7. Managing Networking¶
The Robin platform extends Kubernetes networking via both Calico and SR-IOV/Open vSwitch-based CNI (Container Network Interface) drivers. This dual support offers flexibility in using either overlay networks to create non-rigid L3 subnets that span multiple data centers/cloud environments, or bridged networking to get wire-speed network access for high-performance applications. In either mode, Robin enhances the CNI driver to retain the IP address of the Pod when it is restarted or relocated. This provides additional flexibility during the application lifecycle management process for operations such as scaling and migration, as well as ensuring high availability.
7.1. IP-Pool Management¶
An IP-Pool is a construct in Robin that groups together a set of IP addresses. The main properties of an IP-Pool is the aforementioned range of addresses specified, the netmask and the backing network driver. The netmask assigned indicates the number of IP addresses that can be used from the specified range. In addition Robin supports a multitude of network drivers through which the container networking is orchestrated and enabled. The supported drivers include: Calico, OVS, and SR-IOV. For more information on considerations when selecting a driver please review the below section on CNI plugins.
As part of the installation process, Robin creates two Calico backed IP-Pools named robin-default and nonrobin-default respectively for the users convenience. The former uses the range 172.21.0-15.0-255 whilst the later is assigned the range 172.21.16-31.0-255. As the name suggests the nonrobin-default is used by Kubernetes when the applications are deployed using native Kubernetes tools. Its counter-part can be used for the applications deployed via Robin Bundles.
Note
The nonrobin-default IP-Pool is hidden by default as Robin does not utilize it directly.
When creating an application, one can specify an IP-Pool to be used at the Vnode level. As a result, the IP Address assigned to a container can be easily controlled and managed by the user. Moreover, in situations where a container needs multiple IP addresses, one can specify a set of IP-Pools and the number IP Addresses that need to be assigned from each of them in order to satisfy the requirement. However in the aforementioned situation if there are multiple IP-Pools containing default gateways, all of the gateways will programmed as source based routes except for the first.
Along with additional details, the following commands are described in this section:
|
Add an IP-Pool |
|
Add certificates to an existing IP-Pool |
|
Add additional IP ranges to an existing IP-Pool |
|
List IP-Pools |
|
Display detailed information about an IP-Pool |
|
Remove an IP-Pool |
|
Remove a range of IP addresses from an existing IP-Pool |
|
Rename an existing IP-Pool |
7.1.1. Adding an IP-Pool¶
To add an IP-Pool for Robin to utilize during application deployment, issue the following command:
# robin ip-pool add <name>
--ranges <ranges>
--network <network>
--netmask <netmask>
--prefix <prefix>
--zone <zone>
--tenant <tenant>
--vlan <vlan>
--driver <driver>
--gateway <gateway>
--nameserver <nameserver>
--dns-search <dns_search>
--nictags <nic_tags>
--ifcount <if_count>
--routes <routes>
--vfdriver <vf_driver>
--master-interface <master_interface>
--macvlan-mode <macvlan_mode>
--mtu <mtu>
|
IP-Pool Name |
|
Comma separated list of IP ranges to assign to IP-Pool. Each range can also be specified in CIDR format |
|
IP network without ranges to be used for static IP allocations |
|
Mask indicating number of IP addresses that can be used from given range |
|
CIDR prefix to be used with the IP Pool |
|
Name of zone in which to create this IP-Pool |
|
Name of Tenant to which this IP-Pool belongs to |
|
VLAN to be associated with this IP-Pool. Note this option is only valid for OVS and SR-IOV driver backed IP-Pools |
|
Driver to back this IP-Pool. Valid choices include: OVS, Calico, Secondary, Isolated, MACVLAN and SR-IOV |
|
Default gateway to be used for this IP-Pool |
|
Comma separated list of DNS name servers to be used for Pods deployed using this IP-Pool |
|
Comma separated list of DNS search strings to be used for Pods deployed using this IP-Pool |
|
Comma separated NIC tags to select when assigning interfaces from this network. Each tag must be specified as key/value pair. Only keys “name” and “pci_address” are supported |
|
Preset the interface count when using this network. Applicable only for the SR-IOV driver |
|
Comma separated list of routes to associated with this network |
|
Kernel driver to bind to when attaching an SR-IOV virtual function. Applicable only for the SR-IOV driver |
|
Master interface to be used for the MACVLAN plugin. Applicable only for the MACVLAN driver |
|
Mode for the MACVLAN plugin in order to configure the traffic visibility on the virtual network. Applicable only for the MACVLAN driver. Valid choices include: Private, Vepa and Bridge. The default value is Bridge when the MACVLAN driver is used |
|
Set the maximum transmission unit (MTU) value for the interfaces within the IP-Pool. The default value is 1500 |
Note
At least one of the --network or --ranges options must be given when creating an IP-Pool however both cannot be used. Similarly either one of the --prefix or --netmask parameters must be utilized but both cannot be specified. If an IP-Pool is created without ranges, it can only be used for static IP Address allocations.
Example 1 (Creating a basic OVS IP-Pool):
# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver ovs
Registered IP pool demo.
Example 2 (Creating an SR-IOV IP-Pool with VLAN):
# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver sriov --vlan 500
Registered IP pool demo.
With the above IP-Pool Robin will select VF’s based on the VLANs allowed for a particular NIC.
Example 3 (Creating an SR-IOV IP-Pool with NIC tags using the pci_address parameter):
# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver sriov --vlan 500 --nictags pci_addr=0000:3b:00.0
Registered IP pool demo.
With the above IP-Pool Robin will select VF’s only from NICs with the pci address “0000:3b:00.0”.
Example 5 (Creating an SR-IOV IP-Pool with NIC tags using the name parameter):
# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver sriov --vlan 500 --nictags name=sriov0
Registered IP pool demo.
With the above IP-Pool Robin will select VF’s only from NICs with the name “sriov0”.
Example 6 (Creating an SR-IOV IP-Pool with Bonded VFs):
# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --ifcount 2 --nictags name=sriov0,name=sriov2
Registered IP pool demo.
With the above IP-Pool Robin will select one VF from a NIC named sriov0, one VF from a NIC named sriov2 and bond them together.
Example 7 (Creating an SR-IOV IP-Pool with Bonded VFs based on VLAN):
# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --ifcount 2
Registered IP pool demo.
With the above IP-Pool Robin will select two VFs from two NICs (one from each) where VLAN 500 is allowed and bond them together.
Example 8 (Creating an SR-IOV IP-Pool with Bonded VFs from the same NIC):
# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --ifcount 2 --nictags name=sriov0,name=sriov0
Registered IP pool demo.
With the above IP-Pool Robin will select two VFs from a NIC named sriov0 and bond them together.
