docker:okd1
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| docker:okd1 [2026/03/20 12:31] – jonathan | docker:okd1 [2026/03/20 19:04] (current) – jonathan | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ===== OKD1 ===== | ===== OKD1 ===== | ||
| + | |||
| + | ==== VM spin-up ==== | ||
| + | |||
| + | <code - okd-spin_up-cp.sh> | ||
| + | #!/bin/bash | ||
| + | |||
| + | virsh destroy okd-bootstrap | ||
| + | virsh undefine okd-bootstrap | ||
| + | |||
| + | virsh destroy okd-cp1 | ||
| + | virsh undefine okd-cp1 | ||
| + | |||
| + | virsh destroy okd-cp2 | ||
| + | virsh undefine okd-cp2 | ||
| + | |||
| + | virsh destroy okd-cp3 | ||
| + | virsh undefine okd-cp3 | ||
| + | |||
| + | rm -rf / | ||
| + | ######################################################################## | ||
| + | |||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp bootstrap.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-bootstrap \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp master.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-cp1 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp master.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-cp2 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp master.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-cp3 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | </ | ||
| + | |||
| + | <code - okd-spin_up-workers.sh> | ||
| + | #!/bin/bash | ||
| + | |||
| + | virsh destroy okd-worker1 | ||
| + | virsh undefine okd-worker1 | ||
| + | |||
| + | virsh destroy okd-worker2 | ||
| + | virsh undefine okd-worker2 | ||
| + | |||
| + | virsh destroy okd-worker3 | ||
| + | virsh undefine okd-worker3 | ||
| + | |||
| + | virsh destroy okd-worker4 | ||
| + | virsh undefine okd-worker4 | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp worker.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-worker1 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --network network=ovsbr0, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp worker.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-worker2 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --network network=ovsbr0, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp worker.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-worker3 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --network network=ovsbr0, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | |||
| + | ######################################################################## | ||
| + | |||
| + | # 1. Nettoyage et Copie de l' | ||
| + | wipefs -a / | ||
| + | wipefs -a / | ||
| + | qemu-img convert -O raw / | ||
| + | |||
| + | # 3. Préparation Ignition | ||
| + | cp worker.ign / | ||
| + | chmod 777 / | ||
| + | IGNITION_DEVICE_ARG=" | ||
| + | |||
| + | # 4. Installation | ||
| + | virt-install \ | ||
| + | --name okd-worker4 \ | ||
| + | --memory 16384 --vcpus 4 --cpu host-passthrough \ | ||
| + | --machine q35 --os-variant=fedora-coreos-stable \ | ||
| + | --disk path=/ | ||
| + | --disk path=/ | ||
| + | --network network=vlan219, | ||
| + | --network network=ovsbr0, | ||
| + | --graphics none \ | ||
| + | --import \ | ||
| + | --noautoconsole \ | ||
| + | " | ||
| + | </ | ||
| + | |||
| ==== Installation command ==== | ==== Installation command ==== | ||
| Line 22: | Line 259: | ||
| </ | </ | ||
| - | Once the installation completed you should get access to the OKD GUI via https:// | + | Once the installation completed you should get access to the OKD GUI via https:// |
| Line 110: | Line 347: | ||
| ==== MACVLAN ==== | ==== MACVLAN ==== | ||
| - | This documentation explains | + | This page documents |
| + | The goal is to allow pods to attach to an external Layer‑2 network (VLAN 222) using a macvlan interface. | ||
