7. Managing Networking

The Robin platform extends Kubernetes networking via both Calico and SR-IOV/Open vSwitch-based CNI (Container Network Interface) drivers. This dual support offers flexibility in using either overlay networks to create non-rigid L3 subnets that span multiple data centers/cloud environments, or bridged networking to get wire-speed network access for high-performance applications. In either mode, Robin enhances the CNI driver to retain the IP address of the Pod when it is restarted or relocated. This provides additional flexibility during the application lifecycle management process for operations such as scaling and migration, as well as ensuring high availability.

7.1. IP-Pool Management

An IP-Pool is a construct in Robin that groups together a set of IP addresses. The main properties of an IP-Pool is the aforementioned range of addresses specified, the netmask and the backing network driver. The netmask assigned indicates the number of IP addresses that can be used from the specified range. In addition Robin supports a multitude of network drivers through which the container networking is orchestrated and enabled. The supported drivers include: Calico, OVS, and SR-IOV. For more information on considerations when selecting a driver please review the below section on CNI plugins.

As part of the installation process, Robin creates two Calico backed IP-Pools named robin-default and nonrobin-default respectively for the users convenience. The former uses the range 172.21.0-15.0-255 whilst the later is assigned the range 172.21.16-31.0-255. As the name suggests the nonrobin-default is used by Kubernetes when the applications are deployed using native Kubernetes tools. Its counter-part can be used for the applications deployed via Robin Bundles.

Note

The nonrobin-default IP-Pool is hidden by default as Robin does not utilize it directly.

When creating an application, one can specify an IP-Pool to be used at the Vnode level. As a result, the IP Address assigned to a container can be easily controlled and managed by the user. Moreover, in situations where a container needs multiple IP addresses, one can specify a set of IP-Pools and the number IP Addresses that need to be assigned from each of them in order to satisfy the requirement. However in the aforementioned situation if there are multiple IP-Pools containing default gateways, all of the gateways will programmed as source based routes except for the first.

Along with additional details, the following commands are described in this section:

robin ip-pool add

Add an IP-Pool

robin ip-pool add-certs

Add certificates to an existing IP-Pool

robin ip-pool add-ranges

Add additional IP ranges to an existing IP-Pool

robin ip-pool list

List IP-Pools

robin ip-pool info

Display detailed information about an IP-Pool

robin ip-pool remove

Remove an IP-Pool

robin ip-pool remove-ranges

Remove a range of IP addresses from an existing IP-Pool

robin ip-pool rename

Rename an existing IP-Pool

7.1.1. Adding an IP-Pool

To add an IP-Pool for Robin to utilize during application deployment, issue the following command:

# robin ip-pool add <name>
                    --ranges <ranges>
                    --network <network>
                    --netmask <netmask>
                    --prefix <prefix>
                    --zone <zone>
                    --tenant <tenant>
                    --vlan <vlan>
                    --driver <driver>
                    --gateway <gateway>
                    --nameserver <nameserver>
                    --dns-search <dns_search>
                    --nictags <nic_tags>
                    --ifcount <if_count>
                    --routes <routes>
                    --vfdriver <vf_driver>
                    --master-interface <master_interface>
                    --macvlan-mode <macvlan_mode>
                    --mtu <mtu>

name

IP-Pool Name

--ranges <ranges>

Comma separated list of IP ranges to assign to IP-Pool. Each range can also be specified in CIDR format

--network <network>

IP network without ranges to be used for static IP allocations

--netmask <netmask>

Mask indicating number of IP addresses that can be used from given range

--prefix <prefix>

CIDR prefix to be used with the IP Pool

--zone <zone>

Name of zone in which to create this IP-Pool

--tenant <tenant>

Name of Tenant to which this IP-Pool belongs to

--vlan <vlan>

VLAN to be associated with this IP-Pool. Note this option is only valid for OVS and SR-IOV driver backed IP-Pools

--driver <driver>

Driver to back this IP-Pool. Valid choices include: OVS, Calico, Secondary, Isolated, MACVLAN and SR-IOV

--gateway <gateway>

Default gateway to be used for this IP-Pool

--nameserver <nameserver>

Comma separated list of DNS name servers to be used for Pods deployed using this IP-Pool

--dns-search <dns_search>

Comma separated list of DNS search strings to be used for Pods deployed using this IP-Pool

--nictags <nic_tags>

Comma separated NIC tags to select when assigning interfaces from this network. Each tag must be specified as key/value pair. Only keys “name” and “pci_address” are supported

--ifcount <if_count>

Preset the interface count when using this network. Applicable only for the SR-IOV driver

--routes <routes>

Comma separated list of routes to associated with this network

--vfdriver <vf_driver>

Kernel driver to bind to when attaching an SR-IOV virtual function. Applicable only for the SR-IOV driver

--master-interface <master_interface>

Master interface to be used for the MACVLAN plugin. Applicable only for the MACVLAN driver

--macvlan-mode <macvlan_mode>

Mode for the MACVLAN plugin in order to configure the traffic visibility on the virtual network. Applicable only for the MACVLAN driver. Valid choices include: Private, Vepa and Bridge. The default value is Bridge when the MACVLAN driver is used

--mtu <mtu>

Set the maximum transmission unit (MTU) value for the interfaces within the IP-Pool. The default value is 1500

Note

At least one of the --network or --ranges options must be given when creating an IP-Pool however both cannot be used. Similarly either one of the --prefix or --netmask parameters must be utilized but both cannot be specified. If an IP-Pool is created without ranges, it can only be used for static IP Address allocations.

Example 1 (Creating a basic OVS IP-Pool):

# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver ovs
Registered IP pool demo.

Example 2 (Creating an SR-IOV IP-Pool with VLAN):

# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver sriov --vlan 500
Registered IP pool demo.

With the above IP-Pool Robin will select VF’s based on the VLANs allowed for a particular NIC.

Example 3 (Creating an SR-IOV IP-Pool with NIC tags using the pci_address parameter):

# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver sriov --vlan 500 --nictags pci_addr=0000:3b:00.0
Registered IP pool demo.

With the above IP-Pool Robin will select VF’s only from NICs with the pci address “0000:3b:00.0”.

Example 5 (Creating an SR-IOV IP-Pool with NIC tags using the name parameter):

# robin ip-pool add demo --ranges 10.9.106.1-255 --netmask 255.255.0.0 --driver sriov --vlan 500 --nictags name=sriov0
Registered IP pool demo.

With the above IP-Pool Robin will select VF’s only from NICs with the name “sriov0”.

Example 6 (Creating an SR-IOV IP-Pool with Bonded VFs):

# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --ifcount 2 --nictags name=sriov0,name=sriov2
Registered IP pool demo.

With the above IP-Pool Robin will select one VF from a NIC named sriov0, one VF from a NIC named sriov2 and bond them together.

Example 7 (Creating an SR-IOV IP-Pool with Bonded VFs based on VLAN):

# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --ifcount 2
Registered IP pool demo.

With the above IP-Pool Robin will select two VFs from two NICs (one from each) where VLAN 500 is allowed and bond them together.