Example 9 (Creating an SR-IOV IP-Pool with VF Driver):
# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --nictags name=sriov0 --vfdriver igb_uio
Registered IP pool demo.
With the above IP-Pool Robin will select one VF from a NIC named sriov0 and bind it with the specified driver.
Example 10 (Creating an IP-Pool by specifying IP ranges in network/CIDR format):
# robin ip-pool add demo --ranges 192.10.88.0/24 --netmask 255.255.0.0 --driver ovs
Registered IP pool demo.
With the above IP-Pool Robin will configure its ranges utilizing the CIDR format i.e (/24, /16, /26 etc) with which the ranges were represented.
Example 11 (Creating an MACVLAN based IP-Pool):
# robin ip-pool add demo --driver macvlan --ranges 192.168.10.21-30 --prefix 24 --gateway 192.168.10.1 --master-interface=ens18f1 --macvlan-mode bridge
Registered IP pool demo.
With the above IP-Pool Robin will configure the MACVLAN CNI as the primary network driver with the primary master interface as ens18f1 operating in bridge mode.
Example 12 (Creating an IP-Pool for assigning secondary IP Addresses):
# robin ip-pool add demo --driver secondary --ranges 192.168.10.21-30 --prefix 24
Registered IP pool demo.
With the above IP-Pool defined Robin will construct a standard IP-Pool with the additional caveat that it can only used in conjunction with another IP-Pool (known as the primary IP-Pool) in order to enable the assignment of multiple IP Addresses to a single interface. The aforementioned primary IP-Pool must be SRIOV or OVS based.
Example 13 (Creating an isolated IP-Pool):
# robin ip-pool add demo --driver isolated --ranges 192.168.10.21-30 --prefix 24
Registered IP pool demo.
With the above IP-Pool Robin will utilize the custom robin-isolated CNI plugin in order to configure an additional IP Address on a Pod’s loopback lo interface.
Note
In all the above examples for SR-IOV backed IP-Pools, when the --vlan option is specified independently of any other parameters it acts as a constraining factor whilst also tagging outgoing packets. In every other scenario only the latter holds true. As a result when options such as the --nictags option is passed alongside the --vlan option, the latter stops becoming a constraining factor.
Adds an IP-Pool for Robin to utilize during application deployment.
End Point: /api/v3/robin_server/ip-pools
Method: POST
URL Parameters: None
Data Parameters:
ip_pool: <dict_of_ip_pool_details>–name: <ip_pool_name>- This mandatory field within the payload specifies the name of the IP-Pool to be created.driver: <ip_pool_driver>- This mandatory field within the payload specifies the network driver to be associated with the IP-Pool. Valid options include: ‘ovs’, ‘sriov’, ‘secondary’, ‘isolated’, ‘macvlan’ and ‘calico’.zoneid: <zone_name>- This mandatory field within the payload specifies the name of the zone in which the IP-Pool should be created.ranges: <list_of_range_dicts>- Utilizing this parameter within the payload, by specifying a list containing dictionaries in the form{'range': <ip_range>}for each range, results in the specified ranges being assigned to this IP-Pool.network: <ip_network>- Utilizing this parameter within the payload, by specifying an IP network without ranges, results in the specified network being used for IP allocations when utilizing this network.netmask: <netmask>- Utilizing this parameter within the payload, by specifying an appropriate mask, results in aforementioned mask being applied to the specified ranges and thus indicating the number of IP addresses that can be used.prefix: <cidr_prefix>- Utilizing this parameter within the payload, by specifying a CIDR prefix, results in the aforementioned prefix being associated with the IP-Pool.tenant: <tenant_name>- Utilizing this parameter within the payload, by specifying a tenant name, results in the IP-Pool being associated with the aforementioned tenant.vlan_number: <vlan_number>- Utilizing this parameter within the payload, by specifying a VLAN number, results in the IP-Pool being associated with the aforementioned VLAN number. Note this option is only valid for OVS and SR-IOV driver backed IP-Pools.gateway: <gateway>- Utilizing this parameter within the payload, by specifying a gateway, results aforementioned gateway being set as the default gateway for the IP-Pool.nameserver: <nameservers>- Utilizing this parameter within the payload, by specifying a string of DNS name servers which are comma seperated, results in the aforementioned name servers being used for Pods deployed using this IP-Pool.dns_search: <dns_search_strings>- Utilizing this parameter within the payload, by specifying a string of DNS search strings which are comma seperated, results in the aforementioned search strings being used for Pods deployed using this IP-Pool.nictags: <list_of_tag_dicts>- Utilizing this parameter within the payload, by specifying a list containing dictionaries in the form{<tag_key>: <tag_value>}for each NIC tag, results in only interfaces associated with the aforementioned tags being utilized when using this IP-Pool. Note only keys “name” and “pci_address” are supported.ifcount: <interface_count>- Utilizing this parameter within the payload presets the interface count for allocations to the integer specified when using this network. Valid values include 1 and 2. Note this option is only valid for SR-IOV driver backed IP-Pools.routes: <list_of_route_dicts>- Utilizing this parameter within the payload, by specifying a list containing dictionaries in the form{'dest': <destination>, 'gateway': <gateway>}for each route, results in the specified routes being associated with this IP-Pool.vfdriver: <vf_driver>- Utilizing this parameter within the payload, by specifying the name of a kernel driver, results in the aforementioned driver being bound to when attaching an SR-IOV virtual function. Valid options include: ‘igb_uio’, ‘vfio-pci’, and ‘uio_pci_generic’. Note this option is only valid for SR-IOV driver backed IP-Pools.master_interface: <master_interface>- Utilizing this parameter within the payload, by specifying the name of a valid interface, results in the aforementioned interface being used as the master interface for the MACVLAN plugin. Note this option is only valid for MACVLAN driver backed IP-Pools.macvlan_mode: <macvlan_mode>- Utilizing this parameter within the payload, by specifying the name of a valid mode, results in the MACVLAN plugin being configured with the aforementioned mode which in turn determines the traffic visibility on the virtual network. Valid options include: ‘private’, ‘vepa’, and ‘bridge’. Note this option is only valid for MACVLAN driver backed IP-Pools and the default value is ‘bridge’.
Note
At least one of the
networkorrangesproperties must be given when creating an IP-Pool however both cannot be used. Similarly either one of theprefixornetmaskproperties must be utilized but both cannot be specified. If an IP-Pool is created without ranges, it can only be used for static IP Address allocations.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error), 409 (Duplicate Resource Error)
Example Response:
Output
{
"message":"Registered IP pool demo. \n"
}
7.1.2. Adding certificates to an IP-Pool¶
To add certificates to an IP-Pool in order to make certain addresses accessible in a secure manner, issue the following command:
# robin ip-pool add-certs <name> <certificates>
--keypass <keypass>
--is_hostnames
--no_multinode
|
IP-Pool Name |
|
Path to SSL certificates file |
|
Passphrase of the key |
|
Indicates that the filename specified contains the hostname and its format is <filename>.<certtype> |
|
Indicates that the certificate can be used for multiple hosts |
Example:
# robin ip-pool add-cert demo ~/ssl/demo-cert
Added certificates.