| + | Configuration involves two main components: | ||
| - | A NetworkAttachmentDefinition (NAD) | + | A NetworkAttachmentDefinition (NAD) for Multus |
| - | A MachineConfig | + | A MachineConfig to create the VLAN interface on each worker node |
| - | This setup enables pods to attach | + | ====== 1. Overview ====== |
| + | OpenShift/ | ||
| + | However, when a pod needs direct access | ||
| + | Because OKD nodes are immutable, the required VLAN interface (enp8s0.222) must be created | ||
| + | The workflow: | ||
| + | MachineConfig creates VLAN interface enp8s0.222 | ||
| + | NAD defines a macvlan network using that interface | ||
| + | Pods reference the network through annotations | ||
| - | 1. Background and Architecture | + | ====== 2. NetworkAttachmentDefinition ====== |
| - | In OpenShift/ | + | This definition describes |
| - | However, when you want pods to communicate directly on an external Layer‑2 network — like a routed lab network, IoT segment, or a physical VLAN — you must use a secondary network | + | ===== File: macvlan-enp8s0-vlan222.yaml ===== |
| - | To achieve this: | + | |
| - | Each worker must expose the VLAN interface locally on the OS (enp8s0.222). | + | < |
| - | OKD will not create this automatically. | + | |
| - | Multus attaches a macvlan interface to the pod as a second NIC. | + | |
| - | IP assignment is handled manually (ipam: static) or via the pod annotations. | + | |
| - | + | ||
| - | + | ||
| - | + | ||
| - | NetworkAttachmentDefinition (macvlan-enp8s0-vlan222.yaml) | + | |
| - | This NAD defines the macvlan secondary network used by pods. | + | |
| - | + | ||
| - | < | + | |
| apiVersion: k8s.cni.cncf.io/ | apiVersion: k8s.cni.cncf.io/ | ||
| kind: NetworkAttachmentDefinition | kind: NetworkAttachmentDefinition | ||
| Line 153: | Line 388: | ||
| </ | </ | ||
| - | || Field || Description | + | ===== Explanation ===== |
| + | ^ Field ^ Description ^ | ||
| + | | type: macvlan | ||
| + | | master: enp8s0.222 | Parent interface (VLAN must already exist on the node) | | ||
| + | | mode: bridge | Allows pod ↔ pod traffic on the same worker | | ||
| + | | ipam: static | ||
| + | ===== Example pod annotation ===== | ||
| - | | type: macvlan | Pods get a macvlan interface that acts as a virtual NIC attached to the parent interface (enp8s0.222). | | + | < |
| - | | master: enp8s0.222 | + | annotations: |
| - | | mode: bridge | Allows pod-to-pod communication on the same host. | | + | k8s.v1.cni.cncf.io/ |
| - | | ipam: static | IP addresses must be assigned manually via pod annotations. | | + | [{ |
| + | " | ||
| + | " | ||
| + | " | ||
| + | }] | ||
| + | </ | ||
| - | <code - workers-enp8s0-vlan222-config.yaml> | + | ====== 3. MachineConfig (VLAN Creation) ====== |
| + | OKD nodes are immutable; network interfaces cannot be managed with nmcli or traditional config files. | ||
| + | A MachineConfig is required to create the VLAN interface during node boot. | ||
| + | ===== File: workers-enp8s0-vlan222-config.yaml | ||
| + | |||
| + | |||
| + | <code> | ||
| apiVersion: machineconfiguration.openshift.io/ | apiVersion: machineconfiguration.openshift.io/ | ||
| kind: MachineConfig | kind: MachineConfig | ||
| Line 171: | Line 423: | ||
| ignition: | ignition: | ||
| version: 3.2.0 | version: 3.2.0 | ||
| + | |||
| + | storage: | ||
| + | files: | ||
| + | - path: / | ||
| + | mode: 0755 | ||
| + | contents: | ||
| + | source: data:, | ||
| - | storage: | + | systemd: |
| - | files: | + | units: |
| - | - path: / | + | - name: create-vlan222.service |
| - | mode: 0755 | + | |
| - | contents: | + | contents: |
| - | | + | |
| + | Description=Create VLAN 222 interface on enp8s0 | ||
| + | After=network-online.target | ||
| + | Wants=network-online.target | ||