Example 8 (Creating an SR-IOV IP-Pool with Bonded VFs from the same NIC):

# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --ifcount 2 --nictags name=sriov0,name=sriov0
Registered IP pool demo.

With the above IP-Pool Robin will select two VFs from a NIC named sriov0 and bond them together.

Example 9 (Creating an SR-IOV IP-Pool with VF Driver):

# robin ip-pool add demo --ranges 192.168.1.101-110 --netmask 255.255.255.0 --driver sriov --vlan 500 --nictags name=sriov0 --vfdriver igb_uio
Registered IP pool demo.

With the above IP-Pool Robin will select one VF from a NIC named sriov0 and bind it with the specified driver.

Example 10 (Creating an IP-Pool by specifying IP ranges in network/CIDR format):

# robin ip-pool add demo --ranges 192.10.88.0/24 --netmask 255.255.0.0 --driver ovs
Registered IP pool demo.

With the above IP-Pool Robin will configure its ranges utilizing the CIDR format i.e (/24, /16, /26 etc) with which the ranges were represented.

Example 11 (Creating an MACVLAN based IP-Pool):

# robin ip-pool add demo --driver macvlan --ranges  192.168.10.21-30 --prefix 24 --gateway 192.168.10.1 --master-interface=ens18f1 --macvlan-mode bridge
Registered IP pool demo.

With the above IP-Pool Robin will configure the MACVLAN CNI as the primary network driver with the primary master interface as ens18f1 operating in bridge mode.

Example 12 (Creating an IP-Pool for assigning secondary IP Addresses):

# robin ip-pool add demo --driver secondary --ranges 192.168.10.21-30 --prefix 24
Registered IP pool demo.

With the above IP-Pool defined Robin will construct a standard IP-Pool with the additional caveat that it can only used in conjunction with another IP-Pool (known as the primary IP-Pool) in order to enable the assignment of multiple IP Addresses to a single interface. The aforementioned primary IP-Pool must be SRIOV or OVS based.

Example 13 (Creating an isolated IP-Pool):

# robin ip-pool add demo --driver isolated --ranges 192.168.10.21-30 --prefix 24
Registered IP pool demo.

With the above IP-Pool Robin will utilize the custom robin-isolated CNI plugin in order to configure an additional IP Address on a Pod’s loopback lo interface.

Note

In all the above examples for SR-IOV backed IP-Pools, when the --vlan option is specified independently of any other parameters it acts as a constraining factor whilst also tagging outgoing packets. In every other scenario only the latter holds true. As a result when options such as the --nictags option is passed alongside the --vlan option, the latter stops becoming a constraining factor.

Adds an IP-Pool for Robin to utilize during application deployment.

End Point: /api/v3/robin_server/ip-pools

Method: POST

URL Parameters: None

Data Parameters:

  • ip_pool: <dict_of_ip_pool_details>

    • name: <ip_pool_name> - This mandatory field within the payload specifies the name of the IP-Pool to be created.

    • driver: <ip_pool_driver> - This mandatory field within the payload specifies the network driver to be associated with the IP-Pool. Valid options include: ‘ovs’, ‘sriov’, ‘secondary’, ‘isolated’, ‘macvlan’ and ‘calico’.

    • zoneid: <zone_name> - This mandatory field within the payload specifies the name of the zone in which the IP-Pool should be created.

    • ranges: <list_of_range_dicts> - Utilizing this parameter within the payload, by specifying a list containing dictionaries in the form {'range': <ip_range>} for each range, results in the specified ranges being assigned to this IP-Pool.

    • network: <ip_network> - Utilizing this parameter within the payload, by specifying an IP network without ranges, results in the specified network being used for IP allocations when utilizing this network.

    • netmask: <netmask> - Utilizing this parameter within the payload, by specifying an appropriate mask, results in aforementioned mask being applied to the specified ranges and thus indicating the number of IP addresses that can be used.

    • prefix: <cidr_prefix> - Utilizing this parameter within the payload, by specifying a CIDR prefix, results in the aforementioned prefix being associated with the IP-Pool.

    • tenant: <tenant_name> - Utilizing this parameter within the payload, by specifying a tenant name, results in the IP-Pool being associated with the aforementioned tenant.

    • vlan_number: <vlan_number> - Utilizing this parameter within the payload, by specifying a VLAN number, results in the IP-Pool being associated with the aforementioned VLAN number. Note this option is only valid for OVS and SR-IOV driver backed IP-Pools.

    • gateway: <gateway> - Utilizing this parameter within the payload, by specifying a gateway, results aforementioned gateway being set as the default gateway for the IP-Pool.

    • nameserver: <nameservers> - Utilizing this parameter within the payload, by specifying a string of DNS name servers which are comma seperated, results in the aforementioned name servers being used for Pods deployed using this IP-Pool.

    • dns_search: <dns_search_strings> - Utilizing this parameter within the payload, by specifying a string of DNS search strings which are comma seperated, results in the aforementioned search strings being used for Pods deployed using this IP-Pool.

    • nictags: <list_of_tag_dicts> - Utilizing this parameter within the payload, by specifying a list containing dictionaries in the form {<tag_key>: <tag_value>} for each NIC tag, results in only interfaces associated with the aforementioned tags being utilized when using this IP-Pool. Note only keys “name” and “pci_address” are supported.

    • ifcount: <interface_count> - Utilizing this parameter within the payload presets the interface count for allocations to the integer specified when using this network. Valid values include 1 and 2. Note this option is only valid for SR-IOV driver backed IP-Pools.

    • routes: <list_of_route_dicts> - Utilizing this parameter within the payload, by specifying a list containing dictionaries in the form {'dest': <destination>, 'gateway': <gateway>} for each route, results in the specified routes being associated with this IP-Pool.

    • vfdriver: <vf_driver> - Utilizing this parameter within the payload, by specifying the name of a kernel driver, results in the aforementioned driver being bound to when attaching an SR-IOV virtual function. Valid options include: ‘igb_uio’, ‘vfio-pci’, and ‘uio_pci_generic’. Note this option is only valid for SR-IOV driver backed IP-Pools.

    • master_interface: <master_interface> - Utilizing this parameter within the payload, by specifying the name of a valid interface, results in the aforementioned interface being used as the master interface for the MACVLAN plugin. Note this option is only valid for MACVLAN driver backed IP-Pools.

    • macvlan_mode: <macvlan_mode> - Utilizing this parameter within the payload, by specifying the name of a valid mode, results in the MACVLAN plugin being configured with the aforementioned mode which in turn determines the traffic visibility on the virtual network. Valid options include: ‘private’, ‘vepa’, and ‘bridge’. Note this option is only valid for MACVLAN driver backed IP-Pools and the default value is ‘bridge’.