Adds certificates to an IP-Pool in order to make certain addresses accessible in a secure manner.
End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>
Method: PUT
URL Parameters: None
Data Parameters:
action: add_certs- This mandatory field within the payload specifies that the add certificates operation is to be performed.cert_info: <dict_of_cert_details>–filename: <cert_file_name>- This mandatory field within the payload specifies the base file name of the certificate file.certificate: <cert_data>- This mandatory field within the payload specifies the base64 decoded details within the specified file.multinode: [true|false]- Utilizing this parameter within the payload indicates whether or not this certificate can be used for multiple hosts.is_hostnames: [true|false]- Utilizing this parameter within the payload indicates whether or not the specified certificate filename contains the hostname and is in the format <filename>.<certtype>.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"message":"Added certificates.\n"
}
7.1.3. Adding ranges to an IP-Pool¶
To add additional ranges to an IP-Pool in order to expand the number of IP Addresses available, issue the following command:
# robin ip-pool add-ranges <name> <ranges>
|
IP-Pool Name |
|
Comma separated list of additional IP ranges to assign to IP-Pool |
Example:
# robin ip-pool add-ranges demo 10.9.107.1-255
Added range.
Adds IP ranges that are currently assigned to an IP-Pool in order to expand the number of available IP ranges.
End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>
Method: PUT
URL Parameters: None
Data Parameters:
action: add_ranges- This mandatory field within the payload specifies that the add ranges operation is to be performed.ranges: <list_of_ranges>- This mandatory field within the payload specifies a list of comma seperated ranges to be added from the given IP-Pool.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"message":"Added range.\n"
}
7.1.4. Listing registered IP-Pools¶
To list registered IP-Pools alongside details such as the associated driver and network ranges contained within each pool, issue the following command:
# robin ip-pool list --all
--full
--json
|
Display all registered IP-Pools including hidden ones |
|
Display additional information for listed IP-Pools |
|
Output in JSON |
Example:
# robin ip-pool list --all
Name | Driver | Network | VLAN | Total | Used | Free
-----------------+--------+---------------+------+-------+------+------
nonrobin-default | calico | 172.21.0.0/16 | - | 4096 | 2 | 4094
robin-default | calico | 172.21.0.0/16 | - | 4096 | 0 | 4096
demo | ovs | 10.9.0.0/16 | - | 255 | 0 | 255
Returns all registered IP-Pools alongside details such as the associated driver and network ranges contained within each pool.
End Point: /api/v3/robin_server/ip-pools/
Method: GET
URL Parameters: None
Data Parameters:
all: true- Utilizing this parameter within the payload results in details of hidden IP-Pools being returned as well.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error)
Example Response:
Output
{
"items":[
{
"available":"4092",
"description":null,
"zone":"default",
"tenants":[
],
"subnet":"172.21.0.0",
"vfdriver":null,
"ranges":[
{
"range":"172.21.0-15.0-255"
}
],
"gateway":null,
"name":"nonrobin-default",
"netmask":"255.255.0.0",
"used":"4",
"total":"4096",
"nictags":null,
"dns_search":null,
"zone_id":1,
"driver":"calico",
"routes":[
],
"ifcount":1,
"nameserver":null
},
{
"available":"4094",
"description":null,
"zone":"default",
"tenants":[
"Administrators"
],
"subnet":"172.21.0.0",
"vfdriver":null,
"ranges":[
{
"range":"172.21.16-31.0-255"
}
],
"gateway":null,
"name":"robin-default",
"netmask":"255.255.0.0",
"used":"2",
"total":"4096",
"nictags":null,
"dns_search":null,
"zone_id":1,
"driver":"calico",
"routes":[
],
"ifcount":1,
"nameserver":null
},
{
"available":"255",
"description":null,
"zone":"default",
"tenants":[
"Administrators"
],
"subnet":"10.9.0.0",
"vfdriver":null,
"ranges":[
{
"range":"10.9.106.1-255"
}
],
"gateway":null,
"name":"demo",
"netmask":"255.255.0.0",
"used":"0",
"total":"255",
"nictags":null,
"dns_search":null,
"zone_id":1,
"driver":"ovs",
"routes":[
],
"ifcount":1,
"nameserver":null
}
]
}
To list registered IP-Pools via the robinippool custom resource alongside details such as the associated driver, network ranges, VLANs and bonded NICs contained within each pool, issue the following command:
# kubectl get robinippool
Example:
[root@qct-05 ~]# kubectl get robinippool
NAME NETMASK NETWORK IPPREFIX SUBNET GATEWAY NAMESERVER DRIVER VFDRIVER RANGE(S) VLAN BONDED TRUST SPOOFCHK
robin-default 255.255.0.0 172.21.0.0 calico ["172.21.16-31.0-255"] 1
sec-1 255.255.255.0 24 192.168.1.0 secondary ["192.168.1.11-20"] 1
sec-2 255.255.255.0 24 192.168.2.0 secondary ["192.168.2.11-20"] 1
sriov-b1 255.255.255.0 192.168.110.0 sriov ["192.168.110.165-170"] 20 2 off on
sriov-b2 255.255.255.0 192.168.111.0 sriov ["192.168.111.165-170"] 20 2 off on
sriov1 255.255.255.0 192.168.10.0 sriov igb_uio ["192.168.10.101-164"] 20 1 off on
sriov10 255.255.255.0 192.168.100.0 sriov native ["192.168.100.101-164"] 20 1 off on
sriov2 255.255.255.0 192.168.20.0 sriov igb_uio ["192.168.20.101-164"] 20 1 off on
sriov3 255.255.255.0 192.168.30.0 sriov igb_uio ["192.168.30.101-164"] 20 1 off on
sriov4 255.255.255.0 192.168.40.0 sriov igb_uio ["192.168.40.101-164"] 20 1 off on
sriov5 255.255.255.0 192.168.50.0 sriov native ["192.168.50.101-164"] 20 2 off on
sriov6 255.255.255.0 192.168.60.0 sriov native ["192.168.60.101-164"] 20 2 off on
sriov7 255.255.255.0 192.168.70.0 sriov native ["192.168.70.101-164"] 20 1 off on
sriov8 255.255.255.0 192.168.80.0 sriov native ["192.168.80.101-164"] 20 1 off on
sriov9 255.255.255.0 192.168.90.0 sriov native ["192.168.90.101-164"] 20 1 off on
sriov98 255.255.255.0 192.168.98.0 sriov igb_uio ["192.168.98.101-164"] 20 1 off on
sriov99 255.255.255.0 192.168.99.0 sriov igb_uio ["192.168.99.101-164"]
7.1.5. Show information about a specific IP-Pool¶
To view details about a particular IP-Pool including its utilization, associated driver, and the network range(s) it covers, issue the following command:
# robin ip-pool info <name>
--ip-allocations
--instance-ips
--json
|
Name of IP-Pool |
|
Display IP allocations of each pod created using helm or kubectl within the specified IP-Pool |
|
Display IP allocations of each pod created using a Robin bundle within the specified IP-Pool |
|
Output in JSON |
Example:
# robin ip-pool info demo
IPPool: demo
Driver: ovs
Subnet: 10.10.2.0
Netmask: 255.255.255.0
Range: 10.10.2.102-130
Pool Utilization: 0/29/29 (Used/Available/Total)
Returns details about a particular IP-Pool including its utilization, associated driver, and the network range(s) it covers.
