diff --git a/docs/networking/hostnetworkconfig.md b/docs/networking/hostnetworkconfig.md index b33d2bea0e..e158133172 100644 --- a/docs/networking/hostnetworkconfig.md +++ b/docs/networking/hostnetworkconfig.md @@ -57,138 +57,70 @@ A VlanConfig / NetworkConfig exists for the cluster network and covers the inten For static mode: valid CIDR addresses are prepared for each node. For underlay selection: the HostNetworkConfig must span all nodes in the cluster. -### Configuring Host Network Config -Via kubectl -Create a HostNetworkConfig manifest and apply it with `kubectl apply -f .yaml`. +### Configuring the Host Networks -#### Examples +#### Host Network Configuration without Node Selectors -##### DHCP Mode — All Nodes -Creates a VLAN sub-interface on cluster network cn-1 with VLAN ID 2012 and assigns an IP address via DHCP on every node covered by the cluster network's VlanConfig. +1. On the Harvester UI, go to **Networks > Host Networks**. -``` -apiVersion: network.harvesterhci.io/v1beta1 -kind: HostNetworkConfig -metadata: - name: cn1-vlan2012-dhcp -spec: - clusterNetwork: cn-1 - vlanID: 2012 - mode: dhcp -``` +1. Click **Create**. -After applying, the following is configured on each node: + ![](/img/hnc-1.png) -- VLAN 2012 is added to the bridge and uplink ports (cn-1-br, cn-1-bo). -- Sub-interface cn-1-br.2012 is created and brought up. -- An IP address is obtained via DHCP and applied to the sub-interface. +1. Specify a unique name for the host network. -##### Static Mode — Per-Node IPs +1. On the **Mode** tab, configure the following settings: -Assigns specific IP addresses to each node's sub-interface. + - **Mode**: Specify how IP addresses are assigned to the host network interface. + - **DHCP**: Automatically assigns IP addresses from a DHCP server. + - **Static**: Requires you to manually specify the IP address, subnet mask, and gateway. + - **Cluster Network**: Select the cluster network to associate with this host network. + - **VLAN ID**: Specify the VLAN ID for tagged traffic. -``` -apiVersion: network.harvesterhci.io/v1beta1 -kind: HostNetworkConfig -metadata: - name: cn1-vlan2012-static -spec: - clusterNetwork: cn-1 - vlanID: 2012 - mode: static - ips: - node1: 192.168.1.10/24 - node2: 192.168.1.11/24 - node3: 192.168.1.12/24 -``` +1. Click **Create**. -:::note +#### Host Network Configuration with Node Selectors -Replace the node names "node1,node2,node3" with the actual node names from your cluster +1. On the Harvester UI, go to **Networks > Host Networks**. -In static mode, you must provide an IP entry for every node covered by the VlanConfig's node selector. If a node is added to the cluster later, update the HostNetworkConfig to include the new node's IP before the config will apply to it. +1. Click **Create**. -::: + ![](/img/hnc-2.png) -##### Node Selector — Targeted Nodes Only +1. Specify a unique name for the host network. -Applies the config only to nodes with the label network-role=l3. +1. On the **Mode** tab, configure the following settings: -``` -apiVersion: network.harvesterhci.io/v1beta1 -kind: HostNetworkConfig -metadata: - name: cn1-vlan2014-selected -spec: - nodeSelector: - matchLabels: - network-role: l3 - clusterNetwork: cn-1 - vlanID: 2014 - mode: dhcp -``` -Label the desired nodes before or after creating the resource: + - **Mode**: Specify how IP addresses are assigned to the host network interface. + - **DHCP**: Automatically assigns IP addresses from a DHCP server. + - **Static**: Requires you to manually specify the IP address, subnet mask, and gateway. + - **Cluster network**: Select the cluster network to associate with this host network. + - **VLAN ID**: Specify the VLAN ID for tagged traffic. -``` -kubectl label node network-role=l3 -``` +1. On the **Node Selector** tab, define rules that