Skip to content

Commit d3a9576

Browse files
jab-rhjab-rh
committed
OSDOCS-10856: Add bpfman Operator for ingress firewalls
- https://issues.redhat.com/browse/OSDOCS-10856
1 parent b2e0d60 commit d3a9576

15 files changed

+443
-1
lines changed

‎_topic_maps/_topic_map.yml

+10
Original file line numberDiff line numberDiff line change
@@ -1330,6 +1330,16 @@ Topics:
13301330
File: logging-network-security
13311331
- Name: Understanding the Ingress Node Firewall Operator
13321332
File: ingress-node-firewall-operator
1333+
- Name: eBPF manager Operator
1334+
Dir: ebpf_manager
1335+
Distros: openshift-enterprise,openshift-origin
1336+
Topics:
1337+
- Name: About the eBPF Manager Operator
1338+
File: ebpf-manager-operator-about
1339+
- Name: Installing the eBPF Manager Operator
1340+
File: ebpf-manager-operator-install
1341+
- Name: Deploying an eBPF program
1342+
File: ebpf-manager-operator-deploy
13331343
- Name: Egress Firewall
13341344
Dir: egress_firewall
13351345
Distros: openshift-enterprise,openshift-origin

‎modules/nw-bpfman-infw-about.adoc

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/ingress-node-firewall-operator.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="ingress-node-firewall-operator_{context}"]
7+
= Ingress Node Firewall Operator integration
8+
9+
The Ingress Node Firewall uses link:https://www.kernel.org/doc/html/latest/bpf/index.html[eBPF] programs to implement some of its key firewall functionality. By default these eBPF programs are loaded into the kernel using a mechanism specific to the Ingress Node Firewall. You can configure the Ingress Node Firewall Operator to use the eBPF manager Operator for loading and managing these programs instead.
10+
11+
When this integration is enabled, the following limitations apply:
12+
13+
- The Ingress Node Firewall Operator uses TCX if XDP is not available and TCX is incompatible with bpfman.
14+
- The Ingress Node Firewall Operator daemon set pods remain in the `ContainerCreating` state until the firewall rules are applied.
15+
- The Ingress Node Firewall Operator daemon set pods run as privileged.

‎modules/nw-bpfman-infw-configure.adoc

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/ebpf_manager/ebpf-manager-operator-about.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="bpfman-infw-configure_{context}"]
7+
= Configuring Ingress Node Firewall Operator to use the eBPF manager Operator
8+
9+
The Ingress Node Firewall uses link:https://www.kernel.org/doc/html/latest/bpf/index.html[eBPF] programs to implement some of its key firewall functionality. By default these eBPF programs are loaded into the kernel using a mechanism specific to the Ingress Node Firewall.
10+
11+
As a cluster administrator, you can configure the Ingress Node Firewall Operator to use the eBPF Manager Operator for loading and managing these programs instead, adding additional security and observability functionality.
12+
13+
.Prerequisites
14+
15+
* You have installed the OpenShift CLI (`oc`).
16+
* You have an account with administrator privileges.
17+
* You installed the Ingress Node Firewall Operator.
18+
* You have installed the eBPF manager Operator.
19+
20+
.Procedure
21+
22+
. Apply the following labels to the `ingress-node-firewall-system` namespace:
23+
+
24+
[source,terminal]
25+
----
26+
$ oc label namespace openshift-ingress-node-firewall \
27+
pod-security.kubernetes.io/enforce=privileged \
28+
pod-security.kubernetes.io/warn=privileged --overwrite
29+
----
30+
31+
. Edit the `IngressNodeFirewallConfig` object named `ingressnodefirewallconfig` and set the `ebpfProgramManagerMode` field:
32+
+
33+
.Ingress Node Firewall Operator configuration object
34+
[source,yaml]
35+
----
36+
apiVersion: ingressnodefirewall.openshift.io/v1alpha1
37+
kind: IngressNodeFirewallConfig
38+
metadata:
39+
name: ingressnodefirewallconfig
40+
namespace: openshift-ingress-node-firewall
41+
spec:
42+
nodeSelector:
43+
node-role.kubernetes.io/worker: ""
44+
ebpfProgramManagerMode: <ebpf_mode>
45+
----
46+
+
47+
--
48+
where:
49+
50+
`<ebpf_mode>`: Specifies whether or not the Ingress Node Firewall Operator uses the eBPF manager Operator to manage eBPF programs. Must be either `true` or `false`. If unset, eBPF manager is not used.
51+
--