End Point: /api/v3/robin_server/ip-pools/
Method: GET
URL Parameters: None
Data Parameters:
name: <ip-pool-name>- This mandatory parameter within the payload specifies which IP-Pool actually needs to be queried.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error)
Example Response:
Output
{
"items":[
{
"available":"255",
"description":null,
"zone":"default",
"tenants":[
"Administrators"
],
"subnet":"10.9.0.0",
"vfdriver":null,
"ranges":[
{
"range":"10.9.106.1-255"
}
],
"gateway":null,
"name":"demo",
"netmask":"255.255.0.0",
"used":"0",
"total":"255",
"nictags":null,
"dns_search":null,
"zone_id":1,
"driver":"ovs",
"routes":[
],
"ifcount":1,
"nameserver":null
}
]
}
7.1.6. Removing an IP-Pool¶
To remove an IP-Pool from Robin, issue the following command:
# robin ip-pool remove <name>
--yes
|
IP-Pool Name |
|
Do not prompt the user for confirmation of deletion |
Example:
# robin ip-pool remove demo --yes
Unregistered IP-Pool 'demo'.
Removes an IP-Pool from Robin.
End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>
Method: DELETE
URL Parameters: None
Data Parameters: None
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error)
Example Response:
Output
{
"message":"Unregistered IP pool demo.\n"
}
7.1.7. Removing ranges from an IP-Pool¶
To remove IP ranges that are currently assigned to an IP-Pool in order to reduce the number of available IP ranges, issue the following command:
# robin ip-pool remove-ranges <name> <ranges>
--yes
|
IP-Pool Name |
|
Comma separated list of IP ranges to remove from an IP-Pool |
|
Do not prompt the user for confirmation of removal |
Example:
# robin ip-pool remove-ranges demo 10.9.107.1-255 --yes
Removed range.
Removes IP ranges that are currently assigned to an IP-Pool in order to reduce the number of available IP ranges.
End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>
Method: PUT
URL Parameters: None
Data Parameters:
action: remove_ranges- This mandatory field within the payload specifies that the remove ranges operation is to be performed.ranges: <list_of_ranges>- This mandatory field within the payload specifies a list of comma seperated ranges to be removed from the given IP-Pool.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"message":"Removed range.\n"
}
7.1.8. Renaming an IP-Pool¶
To rename an IP-Pool, issue the following command:
# robin ip-pool rename <name> <new_name>
|
IP-Pool Name |
|
New name of the specified IP-Pool |
Example:
# robin ip-pool rename demo demo_change
IP-Pool 'demo' renamed to 'demo_change'.
Renames an existing IP-Pool.
End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>
Method: PUT
URL Parameters: None
Data Parameters:
action: rename- This mandatory field within the payload specifies that the rename operation is to be performed.new_name: <new_ippool_name>- This mandatory field within the payload specifies the new name for the specified IP-Pool.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"message":"IP-Pool 'demo' renamed to 'demo_change'.\n"
}
7.2. VLAN Support¶
The VLAN (Virtual LAN) feature allows one to logically group a set of devices in the same L2 domain irrespective of how they are physically connected. Additionally one can carve out logical groups even if the devices are connected to the same L2 switch. Listed below are some of the advantages of using VLANs:
Performance - Broadcast traffic is sent to all the nodes in an L2 domain. VLANs allow creating groups or virtual L2 domains, thus containing the broadcast traffic to the created logical groups.
Isolation and Security - VLANs allow one to control the broadcast domain and enforce which logical groups can talk to one another
Flexibility - A device can be easily added/removed from a VLAN logical group without actually changing the physical connectivity
Cost Reduction - VLANs can be used to create broadcast domains without the need for expensive routers
Along with additional details, the following commands are described in this section:
|
Register a VLAN |
|
List VLANs |
|
Unregister a VLAN |
|
Configure a VLAN for an interface on a host |
|
Remove a VLAN from an interface on a host |
7.2.1. Registering a VLAN¶
To register a VLAN with Robin so it can be configured for an interface, issue the following command:
# robin vlan add <vlan_number>
--skip-vlan-interface
--add-vlan-interface
Note
The Robin server might need to access pods deployed in a particular VLAN. As a result a VLAN interface needs to be created on the current Robin Master. This VLAN interface is created, when --add-vlan-interface is enabled, on the aforementioned node when an IP-Pool is created and has an associated VLAN. The IP address linked to the VLAN interface is picked from the addresses provided in the IP Pool. In some deployments, VLAN routing could be provided in a different manner and thus a VLAN interface might not be needed on the Robin Master. If this is the case, you can create VLAN with --skip-vlan-interface option (this is the default behavior).
|
VLAN number/identifier |
|
Skips VLAN interface configuration on the Robin Master node |
|
Configures the VLAN interface on the Robin Master node |
Example:
# robin vlan add 9 --wait
Job: 180 Name: VLANAdd State: PROCESSED Error: 0
Job: 180 Name: VLANAdd State: COMPLETED Error: 0
Registers a VLAN with Robin so it can be configured for an interface.
End Point: /api/v3/robin_server/vlans
Method: POST
URL Parameters: None
Data Parameters:
vlan: <vlan_number>- This mandatory field within the payload specifies the VLAN number for the VLAN to be registered.skip_vlan_interface: [true|false]- This mandatory field within the payload is a boolean value that specifies whether or not the VLAN interface should be configured on the Robin Master node.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 202
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error), 409 (Duplicate Resource Error)
Example Response:
Output
{
"jobid":209
}
7.2.2. Listing all VLANs¶
To list registered VLANs alongside details such as the IP-Pools it is assigned to and the number of NICs associated with it, issue the following command:
# robin vlan list --json
|
Output in JSON |
Example:
# robin vlan list
VLAN | IP Pools | Instance Count | Interface Count
-----+----------+----------------+-----------------
9 | None | 0 | 0
Returns all registered VLANs alongside details such as the IP-Pools it is assigned to and the number of NICs associated with it.