match specific labels applied to nodes. + + Harvester applies the host network configuration only to nodes targeted by the defined node selector rules. -When a label is removed from a node, -``` -kubectl label node network-role=- -``` -the VLAN interface and bridge VLAN entry are automatically removed from that node. + ![](/img/hnc-2.png) -##### Management Cluster Network +1. Click **Create**. -The mgmt cluster network is also supported. This creates a VLAN sub-interface on the management bridge. - -``` -apiVersion: network.harvesterhci.io/v1beta1 -kind: HostNetworkConfig -metadata: - name: mgmt-vlan2014-dhcp -spec: - clusterNetwork: mgmt - vlanID: 2014 - mode: dhcp -``` - -:::note - -Linux network interface names are limited to 15 characters. Ensure that the generated bridge name in the format `ClusterNetworkName>-br.` does not exceed this limit. - -::: - -### Configuring the Underlay of the Harvester Overlay Networking +#### Configuring the Underlay of the Harvester Overlay Networking By default, KubeOVN uses the management interface `(mgmt-br.)` as the underlay tunnel interface for inter-node VM traffic. You can designate any HostNetworkConfig with a configured VLAN interface as the underlay instead. Why Change the Underlay? + Separates VM inter-node (VXLAN) traffic from management traffic, reducing contention. Allows use of a dedicated physical NIC and VLAN for VM traffic. Enforces network best practices in environments where the management plane must be isolated from the data plane. How to Set the Underlay: -Set underlay: true on the HostNetworkConfig that should carry overlay traffic: +Select the **Underlay** option to enable a custom underlay interface on the host network. -``` -apiVersion: network.harvesterhci.io/v1beta1 -kind: HostNetworkConfig -metadata: - name: cn1-vlan2012-underlay -spec: - underlay: true - clusterNetwork: cn-1 - vlanID: 2012 - mode: static - ips: - node1: 10.115.8.15/21 - node2: 10.115.8.16/21 - node3: 10.115.8.17/21 -``` +![](/img/hnc-3.png) -When underlay: true is set: +When underlay is enabled, The hostnetworkconfig agent updates the ovn.kubernetes.io/tunnel_interface annotation on each node to point to the new sub-interface (e.g., cn-1-br.2012). KubeOVN automatically updates the remote VXLAN tunnel endpoints in the OVS bridges on each node to use the new interface's IPs. @@ -226,8 +158,8 @@ ovs-vsctl show ``` -Reverting to the Default Underlay -Set underlay: false on the resource. The agent restores the ovn.kubernetes.io/tunnel_interface annotation to the default management interface and KubeOVN reconfigures tunnel endpoints accordingly. +Reverting to the Default Underlay: +Clear the **Underlay** option to disable the custom underlay interface. The agent restores the `ovn.kubernetes.io/tunnel_interface` annotation to the default management interface, and Kube-OVN reconfigures the tunnel endpoints accordingly. ### Behavior Reference @@ -309,14 +241,6 @@ status: ``` -Update the config using the following command: - -`kubectl edit hostnetworkconfig cn1-vlan2012-dhcp` and edit the contents and save the config. - -Delete the config using the following command: - -`kubectl delete hostnetworkconfig cn1-vlan2012-dhcp`. - :::caution If a node has multiple host interfaces, do not attach them to the same VLAN or subnet. This restriction applies to interfaces configured manually on the host and those configured through `HostNetwork` configurations. diff --git a/docs/networking/kubeovn-vm-isolation.md b/docs/networking/kubeovn-vm-isolation.md index 47ca59b59a..e5bd5432d2 100644 --- a/docs/networking/kubeovn-vm-isolation.md +++ b/docs/networking/kubeovn-vm-isolation.md @@ -30,6 +30,19 @@ Isolation between virtual machines is typically achieved using either VLANs (in For more information about the schema and usage