    Note

    At least one of the network or ranges properties must be given when creating an IP-Pool however both cannot be used. Similarly either one of the prefix or netmask properties must be utilized but both cannot be specified. If an IP-Pool is created without ranges, it can only be used for static IP Address allocations.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error), 409 (Duplicate Resource Error)

Example Response:

Output
{
   "message":"Registered IP pool demo. \n"
}

7.1.2. Adding certificates to an IP-Pool

To add certificates to an IP-Pool in order to make certain addresses accessible in a secure manner, issue the following command:

# robin ip-pool add-certs <name> <certificates>
                                 --keypass <keypass>
                                 --is_hostnames
                                 --no_multinode

name

IP-Pool Name

certificates

Path to SSL certificates file

--keypass <keypass>

Passphrase of the key

--is_hostnames

Indicates that the filename specified contains the hostname and its format is <filename>.<certtype>

--no_multinode

Indicates that the certificate can be used for multiple hosts

Example:

# robin ip-pool add-cert demo ~/ssl/demo-cert
Added certificates.

Adds certificates to an IP-Pool in order to make certain addresses accessible in a secure manner.

End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>

Method: PUT

URL Parameters: None

Data Parameters:

  • action: add_certs - This mandatory field within the payload specifies that the add certificates operation is to be performed.

  • cert_info: <dict_of_cert_details>

    • filename: <cert_file_name> - This mandatory field within the payload specifies the base file name of the certificate file.

    • certificate: <cert_data> - This mandatory field within the payload specifies the base64 decoded details within the specified file.

    • multinode: [true|false] - Utilizing this parameter within the payload indicates whether or not this certificate can be used for multiple hosts.

    • is_hostnames: [true|false] - Utilizing this parameter within the payload indicates whether or not the specified certificate filename contains the hostname and is in the format <filename>.<certtype>.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "message":"Added certificates.\n"
}

7.1.3. Adding ranges to an IP-Pool

To add additional ranges to an IP-Pool in order to expand the number of IP Addresses available, issue the following command:

# robin ip-pool add-ranges <name> <ranges>

name

IP-Pool Name

ranges

Comma separated list of additional IP ranges to assign to IP-Pool

Example:

# robin ip-pool add-ranges demo 10.9.107.1-255
Added range.

Adds IP ranges that are currently assigned to an IP-Pool in order to expand the number of available IP ranges.

End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>

Method: PUT

URL Parameters: None

Data Parameters:

  • action: add_ranges - This mandatory field within the payload specifies that the add ranges operation is to be performed.

  • ranges: <list_of_ranges> - This mandatory field within the payload specifies a list of comma seperated ranges to be added from the given IP-Pool.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "message":"Added range.\n"
}

7.1.4. Listing registered IP-Pools

To list registered IP-Pools alongside details such as the associated driver and network ranges contained within each pool, issue the following command:

# robin ip-pool list --all
                     --full
                     --json

--all

Display all registered IP-Pools including hidden ones

--full

Display additional information for listed IP-Pools

--json

Output in JSON

Example:

# robin ip-pool list --all
Name             | Driver | Network       | VLAN | Total | Used | Free
-----------------+--------+---------------+------+-------+------+------
nonrobin-default | calico | 172.21.0.0/16 | -    | 4096  | 2    | 4094
robin-default    | calico | 172.21.0.0/16 | -    | 4096  | 0    | 4096
demo             | ovs    | 10.9.0.0/16   | -    | 255   | 0    | 255

Returns all registered IP-Pools alongside details such as the associated driver and network ranges contained within each pool.

End Point: /api/v3/robin_server/ip-pools/

Method: GET

URL Parameters: None

Data Parameters:

  • all: true - Utilizing this parameter within the payload results in details of hidden IP-Pools being returned as well.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error)

Example Response:

Output
{
   "items":[
      {
         "available":"4092",
         "description":null,
         "zone":"default",
         "tenants":[

         ],
         "subnet":"172.21.0.0",
         "vfdriver":null,
         "ranges":[
            {
               "range":"172.21.0-15.0-255"
            }
         ],
         "gateway":null,
         "name":"nonrobin-default",
         "netmask":"255.255.0.0",
         "used":"4",
         "total":"4096",
         "nictags":null,
         "dns_search":null,
         "zone_id":1,
         "driver":"calico",
         "routes":[

         ],
         "ifcount":1,
         "nameserver":null
      },
      {
         "available":"4094",
         "description":null,
         "zone":"default",
         "tenants":[
            "Administrators"
         ],
         "subnet":"172.21.0.0",
         "vfdriver":null,
         "ranges":[
            {
               "range":"172.21.16-31.0-255"
            }
         ],
         "gateway":null,
         "name":"robin-default",
         "netmask":"255.255.0.0",
         "used":"2",
         "total":"4096",
         "nictags":null,
         "dns_search":null,
         "zone_id":1,
         "driver":"calico",
         "routes":[

         ],
         "ifcount":1,
         "nameserver":null
      },
      {
         "available":"255",
         "description":null,
         "zone":"default",
         "tenants":[
            "Administrators"
         ],
         "subnet":"10.9.0.0",
         "vfdriver":null,
         "ranges":[
            {
               "range":"10.9.106.1-255"
            }
         ],
         "gateway":null,
         "name":"demo",
         "netmask":"255.255.0.0",
         "used":"0",
         "total":"255",
         "nictags":null,
         "dns_search":null,
         "zone_id":1,
         "driver":"ovs",
         "routes":[

         ],
         "ifcount":1,
         "nameserver":null
      }
   ]
}

To list registered IP-Pools via the robinippool custom resource alongside details such as the associated driver, network ranges, VLANs and bonded NICs contained within each pool, issue the following command:

# kubectl get robinippool

Example:

[root@qct-05 ~]# kubectl get robinippool
NAME            NETMASK         NETWORK   IPPREFIX   SUBNET          GATEWAY   NAMESERVER   DRIVER      VFDRIVER   RANGE(S)                  VLAN   BONDED   TRUST   SPOOFCHK
robin-default   255.255.0.0                          172.21.0.0                             calico                 ["172.21.16-31.0-255"]           1
sec-1           255.255.255.0             24         192.168.1.0                            secondary              ["192.168.1.11-20"]              1
sec-2           255.255.255.0             24         192.168.2.0                            secondary              ["192.168.2.11-20"]              1
sriov-b1        255.255.255.0                        192.168.110.0                          sriov                  ["192.168.110.165-170"]   20     2        off     on
sriov-b2        255.255.255.0                        192.168.111.0                          sriov                  ["192.168.111.165-170"]   20     2        off     on
sriov1          255.255.255.0                        192.168.10.0                           sriov       igb_uio    ["192.168.10.101-164"]    20     1        off     on
sriov10         255.255.255.0                        192.168.100.0                          sriov       native     ["192.168.100.101-164"]   20     1        off     on
sriov2          255.255.255.0                        192.168.20.0                           sriov       igb_uio    ["192.168.20.101-164"]    20     1        off     on
sriov3          255.255.255.0                        192.168.30.0                           sriov       igb_uio    ["192.168.30.101-164"]    20     1        off     on
sriov4          255.255.255.0                        192.168.40.0                           sriov       igb_uio    ["192.168.40.101-164"]    20     1        off     on
sriov5          255.255.255.0                        192.168.50.0                           sriov       native     ["192.168.50.101-164"]    20     2        off     on
sriov6          255.255.255.0                        192.168.60.0                           sriov       native     ["192.168.60.101-164"]    20     2        off     on
sriov7          255.255.255.0                        192.168.70.0                           sriov       native     ["192.168.70.101-164"]    20     1        off     on
sriov8          255.255.255.0                        192.168.80.0                           sriov       native     ["192.168.80.101-164"]    20     1        off     on
sriov9          255.255.255.0                        192.168.90.0                           sriov       native     ["192.168.90.101-164"]    20     1        off     on
sriov98         255.255.255.0                        192.168.98.0                           sriov       igb_uio    ["192.168.98.101-164"]    20     1        off     on
sriov99         255.255.255.0                        192.168.99.0                           sriov       igb_uio    ["192.168.99.101-164"]