End Point: /api/v3/robin_server/vlans/
Method: GET
URL Parameters: None
Data Parameters: None
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error)
Example Response:
Output
{
"items":[
{
"skip_vlan_interface":true,
"ip_pools":[
],
"instance_cnt":0,
"number":9,
"nic_cnt":0
}
]
}
7.2.3. Configuring a VLAN on a host¶
Before installing Robin on a VLAN based setup, it is expected that an administrator would have planned which VLANs are to be used for deploying applications and thus configured the installation appropriately. However in order to configure a VLAN post installation, issue the following command:
# robin host add-vlan [<hosts>]
--vlans <vlans>
--interface <interface>
--all
--untagged
|
A comma separated list of hosts to add VLANs to. If this isn’t provided, then –all must be used |
|
Range of VLANs to be added (Use ‘ALL’ to enable all vlans) |
|
Interface on host on which VLANs should be added |
|
VLANs will be added to every host in the cluster |
|
Network traffic will not be tagged with the VLAN number |
Example:
# robin host add-vlan vnode89.robinsystems.com --vlans 9 --interface br0 --untagged
Job: 180 Name: HostVLANAdd State: PROCESSED Error: 0
Job: 180 Name: HostVLANAdd State: COMPLETED Error: 0
Configures a VLAN on a host after Robin installation.
End Point: /api/v3/robin_server/hosts/<hostname>
Method: PUT
URL Parameters: None
Data Parameters:
action: add_vlans- This mandatory field within the payload specifies that the add VLAN operation is to be performed.vlans: <range_of_vlans>- Utilizing this parameter in the payload, by specifying a range of VLANs, results in the aforementioned VLANs being configured on the host.all_vlans: true- Utilizing this parameter in the payload results in all possible VLANs being configured on this host. The default value is False.interface: <interface_name>- Utilizing this parameter in the payload, by specifying an interface name, results in the given VLANs being configured on the aforementioned interface.untagged: true- Utilizing this parameter in the payload results in the VLAN being configured on SR-IOV interfaces as untagged. The default value is False.
Note
Either the vlans or all_vlans parameter must be present in the request body.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 202
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"jobid":217
}
7.2.4. Removing a VLAN from a host¶
In order to remove a VLAN that is configured on an interface which is present on a host, issue the following command:
# robin host remove-vlan [<hosts>]
--vlans <vlans>
--interface <interface>
--all
|
A comma separated list of hosts to remove VLANs from. If this isn’t provided, then –all must be used |
|
Range of VLANs to be removed (Use ‘ALL’ to indicate all vlans) |
|
Interface on host from which VLANs should be removed |
|
VLANs will be removed on every host in the cluster |
Example:
# robin host remove-vlan vnode89.robinsystems.com --vlans 9 --interface br0
Job: 180 Name: HostVLANRemove State: PROCESSED Error: 0
Job: 180 Name: HostVLANRemove State: COMPLETED Error: 0
Removes a VLAN that is configured on an interface which is present on a host.
End Point: /api/v3/robin_server/hosts/<hostname>
Method: PUT
URL Parameters: None
Data Parameters:
action: remove_vlans- This mandatory field within the payload specifies that the remove VLAN operation is to be performed.vlans: <range_of_vlans>- This mandatory field within the payload specifies the range of VLANs to be removed.interface: <interface_name>- Utilizing this parameter in the payload indicates the interface on the specified host from which the VLAN(s) should be removed.
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 202
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"jobid":213
}
7.2.5. Unregistering a VLAN¶
To unregister a VLAN from Robin, issue the following command:
# robin vlan remove <vlan_number>
--yes
Note
The VLAN must be removed from all hosts it was configured on before it can be unregistered.
|
VLAN number/identifier |
|
Do not prompt the user for confirmation of removal |
Example:
# robin vlan remove 9 --wait --yes
Job: 182 Name: VLANRemove State: PROCESSED Error: 0
Job: 182 Name: VLANRemove State: COMPLETED Error: 0
Unregisters a VLAN from robin.
End Point: /api/v3/robin_server/vlans/<vlan_number>
Method: DELETE
URL Parameters: None
Data Parameters: None
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 202
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error)
Example Response:
Output
{
"jobid":83
}
7.2.6. Assumptions made about VLAN Configurations¶
Below are a list of assumptions and/or rules that made with regards to VLAN integration with Robin:
Upstream ports are configured as trunk ports and the right VLANs are allowed on these ports.
On a single host with multiple ports, then same VLAN is not configured on different ports (an exception to this rule is SR-IOV ports).
Multiple IP subnets can be configured to be carried using the same VLAN.
The same IP subnet cannot be configured for two different VLANs.
7.3. MACVLAN Support¶
With VLAN, you can create multiple sub-interfaces that uses the same MAC addresses, but the traffic is filtered based on the VLAN tag. With MACVLAN, each slave interface created on the top of the master interface is assigned a different MAC address.
You can directly bound the MACVLAN slave interface to a namespace instead of relying on a tap or veth device along with a bridge to provide underlay network connectivity.
To provide fault-tolerant connectivity to the workloads, Robin recommends using Bonded interfaces. You can also configure MACVLAN on Linux VLAN interfaces (eth0.<vlan>) to provide tagging support for workloads. For more information, see here.
MACVLAN supports containers using MACVLAN CNI, and for KVM, MACVTAP interfaces are used.
Points to consider when using MACVLAN
Robin supports the MACVLAN Bridge mode.
The MACVLAN design does not allow you to ping a workload (VM or container) from the host where the workload is deployed.
Due to the design constraint mentioned in the previous point, if you use MACVLAN as the default network for the workload, Kubernetes services may not work as expected.
It is recommended to have a dedicated interface on the node to provide MACVLAN based connectivity to the workloads.
OVS and MACVLAN provide similar kinds of connectivity, it is recommended not to use an OVS interface as the MACVLAN master interface.
By default, Robin installs OVS, but you can use the installer options
—skip-ovs-clusteror—skip-ovs-nodeto disable OVS configuration at a cluster or node level.If you are using MACVLAN as the primary CNI interface for a Pod, static routes including default gateway can be configured using the
--routesoption during IP Pool creation.
7.4. Advanced Compute and Networking Support¶
7.4.1. Supported Functionalities When Using Kubernetes YAML or Helm Chart for Deployment¶
The following are the networking based functionalities that are supported:
Multiple interfaces support
OVS support
SR-IOV device allocation
Note
Virtual Network Function deployment (including the networking components) is not currently supported via YAML/Helm Charts.
