberentes-change-transit-subnet.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)