7.1.5. Show information about a specific IP-Pool

To view details about a particular IP-Pool including its utilization, associated driver, and the network range(s) it covers, issue the following command:

# robin ip-pool info <name>
                     --ip-allocations
                     --instance-ips
                     --json

name

Name of IP-Pool

--ip-allocations

Display IP allocations of each pod created using helm or kubectl within the specified IP-Pool

--instance-ips

Display IP allocations of each pod created using a Robin bundle within the specified IP-Pool

--json

Output in JSON

Example:

# robin ip-pool info demo
IPPool: demo
Driver: ovs
Subnet: 10.10.2.0
Netmask: 255.255.255.0
Range: 10.10.2.102-130
Pool Utilization: 0/29/29 (Used/Available/Total)

Returns details about a particular IP-Pool including its utilization, associated driver, and the network range(s) it covers.

End Point: /api/v3/robin_server/ip-pools/

Method: GET

URL Parameters: None

Data Parameters:

  • name: <ip-pool-name> - This mandatory parameter within the payload specifies which IP-Pool actually needs to be queried.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error)

Example Response:

Output
{
   "items":[
      {
         "available":"255",
         "description":null,
         "zone":"default",
         "tenants":[
            "Administrators"
         ],
         "subnet":"10.9.0.0",
         "vfdriver":null,
         "ranges":[
            {
               "range":"10.9.106.1-255"
            }
         ],
         "gateway":null,
         "name":"demo",
         "netmask":"255.255.0.0",
         "used":"0",
         "total":"255",
         "nictags":null,
         "dns_search":null,
         "zone_id":1,
         "driver":"ovs",
         "routes":[

         ],
         "ifcount":1,
         "nameserver":null
      }
   ]
}

7.1.6. Removing an IP-Pool

To remove an IP-Pool from Robin, issue the following command:

# robin ip-pool remove <name>
                       --yes

name

IP-Pool Name

--yes

Do not prompt the user for confirmation of deletion

Example:

# robin ip-pool remove demo --yes
Unregistered IP-Pool 'demo'.

Removes an IP-Pool from Robin.

End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>

Method: DELETE

URL Parameters: None

Data Parameters: None

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error)

Example Response:

Output
{
   "message":"Unregistered IP pool demo.\n"
}

7.1.7. Removing ranges from an IP-Pool

To remove IP ranges that are currently assigned to an IP-Pool in order to reduce the number of available IP ranges, issue the following command:

# robin ip-pool remove-ranges <name> <ranges>
                                     --yes

name

IP-Pool Name

ranges

Comma separated list of IP ranges to remove from an IP-Pool

--yes

Do not prompt the user for confirmation of removal

Example:

# robin ip-pool remove-ranges demo 10.9.107.1-255 --yes
Removed range.

Removes IP ranges that are currently assigned to an IP-Pool in order to reduce the number of available IP ranges.

End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>

Method: PUT

URL Parameters: None

Data Parameters:

  • action: remove_ranges - This mandatory field within the payload specifies that the remove ranges operation is to be performed.

  • ranges: <list_of_ranges> - This mandatory field within the payload specifies a list of comma seperated ranges to be removed from the given IP-Pool.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "message":"Removed range.\n"
}

7.1.8. Renaming an IP-Pool

To rename an IP-Pool, issue the following command:

# robin ip-pool rename <name> <new_name>

name

IP-Pool Name

new_name

New name of the specified IP-Pool

Example:

# robin ip-pool rename demo demo_change
IP-Pool 'demo' renamed to 'demo_change'.

Renames an existing IP-Pool.

End Point: /api/v3/robin_server/ip-pools/<ip_pool_name>

Method: PUT

URL Parameters: None

Data Parameters:

  • action: rename - This mandatory field within the payload specifies that the rename operation is to be performed.

  • new_name: <new_ippool_name> - This mandatory field within the payload specifies the new name for the specified IP-Pool.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "message":"IP-Pool 'demo' renamed to 'demo_change'.\n"
}

7.2. VLAN Support

The VLAN (Virtual LAN) feature allows one to logically group a set of devices in the same L2 domain irrespective of how they are physically connected. Additionally one can carve out logical groups even if the devices are connected to the same L2 switch. Listed below are some of the advantages of using VLANs:

  • Performance - Broadcast traffic is sent to all the nodes in an L2 domain. VLANs allow creating groups or virtual L2 domains, thus containing the broadcast traffic to the created logical groups.

  • Isolation and Security - VLANs allow one to control the broadcast domain and enforce which logical groups can talk to one another

  • Flexibility - A device can be easily added/removed from a VLAN logical group without actually changing the physical connectivity

  • Cost Reduction - VLANs can be used to create broadcast domains without the need for expensive routers

Along with additional details, the following commands are described in this section:

robin vlan add

Register a VLAN

robin vlan list

List VLANs

robin vlan remove

Unregister a VLAN

robin host add-vlan

Configure a VLAN for an interface on a host

robin host remove-vlan

Remove a VLAN from an interface on a host

7.2.1. Registering a VLAN

To register a VLAN with Robin so it can be configured for an interface, issue the following command:

# robin vlan add <vlan_number>
                 --skip-vlan-interface
                 --add-vlan-interface

Note

The Robin server might need to access pods deployed in a particular VLAN. As a result a VLAN interface needs to be created on the current Robin Master. This VLAN interface is created, when --add-vlan-interface is enabled, on the aforementioned node when an IP-Pool is created and has an associated VLAN. The IP address linked to the VLAN interface is picked from the addresses provided in the IP Pool. In some deployments, VLAN routing could be provided in a different manner and thus a VLAN interface might not be needed on the Robin Master. If this is the case, you can create VLAN with --skip-vlan-interface option (this is the default behavior).

vlan_number

VLAN number/identifier

--skip-vlan-interface

Skips VLAN interface configuration on the Robin Master node

--add-vlan-interface

Configures the VLAN interface on the Robin Master node

Example:

# robin vlan add 9 --wait
Job:  180 Name: VLANAdd              State: PROCESSED       Error: 0
Job:  180 Name: VLANAdd              State: COMPLETED       Error: 0

Registers a VLAN with Robin so it can be configured for an interface.

End Point: /api/v3/robin_server/vlans

Method: POST

URL Parameters: None

Data Parameters:

  • vlan: <vlan_number> - This mandatory field within the payload specifies the VLAN number for the VLAN to be registered.