7.4.2. Specifying Dedicated CPU Request¶
If your Pod needs dedicated CPUs, then the Pod must be in guaranteed QoS class (requests = limits) and should ask for integer CPU requests.
Also, Pods need to have CPU and memory specified in requests and limits.
spec:
containers:
-name: nginx
image: nginx
resources:
limits:
memory: "200Mi"
cpu: "2"
requests:
memory: "200Mi"
cpu: "2
Check Pod’s QoS Class after deploying by following the example mentioned below:
kubectl describe Pod Pod-l2fwd-78554948b7-zrfvj | grep -i qos
QoS Class: Guaranteed
7.4.3. Prerequisites for Using Network Annotations¶
To use network annotations, you must meet the following prerequisites:
The namespace in which Helm Charts or YAML based objects are planned to be deployed in should be registered with Robin. Details on the command by which to achieve this can be found here.
All Kubernetes objects including controllers, Pods etc. that request network resources must meet one of the following conditions in order to have the appropriate network resources allocated to them by the Robin orchestrator:
Both
appandreleaselabels need to be present within the object definition. This is considered the old style of naming.Both
app.kubernetes.io/nameandapp.kubernetes.io/instancelabels need to be present within the object definition. This is considered the new style of naming. For more information on updated naming conventions, see Recommended Labels.
Note
Each controller including all StatefulSets, ReplicaSets, Deployments, and Daemonsets within a Kubernetes cluster must have a unique combination of
appandreleaselabels.
7.4.4. Assigning an interface via Network Annotations¶
In order to have an interface and consequently an IP Address from a registered IP-Pool assigned to a Pod, the robin.io/networks must first be utilized in the manner showcased in the example below. The value for this annotation must be a stringified list consisting of a dictionary containing the name of the IP-Pool from which the IP Address should be assigned from.
Note
A Pod that needs only a Calico interface does not require any annotations to be specified.
robin.io/networks: '[{"ippool": "sriov99"}]'
In order to have multiple interfaces assigned to a Pod, multiple IP-Pools can be specified in the aforemntioned annotation as shown below. This in turn inherently means that Robin supports allocating multiple IPv4 and/or IPv6 IP Addresses to a Pod.
Note
You must not use the Network Attached definitions, network annotations, and robin.io/networks annotation together in a Pod.
robin.io/networks: '[{"ippool": "ovs1"}, {"ippool": "sriov99"}]'
The list of available IP-Pools from which an IP Address can be allocated from can be viewed via either the Robin CLI or native Kubernetes as detailed here. In addition, several options can be specified within each interface request in order to customize the interface allocated. For more details review the section detailed here.
Note
When your Robin Cluster is down and if Pod creation happens at the same time using the robin.io/networks annotation, static IP address allocation for the Pod will fail. You must bounce the Pod after the Robin Cluster is up for static IP address allocation.
7.4.5. Network Annotation options¶
Described below are the options that can be utilized in order to customize the interface allocated via the robin.io/network annotation. Each of these options can be used once and in conjunction with one another within each IP-Pool requested in the aforementioned annotation.
7.4.5.1. Enabling trusted mode¶
In order to set the allocated interface into trusted mode in order to enable it to perform additional operations, specify the trust parameter as shown in the example below. By default this option is disabled.
Note
This is a L2 option for Virtual Functions.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "trust": "on"}]'
7.4.5.2. Enabling spoof checking¶
In order to enable spoof checking for the allocated interface in order to improve network security, specify the spoofchk parameter as shown in the example below. By default this option is disabled.
Note
This is a L2 option for Virtual Functions.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "spoofchk": "on"}]'
7.4.5.3. Setting the Bond mode¶
In order to configure the bond policy of the bonded interface via the Bond CNI, specify the bond_mode parameter as shown in the example below with the respective policy name. Currently Robin only supports the active-backup mode.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "bond_mode": "active-backup"}]
7.4.5.4. Allocating an interface for a container¶
In order to allocate an interface to a specific container when multiple are contained within the Pod to be deployed, specify the container parameter as shown in the example below with the respective name of the container to which the interface needs to be associated with.
Example:
annotations:
robin.io/networks: {"ippool": "sriov99", "container": "container1"}
7.4.5.5. Setting the MTU for an interface¶
In order to configure the MTU size for an allocated Virtual Function, specify the mtu parameter as shown in the example below with the desired transmission size.
Note
This configuration only affects the Virtual Function assigned, the MTU for the backend switch port and Physical Function must be set manually beforehand.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "mtu": "9000"}]'
7.4.5.6. Assigning an environment variable prefix¶
In order to specify a prefix that should prepended to the environment variables related to the assigned interface within the Pod, specify the name parameter as shown in the example below with the desired text.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "name": "FRONTHAUL"}]
7.4.5.7. Setting a custom interface name¶
In order to specify a custom interface name of no more than 15 characters for easier internal identification, specify the interface_name parameter as shown in the example below with the desired name. In addition this feature allows users to meet the interface name requirements of a network function within a Pod if needed. If this parameter is not utilized, the default Robin interface naming scheme is used.
Note
Names such as eth0 or lo should not be used as the Pod will not be created. However other common names such as net can be used if it available.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "interface_name": "sr1"}]
7.4.5.8. Assigning static IP Addresses¶
In order to specify a static IP Address that should be assigned to a Pod, utilize the static_ips parameter as shown in the example below with the list of possible static IP Addresses that can be assigned to the respective pod.
Note
A range of IP Addresses can also be specified instead of singular entries within the given list of allocatable IP Addresses.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "static_ips": ["192.168.96.10-15", "192.168.96.17"]}]'
7.4.5.9. Specifying a static IP policy¶
In order to specify a static IP policy that should be considered when allocating an IP Address to the a Pod, utilize the static_ip_policy parameter as shown in the example below with one of the following valid values:
range- This option should be used when the IP Address to be allocated needs to be within the range of viable static IP Addresses specified in the annotation. When no policy is specified this is the default option.ippool- This option should be used when the IP Address to be allocated can be any available IP Address in the specified IP-Pool when the specified static IP Addresses in the annotation are in-use.
Note
The static_ip_policy parameter is only valid when static IP Addresses are specified within the same annotation via the static_ips parameter.
Example:
annotations:
robin.io/networks: '[{"ippool": "sriov99", "static_ip_policy": "ippool", "static_ips": ["192.168.96.10-15", "192.168.96.17"]}]'
Note
When your Robin Cluster is down and if Pod creation happens at the same time using the robin.io/networks annotation, static IP address allocation for the Pod will fail. You must bounce the Pod after the Robin Cluster is up for static IP address allocation.