| - | systemd: | + | |
| - | units: | + | Type=oneshot |
| - | - name: create-vlan222.service | + | |
| - | enabled: true | + | |
| - | contents: | | + | |
| - | | + | |
| - | | + | |
| - | # | + | |
| - | # | + | |
| - | After=network-online.target | + | |
| - | Wants=network-online.target | + | |
| - | | + | |
| - | Type=oneshot | + | |
| - | ExecStart=/ | + | </ |
| - | | + | |
| - | [Install] | + | ===== Explanation ===== |
| - | | + | The MachineConfig performs two main actions: |
| - | </ | + | ==== 1. Creates script: / |
| + | Decoded content: | ||
| < | < | ||
| + | #!/bin/bash | ||
| + | ip link add link enp8s0 name enp8s0.222 type vlan id 222 || true | ||
| + | ip link set enp8s0.222 up | ||
| </ | </ | ||
| + | |||
| + | Notes: | ||
| + | Creates VLAN 222 on interface enp8s0 | ||
| + | Brings the interface UP | ||
| + | || true prevents failure if the interface already exists | ||
| + | |||
| + | ==== 2. Installs systemd service to run the script ==== | ||
| + | Runs after the network is online to guarantee the parent interface exists. | ||
| + | |||
| + | |||
| + | ====== 4. How it Works End-to-End ====== | ||
| + | |||
| + | MachineConfig adds VLAN interface enp8s0.222 to all worker nodes | ||
| + | NAD defines a macvlan network using this interface | ||
| + | Pods request the network with a Multus annotation | ||
| + | Pods receive a secondary interface (net1) on VLAN 222 | ||
| + | |||
| + | This provides Layer‑2 connectivity directly from the pod to the external network, bypassing the cluster SDN. | ||
| + | |||
| + | |||
| + | ====== 5. Validation Steps ====== | ||
| + | ==== Check VLAN presence ==== | ||
| < | < | ||
| + | jonathan@jonathan-VirtualBox: | ||
| + | Starting pod/ | ||
| + | To use host binaries, run `chroot /host`. Instead, if you need to access host namespaces, run `nsenter -a -t 1`. | ||
| + | Pod IP: 172.16.100.154 | ||
| + | All commands and output from this session will be recorded in container logs, including credentials and sensitive information passed through the command prompt. | ||
| + | If you don't see a command prompt, try pressing enter. | ||
| + | sh-5.1# ip link show enp8s0.222 | ||
| + | 9: enp8s0.222@enp8s0: | ||
| + | link/ether 52: | ||
| + | sh-5.1# | ||
| </ | </ | ||
| + | ==== Check Multus attachment definitions ==== | ||
| < | < | ||
| + | jonathan@jonathan-VirtualBox: | ||
| + | NAME AGE | ||
| + | macvlan-enp8s0 | ||
| + | macvlan-enp8s0-vlan222 | ||
| </ | </ | ||
| + | |||
| + | ===== Monitoring MachineConfig Deployment ===== | ||
| + | |||
| + | The following command is used to check the status of the MachineConfigPool for the worker nodes: | ||
| < | < | ||
| + | oc get mcp worker | ||
| </ | </ | ||
| - | < | + | This command displays the current state of the worker MachineConfigPool (MCP). It is used to monitor the rollout of a MachineConfig across all worker nodes. |
| + | |||
| + | It shows information such as: | ||
| + | |||
| + | * whether the workers are **updating** | ||
| + | * how many nodes are **ready** | ||
| + | * how many nodes still need to **reboot** | ||
| + | * whether the pool is fully **updated** and **in sync** | ||
| + | |||
| + | In summary: **this command is used to verify and monitor the deployment of MachineConfig changes on worker nodes.** | ||
| + | |||
| + | ===== Example Pods Using the macvlan-enp8s0-vlan222 Network ===== | ||
| + | |||
| + | The following examples show how to create simple pods that attach to the | ||
| + | **macvlan-enp8s0-vlan222** secondary network. | ||
| + | Each pod receives a static IP address on VLAN 222 using Multus annotations. | ||
| + | |||
| + | Both pods use the **nicolaka/ | ||
| + | |||
| + | ==== Pod 1: macvlan-pod1 ==== | ||
| + | |||
| + | < | ||
| + | apiVersion: v1 | ||
| + | kind: Pod | ||