guidelines, see [Subnet ACL](https://kubeovn.github.io/docs/v1.13.x/en/guide/subnet/#subnet-acl) and [ACL API Reference](https://kubeovn.github.io/docs/v1.13.x/en/reference/kube-ovn-api/#acl) in the Kube-OVN documentation. +### Configuration + +See [Subnet Settings](./kubeovn-vpc.md#subnet-settings) for information about basic subnet configuration. + +On the **Access Control List** tab, define traffic rules with the following components: + +- **Action**: Action to take when traffic matches the rule. +- **Direction**: Traffic flow to which the rule applies (ingress or egress). +- **Priority**: Integer that determines when the rule is evaluated. Rules with larger values are evaluated first (for example, `1000` takes precedence over `100`). +- **Match**: Packet filtering criteria, such as the source or destination IP address. + + ![](/img/subnet-acl.png) + ### Examples - Example 1: All virtual machines within the `172.20.10.0/24` subnet, except those with the addresses `172.20.10.2` and `172.20.10.3` in the subnet range `172.20.10.0/30`, are allowed to communicate with each other. @@ -166,6 +179,40 @@ NetworkPolicy rules deny traffic by default. To avoid affecting other pods, ensu ::: +### Configuration + + +1. On the Harvester UI, go to **Overlay Networks > Policies**. + +1. Click **Create**. + +1. On the **Ingress Rules** tab, configure the following settings: + + - **Sources**: IP blocks, namespaces, or pods from which inbound traffic is permitted. + - **Allowed ports**: Network ports and protocols open to inbound traffic. + + ![](/img/np-ingress.png) + +1. On the **Egress Rules** tab, configure the following settings: + + **Targets**: IP blocks, namespaces, or pods to which outbound traffic is permitted. + **Allowed ports**: Network ports and protocols permitted for outbound traffic. + + ![](/img/np-egress.png) + +1. On the **Selectors** tab, define rules that select the workload pods to which this network policy applies. + + ![](/img/np-selectors.png) + +1. On the **Labels and Annotations** tab, configure the following settings: + + - **Labels**: Key-value pairs used to categorize and filter the `NetworkPolicy` resource. + - **Annotations**: Non-identifying metadata used by external tools or system controllers. + + ![](/img/np-labels.png) + +1. Click **Create**. + The examples in this document focus on achieving isolation between VMs within the same subnet. ### Examples diff --git a/static/img/hnc-1.png b/static/img/hnc-1.png new file mode 100644 index 0000000000..abda09d94e Binary files /dev/null and b/static/img/hnc-1.png differ diff --git a/static/img/hnc-2.png b/static/img/hnc-2.png new file mode 100644 index 0000000000..9c9047dced Binary files /dev/null and b/static/img/hnc-2.png differ diff --git a/static/img/hnc-3.png b/static/img/hnc-3.png new file mode 100644 index 0000000000..c826939fd6 Binary files /dev/null and b/static/img/hnc-3.png differ diff --git a/static/img/np-egress.png b/static/img/np-egress.png new file mode 100644 index 0000000000..0f9c81b4da Binary files /dev/null and b/static/img/np-egress.png differ diff --git a/static/img/np-ingress.png b/static/img/np-ingress.png new file mode 100644 index 0000000000..296f6af1ca Binary files /dev/null and b/static/img/np-ingress.png differ diff --git a/static/img/np-labels.png b/static/img/np-labels.png new file mode 100644 index 0000000000..5689e8d142 Binary files /dev/null and b/static/img/np-labels.png differ diff --git a/static/img/np-selectors.png b/static/img/np-selectors.png new file mode 100644 index 0000000000..10fffbc56a Binary files /dev/null and b/static/img/np-selectors.png differ diff --git a/static/img/subnet-acl.png b/static/img/subnet-acl.png new file mode 100644 index 0000000000..7614ecb577 Binary files /dev/null and b/static/img/subnet-acl.png differ