7.4.5.10. Assigning multiple IP Addresses to a single interface¶
In order to allocate multiple IPv4 and/or IPv6 addresses to a single interface within a Pod, utilize the primary parameter as shown in the example below with the name of an OVS or SR-IOV based IP-Pool as the value alongside a secondary IP-Pool specified via the ippool parameter.
Example:
annotations:
robin.io/networks: '[{"ippool": "sec-1", "primary": "sriov99"}]'
7.4.6. Assigning a device via Annotations¶
In order to have a device assigned to a Pod and consequently allow its containers to take advantage of the accelerator functions and hardware, the robin.io/device annotation must first be utilized in the manner showcased in the example below. The value for this annotation must be a stringified list consisting of a dictionary containing the type, devid, driver and vendor attributes of the device to assign functions from.
robin.io/devices: '[{"type": "fpga", "devid": "0x0d90", "vendor": "0x8086", "driver": "vfiopci"}]'
In order to have a function from multiple devices assigned to a Pod, multiple devices can be specified in the aforemntioned annotation as shown below.
robin.io/devices: '[{"type": "fpga", "devid": "0x0d90", "vendor": "0x8086", "driver": "vfiopci"}, {"type": "fpga", "devid": "0x0d90", "vendor": "0x8086", "driver": "igbuio"}]'
The list of available devices from which a function can be allocated from can be viewed via the command robin host list --devices command. More details on the command can be found here. In addition, several options can be specified within each device request in order to customize the function allocated. For more details review the section detailed here.
7.4.7. Getting CPU IDs Inside a Pod¶
If you need allocating CPU IDs inside containers requesting guaranteed CPUs, you can access them in the /robinenv file.
Example:
[root@Pod-l2fwd l2fwd]# cat /robinenv
ROBIN_CPUSET=5,6,29,30
ROBIN_CPUSET_ORDERED=5:29,6:30
ROBIN_CPUSET_RANGE=5-6,29-30
7.4.8. Environment Variables to use with Annotations¶
Robin exposes a set of environment variables prefixed with the phrase “ROBIN” within Pods deployed via YAML files. A subset of the aforementioned variables are displayed below and can be accessed via the env command from within the Pod.
Example:
[root@Pod-pktgen-5-668b9d6d5c-58822 pktgen]# env | grep ROBIN
ROBIN_SRIOV5_SUBNET=fd74:ca9b:3a09:8685:0000:0000:0000:0000
ROBIN_NONROBIN_DEFAULT_IP_ADDRESS=fd74:ca9b:3a09:868c:0172:0018:0000:42af
ROBIN_NONROBIN_DEFAULT_DRIVER=calico
ROBIN_SRIOV5_VFIDS=9,7
ROBIN_SRIOV5_DRIVER=sriov
ROBIN_NONROBIN_DEFAULT_NETMASK=ffff:ffff:ffff:ffff:ffff:ffff:ffff:c000
ROBIN_SRIOV5_IP_ADDRESS=fd74:ca9b:3a09:8685:00c0:00a8:0001:006f
ROBIN_SRIOV5_PFNAMES=enp175s0f1,enp175s0f0
ROBIN_SRIOV5_PCI_ADDR=0000:af:0b.1,0000:af:02.7
ROBIN_NONROBIN_DEFAULT_SUBNET=fd74:ca9b:3a09:868c:0172:0018:0000:4000
ROBIN_SRIOV5_MTU=1500
ROBIN_SRIOV5_VFDRIVER=iavf
ROBIN_MEMORY=209715200
ROBIN_SRIOV5_INTF_NAMES=eth1,eth2
ROBIN_SRIOV5_VLAN=20
ROBIN_SRIOV5_NETMASK=ffff:ffff:ffff:ffff:0000:0000:0000:0000
7.5. Network Policy Support¶
Robin supports the Kubernetes concept of NetworkPolicies for Robin bundles and Helm applications based on the Calico network. These policies allow administrators to enforce rules that control traffic flow at the IP address or port level. More specifically they are an application-centric construct which determine how a pod is allowed to communicate with various network entities such as external network endpoints/services and other pods. For more information, view the official documentation here.
7.5.1. How it works¶
By default, Pods are non-isolated, and they accept traffic from any source including other Pods present within the cluster. Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. Network policies affect only Pod-to-Pod communication and do not affect service-to-service traffic directly. Network policies use labels specified within the PodSelector attribute of their definition to select the Pods on which the associated traffic rules will be enforced.
7.5.2. Robin network policies¶
The following are the network policies supported by Robin:
Allow-all: Ingress/egress traffic is allowed to/from all application Pods in the cluster.
Namespace application isolation: Ingress/egress traffic is allowed to/from all application Pods within a namespace.
Tenant application isolation: Ingress/egress traffic is allowed to/from all application Pods within a tenant.
User application isolation: Ingress/egress traffic is allowed to/from all application Pods for a user.
Application Pods isolation: Ingress/egress traffic is allowed to/from all Pods of an application.
Deny-all: No ingress/egress traffic is allowed to/from all application Pods in the cluster.
7.5.3. Cluster level attributes¶
Robin supports two main configuration attributes, create_user_ns_tenant_isolation_nw_policies and network_policy_scope, with regards to network policies and their configuration. Both attributes are at the cluster level and are described in the following sections. In addition the current status of each can be viewed via the robin config list command.
7.5.3.1. Enable cluster level network policies¶
By default, Robin does not create any Kubernetes Ingress/Egress network policies when a user, namespace, or tenant is created within the cluster. In order to enable this behavior when one of the aforementioned entities is created, run the following command:
# robin config cluster create_user_ns_tenant_isolation_nw_policies True
The 'cluster' attribute 'create_user_ns_tenant_isolation_nw_policies' has been updated
Note
Robin creates the default isolation network policies for the user, namespace, or tenant created post-upgrade if the cluster level network policies are set to True.
7.5.3.2. Disable cluster level network policies¶
To disable the creation of Kubernetes Ingress/Egress network policies when a user, namespace, or tenant is added such that no trafic is blocked or so custom network policies can be applied, run the following command:
# robin config update cluster create_user_ns_tenant_isolation_nw_policies False
The 'cluster' attribute 'create_user_ns_tenant_isolation_nw_policies' has been updated
7.5.3.3. Configure Network Policy Scope attribute¶
Robin supports the automatic addition of network policy labels to pods which are created as part of an application deployment. The labels added are determined by the network_policy_scope attribute, which by default is set to allow-all. In order to configure the network_policy_scope attribute at the cluster level, run the following command:
# robin config update cluster network_policy_scope <value>
Example
# robin config update cluster network_policy_scope namespace
The 'cluster' attribute 'network_policy_scope' has been updated
The following are the valid values:
allow-all
namespace
tenant
user
app
deny-all
The above values all map to the respective policies detailed here.