| + | metadata: | ||
| + | name: macvlan-pod1 | ||
| + | annotations: | ||
| + | k8s.v1.cni.cncf.io/ | ||
| + | [{ | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }] | ||
| + | spec: | ||
| + | containers: | ||
| + | - name: test | ||
| + | image: nicolaka/ | ||
| + | command: [" | ||
| + | securityContext: | ||
| + | privileged: true | ||
| </ | </ | ||
| - | < | + | ==== Pod 2: macvlan-pod2 ==== |
| + | |||
| + | < | ||
| + | apiVersion: v1 | ||
| + | kind: Pod | ||
| + | metadata: | ||
| + | name: macvlan-pod2 | ||
| + | annotations: | ||
| + | k8s.v1.cni.cncf.io/ | ||
| + | [{ | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }] | ||
| + | spec: | ||
| + | containers: | ||
| + | - name: test | ||
| + | image: nicolaka/ | ||
| + | command: [" | ||
| + | securityContext: | ||
| + | privileged: true | ||
| </ | </ | ||
| + | |||
| + | ==== Verifying Connectivity ==== | ||
| + | |||
| + | Once both pods are running, you can verify their network configuration: | ||
| < | < | ||
| + | oc exec -it macvlan-pod1 -- ip addr | ||
| + | oc exec -it macvlan-pod2 -- ip addr | ||
| </ | </ | ||
| + | |||
| + | Test L2/L3 communication: | ||
| < | < | ||
| + | oc exec -it macvlan-pod1 -- ping 10.194.22.201 | ||
| + | oc exec -it macvlan-pod2 -- ping 10.194.22.200 | ||
| </ | </ | ||
| - | < | + | \n |
| + | \n | ||
| + | ===== Creating Local Users in OKD 4.21 Using HTPasswd ===== | ||
| + | |||
| + | A fresh OKD installation only provides the ``kubeadmin`` user. | ||
| + | To allow local users to log in and deploy pods, configure an HTPasswd | ||
| + | identity provider. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== Step 1: Create the htpasswd file ==== | ||
| + | |||
| + | < | ||
| + | docker run --rm \ | ||
| + | -v $(pwd):/ | ||
| + | docker.io/ | ||
| + | htpasswd -cbB / | ||
| + | |||
| + | docker run --rm \ | ||
| + | -v $(pwd):/ | ||
| + | docker.io/ | ||
| + | htpasswd -bB / | ||
| + | |||
| + | docker run --rm \ | ||
| + | -v $(pwd):/ | ||
| + | docker.io/ | ||
| + | htpasswd -bB / | ||
| </ | </ | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== Step 2: Create the secret in the openshift-config namespace ==== | ||
| + | |||
| + | <code bash> | ||
| + | oc create secret generic htpasswd-secret \ | ||
| + | --from-file=htpasswd=users.htpasswd \ | ||
| + | -n openshift-config | ||
| + | </ | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== Step 3: Configure OAuth to use HTPasswd ==== | ||
| + | |||
| + | Edit the OAuth configuration: | ||
| + | |||
| + | <code bash> | ||
| + | oc edit oauth cluster | ||
| + | </ | ||
| + | |||
| + | Add: | ||
| + | |||
| + | <code yaml> | ||
| + | spec: | ||
| + | identityProviders: | ||
| + | - name: local-users | ||
| + | mappingMethod: | ||
| + | type: HTPasswd | ||
| + | htpasswd: | ||
| + | fileData: | ||
| + | name: htpasswd-secret | ||
| + | </ | ||
| + | |||
| + | Wait for the OAuth operator to restart. | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== Step 4: Test login ==== | ||
| + | |||
| + | Log out of the Web Console and log in with: | ||
| + | |||
| + | * Username: ``myuser`` | ||
| + | * Password: ``MyPassword123`` | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ==== Step 5: Grant permissions to the new user ==== | ||
| + | |||
| + | Allow user to create their own Projects: | ||
| + | |||
| + | <code bash> | ||
| + | oc adm policy add-cluster-role-to-user self-provisioner myuser | ||
| + | </ | ||
| + | |||
| + | Or give admin access to a specific namespace: | ||
| + | |||
| + | <code bash> | ||
| + | oc adm policy add-role-to-user admin myuser -n mynamespace | ||
| + | </ | ||
| + | |||
| + | The user can now create and run pods. | ||
| + | |||
| < | < | ||
docker/okd1.1774009904.txt.gz · Last modified: by jonathan