Skip to content

Commit a34b8b7

Browse files
author
Steven Smith
committed
Updates UDN docs to include required NS label
Addresses ocpbugs48423--commit two
1 parent 59fe492 commit a34b8b7

File tree

3 files changed

+52
-4
lines changed

3 files changed

+52
-4
lines changed

modules/nw-udn-benefits.adoc

+6-1
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,9 @@ User-defined networks provide the following benefits:
2929
+
3030
* **Network parity**: With user-defined networking, the migration of applications from OpenStack to {product-title} is simplified by providing similar network isolation and configuration options.
3131

32-
Developers and administrators can create a user-defined network that is namespace scoped using the custom resource. An overview of the process is: create a namespace, create and configure the custom resource, create pods in the namespace.
32+
Developers and administrators can create a user-defined network that is namespace scoped using the custom resource. An overview of the process is as follows:
33+
+
34+
. An administrator creates a namespace for a user-defined network with the `k8s.ovn.org/primary-user-defined-network` label.
35+
. Optional: An administrator grants a non-administrator user `admin` privileges on the user-defined network namespace.
36+
. The `UserDefinedNetwork` CR is created by either the cluster administrator or the user.
37+
. The cluster administrator or user with `admin` privileges creates pods in the namespace.

modules/nw-udn-best-practices.adoc

+25-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="considerations-for-udn_{context}"]
77
= Best practices for UserDefinedNetwork
88

9-
Before setting up a `UserDefinedNetwork` (UDN) resource, users should consider the following information:
9+
Before setting up a `UserDefinedNetwork` (UDN) resource, you should consider the following information:
1010

1111
//These will not go live till 4.18 GA
1212
//* To eliminate errors and ensure connectivity, you should create a namespace scoped UDN CR before creating any workload in the namespace.
@@ -15,6 +15,29 @@ Before setting up a `UserDefinedNetwork` (UDN) resource, users should consider t
1515

1616
* `openshift-*` namespaces should not be used to set up a UDN.
1717
18+
* {product-title} administrators should be aware that all namespaces of a cluster are selected when one of following conditions are met:
19+
20+
** The `matchLabels` selector is left empty.
21+
** The `matchExpressions` selector is left empty.
22+
** The `namespaceSelector` is initialized, but does not specify `matchExpressions` or `matchLabel`. For example: `namespaceSelector: {}`.
23+
24+
* For primary networks, the namespace used for the `UserDefinedNetwork` CR must include the `k8s.ovn.org/primary-user-defined-network` label. This label cannot be updated, and can only be added when the namespace is created. The following conditions apply with the `k8s.ovn.org/primary-user-defined-network` namespace label:
25+
26+
** If the namespace is missing the `k8s.ovn.org/primary-user-defined-network` label and a pod is created, the pod attaches itself to the default network.
27+
28+
** If the namespace is missing the `k8s.ovn.org/primary-user-defined-network` label and a primary UDN CR is created that matches the namespace, the UDN reports an error status and the network is not created.
29+
30+
** If the namespace is missing the `k8s.ovn.org/primary-user-defined-network` label and a primary UDN already exists, a pod in the namespace is created and attached to the default network.
31+
32+
** If the namespace _has_ the label, and a primary UDN does not exist, a pod in the namespace is not created until the UDN is created.
33+
34+
* If the user-defined network is intended to be used by a non-administrator user, you must grant the `admin` role to the non-administrator user on the user-defined namespace by entering the following command:
35+
+
36+
[source,terminal]
37+
----
38+
$ oc adm policy add-role-to-user admin <non_administrator_username> -n <udn_namespace>
39+
----
40+
1841
* 2 masquerade IP addresses are required for user defined networks. You must reconfigure your masquerade subnet to be large enough to hold the required number of networks.
1942
+
2043
[IMPORTANT]
@@ -29,5 +52,4 @@ Before setting up a `UserDefinedNetwork` (UDN) resource, users should consider t
2952
3053
* When creating network segmentation, you should only use the NAD resource if user-defined network segmentation cannot be completed using the UDN resource.
3154
32-
* The cluster subnet and services CIDR for a UDN cannot overlap with the default cluster subnet CIDR. OVN-Kubernetes network plugin uses `100.64.0.0/16` as the default network's join subnet, you must not use that value to configure a UDN `joinSubnets` field. If the default address values are used anywhere in the cluster's network you must override it by setting the `joinSubnets` field. For more information, see "Additional configuration details for a UserDefinedNetworks CR".
33-
55+
* The cluster subnet and services CIDR for a UDN cannot overlap with the default cluster subnet CIDR. OVN-Kubernetes network plugin uses `100.64.0.0/16` as the default network's join subnet, you must not use that value to configure a UDN `joinSubnets` field. If the default address values are used anywhere in the cluster's networ, you must override it by setting the `joinSubnets` field. For more information, see "Additional configuration details for a UserDefinedNetworks CR".

modules/nw-udn-cr.adoc

+21
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,27 @@ The following procedure creates a user-defined network that is namespace scoped.
1616

1717
.Procedure
1818

19+
. Optional: For a `UserDefinedNetwork` CR that uses a primary network, create a namespace with the `k8s.ovn.org/primary-user-defined-network` label by entering the following command:
20+
+
21+
[source,yaml]
22+
----
23+
$ cat << EOF | oc apply -f -
24+
apiVersion: v1
25+
kind: Namespace
26+
metadata:
27+
name: <udn_namespace_name>
28+
labels:
29+
k8s.ovn.org/primary-user-defined-network: ""
30+
EOF
31+
----
32+
33+
. Optional: If the user-defined network is intended to be used by a non-administrator user, grant the non-administrator user `admin` permissions on the namespace by entering the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ oc adm policy add-role-to-user admin <non_administrator_username> -n <udn_namespace>
38+
----
39+
1940
. Create a request for either a `Layer2` or `Layer3` topology type user-defined network:
2041

2142
.. Create a YAML file, such as `my-layer-two-udn.yaml`, to define your request for a `Layer2` topology as in the following example:

0 commit comments

Comments
 (0)