Cluster Network Operator in OpenShift Container Platform¶

With the Cluster Network Operator, you can manage networking in OpenShift Container Platform, including how to view status, enable IP forwarding, and collect logs.

You can use the Cluster Network Operator (CNO) to deploy and manage cluster network components on an OpenShift Container Platform cluster, including the Container Network Interface (CNI) network plugin selected for the cluster during installation.

Cluster Network Operator¶

The Cluster Network Operator implements the network API from the operator.openshift.io API group. The Operator deploys the OVN-Kubernetes network plugin, or the network provider plugin that you selected during cluster installation, by using a daemon set.

The Cluster Network Operator is deployed during installation as a Kubernetes Deployment.

Procedure

1. Run the following command to view the Deployment status:
   terminal

   $ oc get -n openshift-network-operator deployment/network-operator

   Example output

   NAME               READY   UP-TO-DATE   AVAILABLE   AGE
   network-operator   1/1     1            1           56m

2. Run the following command to view the state of the Cluster Network Operator:
   terminal

   $ oc get clusteroperator/network

   Example output

   NAME      VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE
   network   4.16.1     True        False         False      50m

   The following fields provide information about the status of the operator: AVAILABLE, PROGRESSING, and DEGRADED. The AVAILABLE field is True when the Cluster Network Operator reports an available status condition.

Viewing the cluster network configuration¶

You can view your OpenShift Container Platform cluster network configuration by using the oc describe command for the network.config/cluster resource.

Procedure

• Use the oc describe command to view the cluster network configuration:
  terminal

  $ oc describe network.config/cluster

  Example output

  Name:         cluster
  Namespace:
  Labels:       <none>
  Annotations:  <none>
  API Version:  config.openshift.io/v1
  Kind:         Network
  Metadata:
    Creation Timestamp:  2024-08-08T11:25:56Z
    Generation:          3
    Resource Version:    29821
    UID:                 808dd2be-5077-4ff7-b6bb-21b7110126c7
  Spec:
    Cluster Network:
      Cidr:         10.128.0.0/14
      Host Prefix:  23
    External IP:
      Policy:
    Network Diagnostics:
      Mode:
      Source Placement:
      Target Placement:
    Network Type:  OVNKubernetes
    Service Network:
      172.30.0.0/16
  Status
    Cluster Network:
      Cidr:               10.128.0.0/14
      Host Prefix:        23
    Cluster Network MTU:  1360
    Conditions:
      Last Transition Time:  2024-08-08T11:51:50Z
      Message:
      Observed Generation:   0
      Reason:                AsExpected
      Status:                True
      Type:                  NetworkDiagnosticsAvailable
    Network Type:            OVNKubernetes
    Service Network:
      172.30.0.0/16
  Events:  <none>

  where:

  spec

  Specifies the field that displays the configured state of the cluster network.

  Status

  Displays the current state of the cluster network configuration.

Viewing Cluster Network Operator status¶

You can inspect the status and view the details of the Cluster Network Operator by using the oc describe command.

Procedure

• Run the following command to view the status of the Cluster Network Operator:
  terminal

  $ oc describe clusteroperators/network

Enabling IP forwarding globally¶

From OpenShift Container Platform 4.14 onward, OVN-Kubernetes disables global IP forwarding by default. By setting the Cluster Network Operator gatewayConfig.ipForwarding spec to Global, you can enable cluster-wide forwarding.

Procedure

1. Backup the existing network configuration by running the following command:
   terminal

   $ oc get network.operator cluster -o yaml > network-config-backup.yaml

2. Run the following command to modify the existing network configuration:
   terminal

   $ oc edit network.operator cluster

   1. Add or update the following block under spec as illustrated in the following example:
      yaml

      spec:
        clusterNetwork:
        - cidr: 10.128.0.0/14
          hostPrefix: 23
        serviceNetwork:
        - 172.30.0.0/16
        networkType: OVNKubernetes
        clusterNetworkMTU: 8900
        defaultNetwork:
          ovnKubernetesConfig:
            gatewayConfig:
              ipForwarding: Global

   2. Save and close the file.
3. After applying the changes, the OpenShift Cluster Network Operator (CNO) applies the update across the cluster. You can monitor the progress by using the following command:
   terminal

   $ oc get clusteroperators network

   The status should eventually report as Available, Progressing=False, and Degraded=False.

4. Alternatively, you can enable IP forwarding globally by running the following command:
   terminal

   $ oc patch network.operator cluster -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"ipForwarding": "Global"}}}}}' --type=merge

   Note

   The other valid option for this parameter is Restricted in case you want to revert this change. Restricted is the default and with that setting global IP address forwarding is disabled.

Viewing Cluster Network Operator logs¶

You can view Cluster Network Operator logs by using the oc logs command.

Procedure

• Run the following command to view the logs of the Cluster Network Operator:
  terminal

  $ oc logs --namespace=openshift-network-operator deployment/network-operator

Cluster Network Operator configuration¶

To manage cluster networking, configure the Cluster Network Operator (CNO) Network custom resource (CR) named cluster so the cluster uses the correct IP ranges and network plugin settings for reliable pod and service connectivity. Some settings and fields are inherited at the time of install or by the default.Network.type plugin, OVN-Kubernetes.

The CNO configuration inherits the following fields during cluster installation from the Network API in the Network.config.openshift.io API group:

clusterNetwork

IP address pools from which pod IP addresses are allocated.

serviceNetwork

IP address pool for services.

defaultNetwork.type

Cluster network plugin. OVNKubernetes is the only supported plugin during installation.

You can specify the cluster network plugin configuration for your cluster by setting the fields for the defaultNetwork object in the CNO object named cluster.

Cluster Network Operator configuration object¶

The fields for the Cluster Network Operator (CNO) are described in the following table:

Cluster Network Operator configuration object

spec:
  clusterNetwork:
  - cidr: 10.128.0.0/19
    hostPrefix: 23
  - cidr: fd01::/48
    hostPrefix: 64

spec:
  serviceNetwork:
  - 172.30.0.0/14
  - fd02::/112

spec:
  additionalRoutingCapabilities:
    providers:
    - FRR

defaultNetwork object configuration¶

The values for the defaultNetwork object are defined in the following table:

defaultNetwork object

Configuration for the OVN-Kubernetes network plugin¶

The following table describes the configuration fields for the OVN-Kubernetes network plugin:

ovnKubernetesConfig object

ovnKubernetesConfig.ipv4 object

ovnKubernetesConfig.ipv6 object

policyAuditConfig object

gatewayConfig object

gatewayConfig.ipv4 object

gatewayConfig.ipv6 object

ipsecConfig object

defaultNetwork:
  type: OVNKubernetes
  ovnKubernetesConfig:
    mtu: 1400
    genevePort: 6081
    ipsecConfig:
      mode: Full

Cluster Network Operator example configuration¶

A complete CNO configuration is specified in the following example:

apiVersion: operator.openshift.io/v1
kind: Network
metadata:
  name: cluster
spec:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  serviceNetwork:
  - 172.30.0.0/16
  networkType: OVNKubernetes