  • skip_vlan_interface: [true|false] - This mandatory field within the payload is a boolean value that specifies whether or not the VLAN interface should be configured on the Robin Master node.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 202

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error), 409 (Duplicate Resource Error)

Example Response:

Output
{
   "jobid":209
}

7.2.2. Listing all VLANs

To list registered VLANs alongside details such as the IP-Pools it is assigned to and the number of NICs associated with it, issue the following command:

# robin vlan list --json

--json

Output in JSON

Example:

# robin vlan list
VLAN | IP Pools | Instance Count | Interface Count
-----+----------+----------------+-----------------
9    | None     | 0              | 0

Returns all registered VLANs alongside details such as the IP-Pools it is assigned to and the number of NICs associated with it.

End Point: /api/v3/robin_server/vlans/

Method: GET

URL Parameters: None

Data Parameters: None

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error)

Example Response:

Output
{
   "items":[
      {
         "skip_vlan_interface":true,
         "ip_pools":[

         ],
         "instance_cnt":0,
         "number":9,
         "nic_cnt":0
      }
   ]
}

7.2.3. Configuring a VLAN on a host

Before installing Robin on a VLAN based setup, it is expected that an administrator would have planned which VLANs are to be used for deploying applications and thus configured the installation appropriately. However in order to configure a VLAN post installation, issue the following command:

# robin host add-vlan [<hosts>]
                      --vlans <vlans>
                      --interface <interface>
                      --all
                      --untagged

hosts

A comma separated list of hosts to add VLANs to. If this isn’t provided, then –all must be used

--vlans <vlans>

Range of VLANs to be added (Use ‘ALL’ to enable all vlans)

--interface <interface>

Interface on host on which VLANs should be added

--all

VLANs will be added to every host in the cluster

--untagged

Network traffic will not be tagged with the VLAN number

Example:

# robin host add-vlan vnode89.robinsystems.com --vlans 9 --interface br0 --untagged
Job:  180 Name: HostVLANAdd          State: PROCESSED       Error: 0
Job:  180 Name: HostVLANAdd          State: COMPLETED       Error: 0

Configures a VLAN on a host after Robin installation.

End Point: /api/v3/robin_server/hosts/<hostname>

Method: PUT

URL Parameters: None

Data Parameters:

  • action: add_vlans - This mandatory field within the payload specifies that the add VLAN operation is to be performed.

  • vlans: <range_of_vlans> - Utilizing this parameter in the payload, by specifying a range of VLANs, results in the aforementioned VLANs being configured on the host.

  • all_vlans: true - Utilizing this parameter in the payload results in all possible VLANs being configured on this host. The default value is False.

  • interface: <interface_name> - Utilizing this parameter in the payload, by specifying an interface name, results in the given VLANs being configured on the aforementioned interface.

  • untagged: true - Utilizing this parameter in the payload results in the VLAN being configured on SR-IOV interfaces as untagged. The default value is False.

Note

Either the vlans or all_vlans parameter must be present in the request body.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 202

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "jobid":217
}

7.2.4. Removing a VLAN from a host

In order to remove a VLAN that is configured on an interface which is present on a host, issue the following command:

# robin host remove-vlan [<hosts>]
                          --vlans <vlans>
                          --interface <interface>
                          --all

hosts

A comma separated list of hosts to remove VLANs from. If this isn’t provided, then –all must be used

--vlans <vlans>

Range of VLANs to be removed (Use ‘ALL’ to indicate all vlans)

--interface <interface>

Interface on host from which VLANs should be removed

--all

VLANs will be removed on every host in the cluster

Example:

# robin host remove-vlan vnode89.robinsystems.com --vlans 9 --interface br0
Job:  180 Name: HostVLANRemove          State: PROCESSED       Error: 0
Job:  180 Name: HostVLANRemove          State: COMPLETED       Error: 0

Removes a VLAN that is configured on an interface which is present on a host.

End Point: /api/v3/robin_server/hosts/<hostname>

Method: PUT

URL Parameters: None

Data Parameters:

  • action: remove_vlans - This mandatory field within the payload specifies that the remove VLAN operation is to be performed.

  • vlans: <range_of_vlans> - This mandatory field within the payload specifies the range of VLANs to be removed.

  • interface: <interface_name> - Utilizing this parameter in the payload indicates the interface on the specified host from which the VLAN(s) should be removed.

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 202

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "jobid":213
}

7.2.5. Unregistering a VLAN

To unregister a VLAN from Robin, issue the following command:

# robin vlan remove <vlan_number>
                    --yes

Note

The VLAN must be removed from all hosts it was configured on before it can be unregistered.

vlan_number

VLAN number/identifier

--yes

Do not prompt the user for confirmation of removal

Example:

# robin vlan remove 9 --wait --yes
Job:  182 Name: VLANRemove           State: PROCESSED       Error: 0
Job:  182 Name: VLANRemove           State: COMPLETED       Error: 0

Unregisters a VLAN from robin.

End Point: /api/v3/robin_server/vlans/<vlan_number>

Method: DELETE

URL Parameters: None

Data Parameters: None

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 202

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error)

Example Response:

Output
{
   "jobid":83
}

7.2.6. Assumptions made about VLAN Configurations

Below are a list of assumptions and/or rules that made with regards to VLAN integration with Robin:

  • Upstream ports are configured as trunk ports and the right VLANs are allowed on these ports.

  • On a single host with multiple ports, then same VLAN is not configured on different ports (an exception to this rule is SR-IOV ports).

  • Multiple IP subnets can be configured to be carried using the same VLAN.

  • The same IP subnet cannot be configured for two different VLANs.

7.3. MACVLAN Support

With VLAN, you can create multiple sub-interfaces that uses the same MAC addresses, but the traffic is filtered based on the VLAN tag. With MACVLAN, each slave interface created on the top of the master interface is assigned a different MAC address.

You can directly bound the MACVLAN slave interface to a namespace instead of relying on a tap or veth device along with a bridge to provide underlay network connectivity.

To provide fault-tolerant connectivity to the workloads, Robin recommends using Bonded interfaces. You can also configure MACVLAN on Linux VLAN interfaces (eth0.<vlan>) to provide tagging support for workloads. For more information, see here.

MACVLAN supports containers using MACVLAN CNI, and for KVM, MACVTAP interfaces are used.

Points to consider when using MACVLAN

  • Robin supports the MACVLAN Bridge mode.

  • The MACVLAN design does not allow you to ping a workload (VM or container) from the host where the workload is deployed.

  • Due to the design constraint mentioned in the previous point, if you use MACVLAN as the default network for the workload, Kubernetes services may not work as expected.

  • It is recommended to have a dedicated interface on the node to provide MACVLAN based connectivity to the workloads.

  • OVS and MACVLAN provide similar kinds of connectivity, it is recommended not to use an OVS interface as the MACVLAN master interface.

  • By default, Robin installs OVS, but you can use the installer options —skip-ovs-cluster or —skip-ovs-node to disable OVS configuration at a cluster or node level.

  • If you are using MACVLAN as the primary CNI interface for a Pod, static routes including default gateway can be configured using the --routes option during IP Pool creation.

7.3.1. Configuring MACVLAN

To configure the MACVLAN plugin via a Robin IP-Pool, review the example detailed here.