‎modules/nw-bpfman-operator-deploy.adoc

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/ebpf_manager/ebpf-manager-operator-deploy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-bpfman-operator-deploy_{context}"]
7+
= Deploying a containerized eBPF program
8+
9+
As a cluster administrator, you can deploy an eBPF program to nodes on your cluster. In this procedure, a sample containerized eBPF program is installed in the `go-xdp-counter` namespace.
10+
11+
.Prerequisites
12+
13+
* You have installed the OpenShift CLI (`oc`).
14+
* You have an account with administrator privileges.
15+
* You have installed the eBPF manager Operator.
16+
17+
.Procedure
18+
19+
. To download the manifest, enter the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ curl -L https://github.com/bpfman/bpfman/releases/download/v0.5.1/go-xdp-counter-install-selinux.yaml -o go-xdp-counter-install-selinux.yaml
24+
----
25+
26+
. To deploy the sample eBPF application, enter the following command:
27+
+
28+
[source,terminal]
29+
----
30+
$ oc create -f go-xdp-counter-install-selinux.yaml
31+
----
32+
+
33+
.Example output
34+
[source,text]
35+
----
36+
namespace/go-xdp-counter created
37+
serviceaccount/bpfman-app-go-xdp-counter created
38+
clusterrolebinding.rbac.authorization.k8s.io/xdp-binding created
39+
daemonset.apps/go-xdp-counter-ds created
40+
xdpprogram.bpfman.io/go-xdp-counter-example created
41+
selinuxprofile.security-profiles-operator.x-k8s.io/bpfman-secure created
42+
----
43+
44+
. To confirm that the eBPF sample application deployed successfully, enter the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ oc get all -o wide -n go-xdp-counter
49+
----
50+
+
51+
.Example output
52+
[source,text]
53+
----
54+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
55+
pod/go-xdp-counter-ds-4m9cw 1/1 Running 0 44s 10.129.0.92 ci-ln-dcbq7d2-72292-ztrkp-master-1 <none> <none>
56+
pod/go-xdp-counter-ds-7hzww 1/1 Running 0 44s 10.130.0.86 ci-ln-dcbq7d2-72292-ztrkp-master-2 <none> <none>
57+
pod/go-xdp-counter-ds-qm9zx 1/1 Running 0 44s 10.128.0.101 ci-ln-dcbq7d2-72292-ztrkp-master-0 <none> <none>
58+
59+
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE CONTAINERS IMAGES SELECTOR
60+
daemonset.apps/go-xdp-counter-ds 3 3 3 3 3 <none> 44s go-xdp-counter quay.io/bpfman-userspace/go-xdp-counter:v0.5.0 name=go-xdp-counter
61+
----
62+
63+
. To confirm that the example XDP program is running, enter the following command:
64+
+
65+
[source,terminal]
66+
----
67+
$ oc get xdpprogram go-xdp-counter-example
68+
----
69+
+
70+
.Example output
71+
[source,text]
72+
----
73+
74+
NAME BPFFUNCTIONNAME NODESELECTOR STATUS
75+
go-xdp-counter-example xdp_stats {} ReconcileSuccess
76+
----
77+
78+
. To confirm that the XDP program is collecting data, enter the following command:
79+
+
80+
[source,terminal]
81+
----
82+
$ oc logs <pod_name> -n go-xdp-counter
83+
----
84+
+
85+
Replace `<pod_name>` with the name of a XDP program pod, such as `go-xdp-counter-ds-4m9cw`.
86+
+
87+
.Example output
88+
[source,text]
89+
----
90+
2024/08/13 15:20:06 15016 packets received
91+
2024/08/13 15:20:06 93581579 bytes received
92+
93+
2024/08/13 15:20:09 19284 packets received
94+
2024/08/13 15:20:09 99638680 bytes received
95+
96+
2024/08/13 15:20:12 23522 packets received
97+
2024/08/13 15:20:12 105666062 bytes received
98+
99+
2024/08/13 15:20:15 27276 packets received
100+
2024/08/13 15:20:15 112028608 bytes received
101+
102+
2024/08/13 15:20:18 29470 packets received
103+
2024/08/13 15:20:18 112732299 bytes received
104+
105+
2024/08/13 15:20:21 32588 packets received
106+
2024/08/13 15:20:21 113813781 bytes received
107+
----

