Table of Contents

• Cluster Network Operator
  • Troubleshoot software defined networking
• DNS Operator
• External routes (unsecured)
  • Edit routes
• Network Ingress
• Secure Routes Using TLS Certificates

The Cluster Network Operator implements the network API from the operator.openshift.io API group. The Operator deploys the OpenShift SDN default Container Network Interface (CNI) network provider plug-in, or the default network provider plug-in that you selected during cluster installation, by using a DaemonSet.

• operates the cluster network
• deploys and manages the network components of your cluster (including the CNI [container network interface] and also the Pod Network Provider Plugin [selected for the cluster during installation])
• implements a network API from operator.openshift.io API group
• deployed during installation
• deployed as a kubernetes deployment

Since CNO is responsible for our networking, we should be able to check it's deployment state, it's status, it's logs in order to troubleshoot issues when the occur.

oc get -n openshift-network-operator deployment/network-operator

oc get clusteroperator/network

oc describe clusteroperators/network

Every new OKD installation has a network.config object named cluster.

oc describe network.config/cluster

oc logs --namespace=openshift-network-operator deployment/network-operator

https://docs.okd.io/latest/networking/cluster-network-operator.html

oc get endpoints -n <project>

oc get pods -n <project> --template='{{range.item}}HostIP:{{status.hostIP}} PodIP: {{.status.podIP}}{{"\n"}}{{end}}'

oc get route -n <project>

oc get services -n <project_name>

The DNS Operator deploys and manages CoreDNS to provide a name resolution service to pods, enabling DNS-based Kubernetes Service discovery in OpenShift.

The DNS Operator implements the dns API from the operator.openshift.io API group. The operator deploys CoreDNS using a DaemonSet, creates a Service for the DaemonSet, and configures the kubelet to instruct pods to use the CoreDNS Service IP for name resolution.

It is also deployed during installation as a Kubernetes Deployment.

oc get -n openshift-dns-operator deployment/dns-operator

oc get clusteroperator/dns

oc describe clusteroperator/dns

oc logs -n openshift-dns-operator deployment/dns-operator

https://docs.okd.io/latest/networking/dns-operator.html

To create routes we will expose our services available in our cluster. When exposed a service will be reachable outside from the cluster.

oc expose service <service_name>

oc expose service <service_name> -l name=<label> --name=<route_name>

oc expose service --port=<port> --protocol="<protocol>"

oc expose service <service_name> --path=<path>

oc annotate route <route> --overwrite haproxy.router.openshift.io/timeout=<timeout>.<time_unit>

oc annotate route <route> router.openshift.io/<cookie_name>="-<cookie_annotation>"

oc annotate route <route> haproxy.router.openshift.io/ip_whitelist="<ip1 ip2 ip3>"

oc annotate route <route> haproxy.router.openshift.io/rate-limit-connections=true

Ingress expose HTTP and HTTPS routes from outside cluster to services within the cluster. Rules are defined in the Ingress resource to controll traffic routing. The Ingress operator implements the ingress controller API to enable access to the openshift cluster services. The operator deploys and manages one or more HAProxy based ingress controllers that makes this all possible.

https://docs.okd.io/latest/networking/configuring_ingress_cluster_traffic/overview-traffic.html

example-ingress.yaml

oc create -f router-internal.yaml

oc create route edge --service=frontend --cert=tls.crt --key=tls.key --hostname=www.example.com

Examine route (command above will create something like this)

apiVersion: v1
kind: Route
metadata:
  name: frontend
spec:
  host: www.example.com
  to:
    kind: Service
	name: frontend
  tls:
    termination: edge
	key: |-
	  -----BEGIN PRIVATE KEY-----
	  [...]
	  -----END PRIVATE KEY-----
	certificate: |-
	  -----BEGIN CERTIFICATE-----
	  [...]
	  -----END CERTIFICATE-----

https://docs.okd.io/latest/networking/routes/secured-routes.html

openssl req -x509 -newkey rsa:4096 -nodes -keyout cert.key -out cert.crt

openssl rsa -in <password_protected_key_file>.key -out <key_file>.key