Configuring OVN-Kubernetes internal IP address subnets¶

As a cluster administrator, you can change the IP address ranges that the OVN-Kubernetes network plugin uses for the join and transit subnets.

Configure the OVN-Kubernetes join subnet¶

You can change the join subnet used by OVN-Kubernetes to avoid conflicting with any existing subnets already in use in your environment.

Prerequisites

Install the OpenShift CLI (oc).
Log in to the cluster with a user with cluster-admin privileges.
Ensure that the cluster uses the OVN-Kubernetes network plugin.

Procedure

To change the OVN-Kubernetes join subnet, enter the following command:
```
$ oc patch network.operator.openshift.io cluster --type='merge' \
  -p='{"spec":{"defaultNetwork":{"ovnKubernetesConfig":
    {"ipv4":{"internalJoinSubnet": "<join_subnet>"},
    "ipv6":{"internalJoinSubnet": "<join_subnet>"}}}}}'
```
where:

<join_subnet>

Specifies an IP address subnet for internal use by OVN-Kubernetes. The subnet must be larger than the number of nodes in the cluster and it must be large enough to accommodate one IP address per node in the cluster. This subnet cannot overlap with any other subnets used by OpenShift Container Platform or on the host itself. The default value for IPv4 is 100.64.0.0/16 and the default value for IPv6 is fd98::/64.
Example output
```
network.operator.openshift.io/cluster patched
```

Verification

To confirm that the configuration is active, enter the following command:

$ oc get network.operator.openshift.io \
  -o jsonpath="{.items[0].spec.defaultNetwork}"

The command operation can take up to 30 minutes for this change to take effect.

Example output

{
  "ovnKubernetesConfig": {
    "ipv4": {
      "internalJoinSubnet": "100.64.1.0/16"
    },
  },
  "type": "OVNKubernetes"
}

Configure the OVN-Kubernetes masquerade subnet as a postinstallation operation¶

You can change the masquerade subnet used by OVN-Kubernetes as a postinstallation operation to avoid conflicts with any existing subnets that are already in use in your environment.

Prerequisites

Install the OpenShift CLI (oc).
Log in to the cluster as a user with cluster-admin privileges.

Procedure

Change your cluster’s masquerade subnet:
- For dual-stack clusters that use IPv6, run the following command:
```
$ oc patch networks.operator.openshift.io cluster --type=merge -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"ipv4":{"internalMasqueradeSubnet": "<ipv4_masquerade_subnet>"},"ipv6":{"internalMasqueradeSubnet": "<ipv6_masquerade_subnet>"}}}}}}'
```
  where:
  
  ipv4_masquerade_subnet
  
  Specifies an IPv4 address for the masquerade subnet. This range cannot overlap with any other subnet that OpenShift Container Platform or the host uses. In versions of OpenShift Container Platform earlier than 4.17, the default value for IPv4 was 169.254.169.0/29, and clusters that you upgrade to version 4.17 keep this value. For new clusters starting from version 4.17, the default value is 169.254.0.0/17.
  
  ipv6_masquerade_subnet
  
  Specifies an IPv6 address for the masquerade subnet. This range cannot overlap with any other subnet that OpenShift Container Platform or the host uses. The default value for IPv6 is fd69::/125.
- For clusters that use IPv4, run the following command:
```
$ oc patch networks.operator.openshift.io cluster --type=merge -p '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"ipv4":{"internalMasqueradeSubnet": "<ipv4_masquerade_subnet>"}}}}}}'
```
  where:
  
  ipv4_masquerade_subnet
  
  Specifies an IPv4 address for the masquerade subnet. This range cannot overlap with any other subnet that OpenShift Container Platform or the host uses. In versions of OpenShift Container Platform earlier than 4.17, the default value for IPv4 was 169.254.169.0/29, and clusters that you upgrade to version 4.17 keep this value. For new clusters starting from version 4.17, the default value is 169.254.0.0/17.

Configure the OVN-Kubernetes transit subnet¶

You can change the transit subnet used by OVN-Kubernetes to avoid conflicting with any existing subnets already in use in your environment.

Prerequisites

Install the OpenShift CLI (oc).
Log in to the cluster with a user with cluster-admin privileges.
Ensure that the cluster uses the OVN-Kubernetes network plugin.

Procedure

To change the OVN-Kubernetes transit subnet, enter the following command:
```
$ oc patch network.operator.openshift.io cluster --type='merge' \
  -p='{"spec":{"defaultNetwork":{"ovnKubernetesConfig":
    {"ipv4":{"internalTransitSwitchSubnet": "<transit_subnet>"},
    "ipv6":{"internalTransitSwitchSubnet": "<transit_subnet>"}}}}}'
```
where:

<transit_subnet>

Specifies an IP address subnet for the distributed transit switch that enables east-west traffic. This subnet cannot overlap with any other subnets used by OVN-Kubernetes or on the host itself. The default value for IPv4 is 100.88.0.0/16 and the default value for IPv6 is fd97::/64.
Example output
```
network.operator.openshift.io/cluster patched
```

Verification

To confirm that the configuration is active, enter the following command:

$ oc get network.operator.openshift.io \
  -o jsonpath="{.items[0].spec.defaultNetwork}"

It can take up to 30 minutes for this change to take effect.

Example output

{
  "ovnKubernetesConfig": {
    "ipv4": {
      "internalTransitSwitchSubnet": "100.88.1.0/16"
    },
  },
  "type": "OVNKubernetes"
}