‎modules/nw-bpfman-operator-installing-cli.adoc

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/ebpf_manager/ebpf-manager-operator-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-bpfman-operator-installing-cli_{context}"]
7+
= Installing the eBPF manager Operator using the CLI
8+
9+
As a cluster administrator, you can install the Operator using the CLI.
10+
11+
.Prerequisites
12+
13+
* You have installed the OpenShift CLI (`oc`).
14+
* You have an account with administrator privileges.
15+
16+
.Procedure
17+
18+
. To create the `bpfman` namespace, enter the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ cat << EOF| oc create -f -
23+
apiVersion: v1
24+
kind: Namespace
25+
metadata:
26+
labels:
27+
pod-security.kubernetes.io/enforce: privileged
28+
pod-security.kubernetes.io/enforce-version: v1.24
29+
name: bpfman
30+
EOF
31+
----
32+
33+
. To create an `OperatorGroup` CR, enter the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ cat << EOF| oc create -f -
38+
apiVersion: operators.coreos.com/v1
39+
kind: OperatorGroup
40+
metadata:
41+
name: bpfman-operators
42+
namespace: bpfman
43+
EOF
44+
----
45+
46+
. Subscribe to the eBPF manager Operator.
47+
48+
.. To create a `Subscription` CR for the eBPF manager Operator, enter the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ cat << EOF| oc create -f -
53+
apiVersion: operators.coreos.com/v1alpha1
54+
kind: Subscription
55+
metadata:
56+
name: bpfman-operator
57+
namespace: bpfman
58+
spec:
59+
name: bpfman-operator
60+
channel: alpha
61+
source: community-operators
62+
sourceNamespace: openshift-marketplace
63+
EOF
64+
----
65+
66+
. To verify that the Operator is installed, enter the following command:
67+
+
68+
[source,terminal]
69+
----
70+
$ oc get ip -n bpfman
71+
----
72+
+
73+
.Example output
74+
[source,terminal,subs="attributes+"]
75+
----
76+
NAME CSV APPROVAL APPROVED
77+
install-ppjxl security-profiles-operator.v0.8.5 Automatic true
78+
----
79+
80+
. To verify the version of the Operator, enter the following command:
81+
82+
+
83+
[source,terminal]
84+
----
85+
$ oc get csv -n bpfman
86+
----
87+
+
88+
.Example output
89+
[source,terminal,subs="attributes+"]
90+
----
91+
NAME DISPLAY VERSION REPLACES PHASE
92+
bpfman-operator.v0.5.0 eBPF manager Operator 0.5.0 bpfman-operator.v0.4.2 Succeeded
93+
----

‎modules/nw-bpfman-operator-installing-console.adoc

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/ebpf_manager/ebpf-manager-operator-install.adoc
4+
5+
////
6+
Operator Hub capitalizes all Operator names; officially, it is eBPF manager though.
7+
////
8+
9+
:_mod-docs-content-type: PROCEDURE
10+
[id="nw-bpfman-operator-installing-console_{context}"]
11+
= Installing the eBPF manager Operator using the web console
12+
13+
As a cluster administrator, you can install the eBPF manager Operator using the web console.
14+
15+
.Prerequisites
16+
17+
* You have installed the OpenShift CLI (`oc`).
18+
* You have an account with administrator privileges.
19+
20+
.Procedure
21+
22+
. Install the eBPF manager Operator:
23+
24+
.. In the {product-title} web console, click *Operators* -> *OperatorHub*.
25+
26+
.. Select *eBPF manager Operator* from the list of available Operators, and if prompted to *Show community Operator*, click *Continue*.
27+
28+
.. Click *Install*.
29+
30+
.. On the *Install Operator* page, under *Installed Namespace*, select *Operator recommended Namespace*.
31+
32+
.. Click *Install*.
33+
34+
. Verify that the eBPF manager Operator is installed successfully:
35+
36+
.. Navigate to the *Operators* -> *Installed Operators* page.
37+
38+
.. Ensure that *eBPF manager Operator* is listed in the *openshift-ingress-node-firewall* project with a *Status* of *InstallSucceeded*.
39+
+
40+
[NOTE]
41+
====
42+
During installation an Operator might display a *Failed* status.
43+
If the installation later succeeds with an *InstallSucceeded* message, you can ignore the *Failed* message.
44+
====
45+
+
46+
If the Operator does not have a *Status* of *InstallSucceeded*, troubleshoot using the following steps:
47+
+
48+
* Inspect the *Operator Subscriptions* and *Install Plans* tabs for any failures or errors under *Status*.
49+
* Navigate to the *Workloads* -> *Pods* page and check the logs for pods in the `bpfman` project.

‎modules/nw-infw-operator-config-object.adoc

+7
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ spec:
3838
One label used in `nodeSelector` must match a label on the nodes in order for the daemon set to start. For example, if the node labels `node-role.kubernetes.io/worker` and `node-type.kubernetes.io/vm` are applied to a node, then at least one label must be set using `nodeSelector` for the daemon set to start.
3939
====
4040

41+
|`spec.ebpfProgramManagerMode`
42+
|`boolean`
43+
|
44+
Specifies if the Node Ingress Firewall Operator uses the eBPF manager Operator or not to manage eBPF programs. This capability is a Technology Preview feature.
45+
46+
For more information about the support scope of Red Hat Technology Preview features, see link:https://access.redhat.com/support/offerings/techpreview/[Technology Preview Features Support Scope].
47+
4148
|====
4249

4350
[NOTE]

‎networking/network_security/ebpf_manager/_attributes

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../../_attributes

0 commit comments

Comments
 (0)