7.4. Advanced Compute and Networking Support

7.4.1. Supported Functionalities When Using Kubernetes YAML or Helm Chart for Deployment

The following are the networking based functionalities that are supported:

  • Multiple interfaces support

  • OVS support

  • SR-IOV device allocation

Note

Virtual Network Function deployment (including the networking components) is not currently supported via YAML/Helm Charts.

7.4.2. Specifying Dedicated CPU Request

If your Pod needs dedicated CPUs, then the Pod must be in guaranteed QoS class (requests = limits) and should ask for integer CPU requests.

Also, Pods need to have CPU and memory specified in requests and limits.

spec:
    containers:
       -name: nginx
        image: nginx
        resources:
        limits:
           memory: "200Mi"
           cpu: "2"
        requests:
           memory: "200Mi"
           cpu: "2

Check Pod’s QoS Class after deploying by following the example mentioned below:

kubectl describe Pod Pod-l2fwd-78554948b7-zrfvj | grep -i qos
QoS Class:       Guaranteed

7.4.3. Prerequisites for Using Network Annotations

To use network annotations, you must meet the following prerequisites:

  • The namespace in which Helm Charts or YAML based objects are planned to be deployed in should be registered with Robin. Details on the command by which to achieve this can be found here.

  • All Kubernetes objects including controllers, Pods etc. that request network resources must meet one of the following conditions in order to have the appropriate network resources allocated to them by the Robin orchestrator:

    • Both app and release labels need to be present within the object definition. This is considered the old style of naming.

    • Both app.kubernetes.io/name and app.kubernetes.io/instance labels need to be present within the object definition. This is considered the new style of naming. For more information on updated naming conventions, see Recommended Labels.

Note

  • Each controller including all StatefulSets, ReplicaSets, Deployments, and Daemonsets within a Kubernetes cluster must have a unique combination of app and release labels.

7.4.4. Assigning an interface via Network Annotations

In order to have an interface and consequently an IP Address from a registered IP-Pool assigned to a Pod, the robin.io/networks must first be utilized in the manner showcased in the example below. The value for this annotation must be a stringified list consisting of a dictionary containing the name of the IP-Pool from which the IP Address should be assigned from.

Note

A Pod that needs only a Calico interface does not require any annotations to be specified.

robin.io/networks: '[{"ippool": "sriov99"}]'

In order to have multiple interfaces assigned to a Pod, multiple IP-Pools can be specified in the aforemntioned annotation as shown below. This in turn inherently means that Robin supports allocating multiple IPv4 and/or IPv6 IP Addresses to a Pod.

Note

You must not use the Network Attached definitions, network annotations, and robin.io/networks annotation together in a Pod.

robin.io/networks: '[{"ippool": "ovs1"}, {"ippool": "sriov99"}]'

The list of available IP-Pools from which an IP Address can be allocated from can be viewed via either the Robin CLI or native Kubernetes as detailed here. In addition, several options can be specified within each interface request in order to customize the interface allocated. For more details review the section detailed here.

Note

When your Robin Cluster is down and if Pod creation happens at the same time using the robin.io/networks annotation, static IP address allocation for the Pod will fail. You must bounce the Pod after the Robin Cluster is up for static IP address allocation.

7.4.5. Network Annotation options

Described below are the options that can be utilized in order to customize the interface allocated via the robin.io/network annotation. Each of these options can be used once and in conjunction with one another within each IP-Pool requested in the aforementioned annotation.

7.4.5.1. Enabling trusted mode

In order to set the allocated interface into trusted mode in order to enable it to perform additional operations, specify the trust parameter as shown in the example below. By default this option is disabled.

Note

This is a L2 option for Virtual Functions.

Example:

annotations:
    robin.io/networks: '[{"ippool": "sriov99", "trust": "on"}]'

7.4.5.2. Enabling spoof checking

In order to enable spoof checking for the allocated interface in order to improve network security, specify the spoofchk parameter as shown in the example below. By default this option is disabled.

Note

This is a L2 option for Virtual Functions.

Example:

annotations:
    robin.io/networks: '[{"ippool": "sriov99", "spoofchk": "on"}]'

7.4.5.3. Setting the Bond mode

In order to configure the bond policy of the bonded interface via the Bond CNI, specify the bond_mode parameter as shown in the example below with the respective policy name. Currently Robin only supports the active-backup mode.

Example:

annotations:
            robin.io/networks: '[{"ippool": "sriov99", "bond_mode": "active-backup"}]

7.4.5.4. Allocating an interface for a container

In order to allocate an interface to a specific container when multiple are contained within the Pod to be deployed, specify the container parameter as shown in the example below with the respective name of the container to which the interface needs to be associated with.

Example:

annotations:
        robin.io/networks: {"ippool": "sriov99", "container": "container1"}

7.4.5.5. Setting the MTU for an interface

In order to configure the MTU size for an allocated Virtual Function, specify the mtu parameter as shown in the example below with the desired transmission size.

Note

This configuration only affects the Virtual Function assigned, the MTU for the backend switch port and Physical Function must be set manually beforehand.

Example:

annotations:
                robin.io/networks: '[{"ippool": "sriov99", "mtu": "9000"}]'

7.4.5.6. Assigning an environment variable prefix

In order to specify a prefix that should prepended to the environment variables related to the assigned interface within the Pod, specify the name parameter as shown in the example below with the desired text.

Example:

annotations:
                robin.io/networks: '[{"ippool": "sriov99", "name": "FRONTHAUL"}]

7.4.5.7. Setting a custom interface name

In order to specify a custom interface name of no more than 15 characters for easier internal identification, specify the interface_name parameter as shown in the example below with the desired name. In addition this feature allows users to meet the interface name requirements of a network function within a Pod if needed. If this parameter is not utilized, the default Robin interface naming scheme is used.

Note

Names such as eth0 or lo should not be used as the Pod will not be created. However other common names such as net can be used if it available.

Example:

annotations:
    robin.io/networks: '[{"ippool": "sriov99", "interface_name": "sr1"}]

7.4.5.8. Assigning static IP Addresses

In order to specify a static IP Address that should be assigned to a Pod, utilize the static_ips parameter as shown in the example below with the list of possible static IP Addresses that can be assigned to the respective pod.

Note

A range of IP Addresses can also be specified instead of singular entries within the given list of allocatable IP Addresses.

Example:

annotations:
    robin.io/networks: '[{"ippool": "sriov99", "static_ips": ["192.168.96.10-15", "192.168.96.17"]}]'

7.4.5.9. Specifying a static IP policy

In order to specify a static IP policy that should be considered when allocating an IP Address to the a Pod, utilize the static_ip_policy parameter as shown in the example below with one of the following valid values:

  • range - This option should be used when the IP Address to be allocated needs to be within the range of viable static IP Addresses specified in the annotation. When no policy is specified this is the default option.

  • ippool - This option should be used when the IP Address to be allocated can be any available IP Address in the specified IP-Pool when the specified static IP Addresses in the annotation are in-use.

Note

The static_ip_policy parameter is only valid when static IP Addresses are specified within the same annotation via the static_ips parameter.