7.5.4. Create network policies for individual users¶
In order to create Kubernetes Ingress/Egress network policies for an individual Robin user or a set of users, run the following command:
# robin networkpolicy create <usernames>
|
Comma seperated list of Robin usernames for whom the network policies should be created. |
Example
# robin networkpolicy create T2User
Successfully added K8S network policies for user 'T2User'
Creates Kubernetes Ingress/Egress network policies for an individual Robin user or a set of users.
End Point: /api/v3/robin_server/networkpolicies
Method: POST
URL Parameters: None
Data Parameters:
user_info: <dict_of_key_value_pairs>–user_list: <list_of_user_names>- This mandatory field within the dictionary specifies the names of the Robin users for which the Kubernetes network policies should be created for
Port: RCM Port (default value is 29442)
Headers:
Authorization: <auth_token>: Authorization token to identify which user is sending the request. The token can be acquired from the login API.
Success Response Code: 200
Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)
Example Response:
Output
{
"message":"\nSuccessfully added K8S network policies for Robin User\/s '['robin']'\n"
}
7.5.5. Attach network policy to application¶
In order to associate either the default Robin network policies or any custom network policies with an application(s), issue the following command:
# robin app attach-network-policy <appnames> <policies>
--roles <roles>
|
Comma separated list of one or more application names. |
|
Comma separated list of one or more Kubernetes Network Policy names to attach to specified applications. |
|
Comma separated list of roles within an application to attach the specified network policies. If not specified it is attached to all roles within the application. |
Example
# robin app attach-network-policy app-1-robinuser up-allow-intra-user-pods-t001-u000003-3 --wait
Job: 127 Name: ApplicationAddPolicy State: VALIDATED Error: 0
Job: 127 Name: ApplicationAddPolicy State: COMPLETED Error: 0
7.5.6. Detach network policy from application¶
In order to dissociate either default Robin network policies or any custom network policies from an application(s), issue the following command:
# robin app detach-network-policy <appnames> <policies>
--roles <roles>
|
Comma separated list of one or more application names. |
|
Comma separated list of one or more Kubernetes Network Policy names to detach from specified applications. |
|
Comma separated list of roles within an application to detach the specified network policies from. If not specified it is attached to all roles within the application. |
Example
# robin app detach-network-policy app-1-robinuser up-allow-intra-user-pods-t001-u000003-3 --wait
Job: 127 Name: ApplicationRemovePolicy State: VALIDATED Error: 0
Job: 127 Name: ApplicationRemovePolicy State: COMPLETED Error: 0
7.5.7. View network policies attached to an application¶
In order to view the network policies currently associated with an application the robin app info command can be used with the --networkpolicies parameter. More details on this operation can be found here.
7.5.8. View network policies in cluster¶
You can view the network policies configured in your cluster.
To view the network policies in the cluster, run the following command:
# network-policies
Example
# network-policies
NAMESPACE NAME POD-SELECTOR AGE
sveta-custom np-allow-intra-ns-pods robin.io/networkpolicyns=np-allow-intra-ns-pods 105m
sveta-custom np-deny-all-pods robin.io/networkpolicyns=np-deny-all-pods 105m
sveta-custom tp-allow-intra-tenant-pods-1 robin.io/networkpolicytenant=tp-allow-intra-tenant-pods-1 105m
sveta-custom up-allow-intra-user-pods-4 robin.io/networkpolicyuser=up-allow-intra-user-pods-4 105m
t001-u000001 np-allow-intra-ns-pods robin.io/networkpolicyns=np-allow-intra-ns-pods 130m
t001-u000001 np-deny-all-pods robin.io/networkpolicyns=np-deny-all-pods 130m
t001-u000001 tp-allow-intra-tenant-pods-1 robin.io/networkpolicytenant=tp-allow-intra-tenant-pods-1 130m
t001-u000001 up-allow-intra-user-pods-1 robin.io/networkpolicyuser=up-allow-intra-user-pods-1 130m
t001-u000002 np-allow-intra-ns-pods robin.io/networkpolicyns=np-allow-intra-ns-pods 130m
t001-u000002 np-deny-all-pods robin.io/networkpolicyns=np-deny-all-pods 130m
7.5.9. View network policies for namespace¶
You can view the network policies configured for a namespace in your cluster.
To view the network policies configured for a namespace, run the following command:
# network-policies ns<namespace_name>
Example
# network-policies t001-u000003
t001-u000003 np-allow-intra-ns-pods robin.io/networkpolicyns=np-allow-intra-ns-pods 132m
t001-u000003 np-deny-all-pods robin.io/networkpolicyns=np-deny-all-pods 132m
t001-u000003 tp-allow-intra-tenant-pods-1 robin.io/networkpolicytenant=tp-allow-intra-tenant-pods-1 132m
t001-u000003 up-allow-intra-user-pods-3 robin.io/networkpolicyuser=up-allow-intra-user-pods-3 132m
Alternatively, you can also run the following command to view the network policies configured for a namespace.
# robin namespace info <namespace name>
Example
# robin namespace info t037-u000077
Namespace: t037-u000077
Primary Namespace: True
User: T1User
Tenant: T1
Imported: False
K8S Ingress/Egress Network Policies:
- np-allow-intra-ns-pods (Allow Ingress/Egress Traffic from/to application pods within namespace t037-u000077)
- np-deny-all-pods (Block Ingress/Egress Traffic from/to all application pods in the cluster)
- tp-allow-intra-tenant-pods-37 (Allow Ingress/Egress Traffic from/to all application pods within tenant T1)
- up-allow-intra-user-pods-77 (Allow Ingress/Egress Traffic from/to all application pods for user T1User)
7.5.10. View information of network policy¶
You can view the detailed information of the network policy configured for a namespace in your cluster.
To view the detailed information of a network policy, run the following command:
# network-policy-info ns<namespace_name> policy<network_policy_name>
Example
# network-policy-info t001-u000003 np-allow-intra-ns-pods
Name: np-allow-intra-ns-pods
Namespace: t001-u000003
Created on: 2021-02-05 10:41:15 -0800 PST
Labels: robin.io/domain=ROBIN
robin.io/networkpolicyns=np-allow-intra-ns-pods
Annotations: <none>
Spec:
PodSelector: robin.io/networkpolicyns=np-allow-intra-ns-pods
Allowing ingress traffic:
To Port: <any> (traffic allowed to all ports)
From:
NamespaceSelector: robin.io/namespace=t001-u000003
From:
IPBlock:
CIDR: 0.0.0.0/0
Except: 172.18.0.0/16, 172.21.0.0/16
Allowing egress traffic:
To Port: <any> (traffic allowed to all ports)
To:
NamespaceSelector: robin.io/namespace=t001-u000003
Policy Types: Egress, Ingress