-
Notifications
You must be signed in to change notification settings - Fork 457
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #69 from alauda/docs/crd-ipv6
docs: add crd/ipv6 docs and bump version 0.6.0
- Loading branch information
Showing
11 changed files
with
255 additions
and
128 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # IPv6 | ||
|
|
||
| Through Kube-OVN does support both protocol subnets coexist in a cluster, Kubernetes control plan now only support one protocol. So you will lost some ability like probe and service discovery if you use a protocol other than the kubernetes control plan. We recommend you use only one same ip protocol that same with kubernetes control plan. | ||
|
|
||
| To enable IPv6 support you need to modify the installation yaml to specify the default subnet and node subnet cidrBlock and gateway with a ipv6 format. You can apply this [v6 version yaml](https://raw.githubusercontent.com/alauda/kube-ovn/v0.6.0/yamls/kube-ovn-ipv6.yaml) at [installation step 3](install.md#to-install) for a quick start. |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,42 +1,59 @@ | ||
| # Subnets | ||
|
|
||
| Kube-OVN uses annotations on Namespaces to create and share Subnets. If a Namespace has no related annotations, it will use the default Subnet (10.16.0.0/16) | ||
| From v0.6.0 Kube-OVN will use Subnet crd to manage subnets. If you still use a version prior to v0.6.0 please update to this version to use new subnet. | ||
|
|
||
| Use the following annotations to define a Subnet: | ||
| ## Example | ||
|
|
||
| - `ovn.kubernetes.io/cidr`: The CIDR of the Subnet. | ||
| - `ovn.kubernetes.io/gateway`: The Gateway address for the Subnet. | ||
| - `ovn.kubernetes.io/logical_switch`: The Logical Switch name in OVN. | ||
| - `ovn.kubernetes.io/exclude_ips`: Addresses that should not be allocated to Pods. | ||
| ```bash | ||
| apiVersion: kubeovn.io/v1 | ||
| kind: Subnet | ||
| name: subnet-gateway | ||
| spec: | ||
| protocol: IPv4 | ||
| default: false | ||
| namespaces: | ||
| - ns1 | ||
| - ns2 | ||
| cidrBlock: 100.64.0.0/16 | ||
| gateway: 100.64.0.1 | ||
| excludeIps: | ||
| - 100.64.0.1 | ||
| private: true | ||
| allowSubnets: | ||
| - 10.16.0.0/16 | ||
| - 10.18.0.0/16 | ||
| gatewayType: centralized | ||
| gatewayNode: node1 | ||
| natOutgoing: true | ||
| ``` | ||
| ## Basic Configuration | ||
|
|
||
| - `protocol`: The ip protocol ,can be IPv4 or IPv6. *Note*: Through kube-ovn support both protocol subnets coexist in a cluster, kubernetes control plan now only support one protocol. So you will lost some ability like probe and service discovery if you use a protocol other than the kubernetes control plan. | ||
| - `default`: If set true, all namespaces that not bind to any subnets will use this subnet to allocate pod ip and share other network configuration. Note: Kube-OVN will create a default subnet and set this field to true. There can only be one default subnet in a cluster. | ||
| - `namespaces`: List of namespaces that bind to this subnet. If you want to bind a namespace to this subnet, edit and add the namespace name to this field. | ||
| - `cidrBlock`: The cidr of this subnet. | ||
| - `gateway`: The gateway address of this subnet. | ||
| - `excludeIps`: List of ips that you do not want to be allocated. | ||
|
|
||
| Example: | ||
| ## Isolation | ||
|
|
||
| ```bash | ||
| apiVersion: v1 | ||
| kind: Namespace | ||
| metadata: | ||
| annotations: | ||
| ovn.kubernetes.io/cidr: 10.17.0.0/16 | ||
| ovn.kubernetes.io/gateway: 10.17.0.1 | ||
| ovn.kubernetes.io/logical_switch: ovn-subnet | ||
| ovn.kubernetes.io/exclude_ips: "192.168.0.4,192.168.0.30..192.168.0.60,192.168.0.110..192.168.0.120" | ||
| name: ovn-subnet | ||
| ``` | ||
| Besides standard NetworkPolicy，Kube-OVN also supports network isolation and access control at the Subnet level to simplify the use of access control. | ||
|
|
||
| This YAML will create a Logical Switch named `ovn-subnet` in OVN, with CIDR 10.17.0.0/16, and Gateway 10.17.0.1. The IP addresses between 10.17.0.0 and 10.17.0.10 will not be allocated to the Pods. | ||
| *Note*: NetworkPolicy take a higher priority than subnet isolation rules. | ||
|
|
||
| **NOTE**: In the current version, we only support creating a Subnet while creating a new Namespace. Modifying annotations after Namespace creation will not trigger Subnet creation/update in OVN. Dynamic Subnet configuration is planned for a future release. | ||
| - `private`: Boolean, controls whether to deny traffic from IP addresses outside of this Subnet. Default: false. | ||
| - `allow`: Strings of CIDRs separated by commas, controls which addresses can access this Subnet, if `private=true`. | ||
|
|
||
| To share a Subnet across multiple Namespaces, point the annotation `ovn.kubernetes.io/logical_switch` to an existing Logical Switch when creating the Namespace. For example: | ||
| ## Gateway | ||
|
|
||
| ```bash | ||
| apiVersion: v1 | ||
| kind: Namespace | ||
| metadata: | ||
| annotations: | ||
| ovn.kubernetes.io/logical_switch: ovn-subnet | ||
| name: ovn-share | ||
| ``` | ||
| Gateway is used to enable external network connectivity for Pods within the OVN Virtual Network. | ||
|
|
||
| Kube-OVN supports two kinds of Gateways: the distributed Gateway and the centralized Gateway. Also user can expose pod ip directly to external network. | ||
|
|
||
| For a distributed Gateway, outgoing traffic from Pods within the OVN network to external destinations will go through the Node where the Pod is hosted. | ||
|
|
||
| For a centralized gateway, outgoing traffic from Pods within the OVN network to external destinations will go through Gateway Node for the Namespace. | ||
|
|
||
| This YAML will create a Namespace ovn-share that uses the same Subnet as the previous Namespace `ovn-subnet`. | ||
| - `gatewayType`: `distributed` or `centralized`, default is `distributed`. | ||
| - `gatewayNode`: when `gatewayType` is `centralized` used this field to specify which node act as the namespace gateway. | ||
| - `natOutgoing`: `true` or `false`, whether pod ip need to be masqueraded when go through gateway. When `false`, pod ip will be exposed to external network directly, default `false`. |
Oops, something went wrong.