Example:

annotations:
   robin.io/networks: '[{"ippool": "sriov99", "static_ip_policy": "ippool", "static_ips": ["192.168.96.10-15", "192.168.96.17"]}]'

Note

When your Robin Cluster is down and if Pod creation happens at the same time using the robin.io/networks annotation, static IP address allocation for the Pod will fail. You must bounce the Pod after the Robin Cluster is up for static IP address allocation.

7.4.5.10. Assigning multiple IP Addresses to a single interface

In order to allocate multiple IPv4 and/or IPv6 addresses to a single interface within a Pod, utilize the primary parameter as shown in the example below with the name of an OVS or SR-IOV based IP-Pool as the value alongside a secondary IP-Pool specified via the ippool parameter.

Example:

annotations:
    robin.io/networks: '[{"ippool": "sec-1", "primary": "sriov99"}]'

7.4.6. Assigning a device via Annotations

In order to have a device assigned to a Pod and consequently allow its containers to take advantage of the accelerator functions and hardware, the robin.io/device annotation must first be utilized in the manner showcased in the example below. The value for this annotation must be a stringified list consisting of a dictionary containing the type, devid, driver and vendor attributes of the device to assign functions from.

robin.io/devices: '[{"type": "fpga", "devid": "0x0d90", "vendor": "0x8086", "driver": "vfiopci"}]'

In order to have a function from multiple devices assigned to a Pod, multiple devices can be specified in the aforemntioned annotation as shown below.

robin.io/devices: '[{"type": "fpga", "devid": "0x0d90", "vendor": "0x8086", "driver": "vfiopci"}, {"type": "fpga", "devid": "0x0d90", "vendor": "0x8086", "driver": "igbuio"}]'

The list of available devices from which a function can be allocated from can be viewed via the command robin host list --devices command. More details on the command can be found here. In addition, several options can be specified within each device request in order to customize the function allocated. For more details review the section detailed here.

7.4.7. Getting CPU IDs Inside a Pod

If you need allocating CPU IDs inside containers requesting guaranteed CPUs, you can access them in the /robinenv file.

Example:

[root@Pod-l2fwd l2fwd]# cat /robinenv
ROBIN_CPUSET=5,6,29,30
ROBIN_CPUSET_ORDERED=5:29,6:30
ROBIN_CPUSET_RANGE=5-6,29-30

7.4.8. Environment Variables to use with Annotations

Robin exposes a set of environment variables prefixed with the phrase “ROBIN” within Pods deployed via YAML files. A subset of the aforementioned variables are displayed below and can be accessed via the env command from within the Pod.

Example:

[root@Pod-pktgen-5-668b9d6d5c-58822 pktgen]# env | grep ROBIN

ROBIN_SRIOV5_SUBNET=fd74:ca9b:3a09:8685:0000:0000:0000:0000
ROBIN_NONROBIN_DEFAULT_IP_ADDRESS=fd74:ca9b:3a09:868c:0172:0018:0000:42af
ROBIN_NONROBIN_DEFAULT_DRIVER=calico
ROBIN_SRIOV5_VFIDS=9,7
ROBIN_SRIOV5_DRIVER=sriov
ROBIN_NONROBIN_DEFAULT_NETMASK=ffff:ffff:ffff:ffff:ffff:ffff:ffff:c000
ROBIN_SRIOV5_IP_ADDRESS=fd74:ca9b:3a09:8685:00c0:00a8:0001:006f
ROBIN_SRIOV5_PFNAMES=enp175s0f1,enp175s0f0
ROBIN_SRIOV5_PCI_ADDR=0000:af:0b.1,0000:af:02.7
ROBIN_NONROBIN_DEFAULT_SUBNET=fd74:ca9b:3a09:868c:0172:0018:0000:4000
ROBIN_SRIOV5_MTU=1500
ROBIN_SRIOV5_VFDRIVER=iavf
ROBIN_MEMORY=209715200
ROBIN_SRIOV5_INTF_NAMES=eth1,eth2
ROBIN_SRIOV5_VLAN=20
ROBIN_SRIOV5_NETMASK=ffff:ffff:ffff:ffff:0000:0000:0000:0000

7.5. Network Policy Support

Robin supports the Kubernetes concept of NetworkPolicies for Robin bundles and Helm applications based on the Calico network. These policies allow administrators to enforce rules that control traffic flow at the IP address or port level. More specifically they are an application-centric construct which determine how a pod is allowed to communicate with various network entities such as external network endpoints/services and other pods. For more information, view the official documentation here.

7.5.1. How it works

By default, Pods are non-isolated, and they accept traffic from any source including other Pods present within the cluster. Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. Network policies affect only Pod-to-Pod communication and do not affect service-to-service traffic directly. Network policies use labels specified within the PodSelector attribute of their definition to select the Pods on which the associated traffic rules will be enforced.

7.5.2. Robin network policies

The following are the network policies supported by Robin:

  • Allow-all: Ingress/egress traffic is allowed to/from all application Pods in the cluster.

  • Namespace application isolation: Ingress/egress traffic is allowed to/from all application Pods within a namespace.

  • Tenant application isolation: Ingress/egress traffic is allowed to/from all application Pods within a tenant.

  • User application isolation: Ingress/egress traffic is allowed to/from all application Pods for a user.

  • Application Pods isolation: Ingress/egress traffic is allowed to/from all Pods of an application.

  • Deny-all: No ingress/egress traffic is allowed to/from all application Pods in the cluster.

7.5.3. Cluster level attributes

Robin supports two main configuration attributes, create_user_ns_tenant_isolation_nw_policies and network_policy_scope, with regards to network policies and their configuration. Both attributes are at the cluster level and are described in the following sections. In addition the current status of each can be viewed via the robin config list command.

7.5.3.1. Enable cluster level network policies

By default, Robin does not create any Kubernetes Ingress/Egress network policies when a user, namespace, or tenant is created within the cluster. In order to enable this behavior when one of the aforementioned entities is created, run the following command:

# robin config cluster create_user_ns_tenant_isolation_nw_policies True
The 'cluster' attribute 'create_user_ns_tenant_isolation_nw_policies' has been updated

Note

Robin creates the default isolation network policies for the user, namespace, or tenant created post-upgrade if the cluster level network policies are set to True.

7.5.3.2. Disable cluster level network policies

To disable the creation of Kubernetes Ingress/Egress network policies when a user, namespace, or tenant is added such that no trafic is blocked or so custom network policies can be applied, run the following command:

# robin config update cluster create_user_ns_tenant_isolation_nw_policies False
The 'cluster' attribute 'create_user_ns_tenant_isolation_nw_policies' has been updated

7.5.3.3. Configure Network Policy Scope attribute

Robin supports the automatic addition of network policy labels to pods which are created as part of an application deployment. The labels added are determined by the network_policy_scope attribute, which by default is set to allow-all. In order to configure the network_policy_scope attribute at the cluster level, run the following command:

# robin config update cluster network_policy_scope <value>

Example

# robin config update cluster network_policy_scope namespace
The 'cluster' attribute 'network_policy_scope' has been updated

The following are the valid values:

  • allow-all

  • namespace

  • tenant

  • user

  • app

  • deny-all

The above values all map to the respective policies detailed here.

7.5.4. Create network policies for individual users

In order to create Kubernetes Ingress/Egress network policies for an individual Robin user or a set of users, run the following command:

# robin networkpolicy create <usernames>

usernames

Comma seperated list of Robin usernames for whom the network policies should be created.

Example

# robin networkpolicy create T2User
Successfully added K8S network policies for user 'T2User'

Creates Kubernetes Ingress/Egress network policies for an individual Robin user or a set of users.

End Point: /api/v3/robin_server/networkpolicies

Method: POST

URL Parameters: None

Data Parameters:

  • user_info: <dict_of_key_value_pairs>

    • user_list: <list_of_user_names> - This mandatory field within the dictionary specifies the names of the Robin users for which the Kubernetes network policies should be created for

Port: RCM Port (default value is 29442)

Headers:

  • Authorization: <auth_token> : Authorization token to identify which user is sending the request. The token can be acquired from the login API.

Success Response Code: 200

Error Response Code: 500 (Internal Server Error), 404 (Not Found Error), 401 (Unauthorized Error), 400 (Invalid API Usage Error)

Example Response:

Output
{
   "message":"\nSuccessfully added K8S network policies for Robin User\/s '['robin']'\n"
}

7.5.5. Attach network policy to application

In order to associate either the default Robin network policies or any custom network policies with an application(s), issue the following command:

# robin app attach-network-policy <appnames> <policies>
                                             --roles <roles>

appnames

Comma separated list of one or more application names.

policies

Comma separated list of one or more Kubernetes Network Policy names to attach to specified applications.

--roles <roles>

Comma separated list of roles within an application to attach the specified network policies. If not specified it is attached to all roles within the application.

Example

# robin app attach-network-policy app-1-robinuser up-allow-intra-user-pods-t001-u000003-3 --wait
Job:  127 Name: ApplicationAddPolicy State: VALIDATED       Error: 0
Job:  127 Name: ApplicationAddPolicy State: COMPLETED       Error: 0

7.5.6. Detach network policy from application

In order to dissociate either default Robin network policies or any custom network policies from an application(s), issue the following command:

# robin app detach-network-policy <appnames> <policies>
                                             --roles <roles>

appnames

Comma separated list of one or more application names.

policies

Comma separated list of one or more Kubernetes Network Policy names to detach from specified applications.

--roles <roles>

Comma separated list of roles within an application to detach the specified network policies from. If not specified it is attached to all roles within the application.

Example

# robin app detach-network-policy app-1-robinuser up-allow-intra-user-pods-t001-u000003-3 --wait
Job:  127 Name: ApplicationRemovePolicy State: VALIDATED       Error: 0
Job:  127 Name: ApplicationRemovePolicy State: COMPLETED       Error: 0

7.5.7. View network policies attached to an application

In order to view the network policies currently associated with an application the robin app info command can be used with the --networkpolicies parameter. More details on this operation can be found here.

7.5.8. View network policies in cluster

You can view the network policies configured in your cluster.

To view the network policies in the cluster, run the following command:

# network-policies

Example

# network-policies
NAMESPACE      NAME                           POD-SELECTOR                                                AGE
sveta-custom   np-allow-intra-ns-pods         robin.io/networkpolicyns=np-allow-intra-ns-pods             105m
sveta-custom   np-deny-all-pods               robin.io/networkpolicyns=np-deny-all-pods                   105m
sveta-custom   tp-allow-intra-tenant-pods-1   robin.io/networkpolicytenant=tp-allow-intra-tenant-pods-1   105m
sveta-custom   up-allow-intra-user-pods-4     robin.io/networkpolicyuser=up-allow-intra-user-pods-4       105m
t001-u000001   np-allow-intra-ns-pods         robin.io/networkpolicyns=np-allow-intra-ns-pods             130m
t001-u000001   np-deny-all-pods               robin.io/networkpolicyns=np-deny-all-pods                   130m
t001-u000001   tp-allow-intra-tenant-pods-1   robin.io/networkpolicytenant=tp-allow-intra-tenant-pods-1   130m
t001-u000001   up-allow-intra-user-pods-1     robin.io/networkpolicyuser=up-allow-intra-user-pods-1       130m
t001-u000002   np-allow-intra-ns-pods         robin.io/networkpolicyns=np-allow-intra-ns-pods             130m
t001-u000002   np-deny-all-pods               robin.io/networkpolicyns=np-deny-all-pods                   130m

7.5.9. View network policies for namespace

You can view the network policies configured for a namespace in your cluster.

To view the network policies configured for a namespace, run the following command:

# network-policies ns<namespace_name>

Example

# network-policies t001-u000003
t001-u000003   np-allow-intra-ns-pods         robin.io/networkpolicyns=np-allow-intra-ns-pods                132m
t001-u000003   np-deny-all-pods               robin.io/networkpolicyns=np-deny-all-pods                      132m
t001-u000003   tp-allow-intra-tenant-pods-1   robin.io/networkpolicytenant=tp-allow-intra-tenant-pods-1      132m
t001-u000003   up-allow-intra-user-pods-3     robin.io/networkpolicyuser=up-allow-intra-user-pods-3          132m

Alternatively, you can also run the following command to view the network policies configured for a namespace.

# robin namespace info <namespace name>

Example

# robin namespace info t037-u000077
Namespace: t037-u000077
    Primary Namespace: True
    User: T1User
    Tenant: T1
    Imported: False
    K8S Ingress/Egress Network Policies:
      - np-allow-intra-ns-pods (Allow Ingress/Egress Traffic from/to application pods within namespace t037-u000077)

      - np-deny-all-pods (Block Ingress/Egress Traffic from/to all application pods in the cluster)

      - tp-allow-intra-tenant-pods-37 (Allow Ingress/Egress Traffic from/to all application pods within tenant T1)

      - up-allow-intra-user-pods-77 (Allow Ingress/Egress Traffic from/to all application pods for user T1User)

7.5.10. View information of network policy

You can view the detailed information of the network policy configured for a namespace in your cluster.

To view the detailed information of a network policy, run the following command:

# network-policy-info ns<namespace_name> policy<network_policy_name>

Example

# network-policy-info t001-u000003 np-allow-intra-ns-pods
Name:        np-allow-intra-ns-pods
Namespace:   t001-u000003
Created on:   2021-02-05 10:41:15 -0800 PST
Labels:      robin.io/domain=ROBIN
             robin.io/networkpolicyns=np-allow-intra-ns-pods
Annotations:  <none>
Spec:
  PodSelector:     robin.io/networkpolicyns=np-allow-intra-ns-pods
  Allowing ingress traffic:
      To Port: <any> (traffic allowed to all ports)
      From:
      NamespaceSelector: robin.io/namespace=t001-u000003
      From:
      IPBlock:
      CIDR: 0.0.0.0/0
      Except: 172.18.0.0/16, 172.21.0.0/16
  Allowing egress traffic:
      To Port: <any> (traffic allowed to all ports)
      To:
      NamespaceSelector: robin.io/namespace=t001-u000003
  Policy Types: Egress, Ingress