Chapter 8. Common administrative networking tasks Sometimes you might need to perform administration tasks on the Red Hat OpenStack Services on OpenShift (RHOSO) Networking service (neutron) such as specifying the name assigned to ports by the internal DNS. This section includes the following topics: Section 8.1, "Configuring shared security groups" Section 8.2, "Specifying the name that DNS assigns to ports" Section 8.3, "Enabling NUMA affinity on ports" Section 8.4, "Limiting queries to the metadata service" Section 8.5, "Enabling and configuring FDB learning" 8.1. Configuring shared security groups When you want one or more projects to be able to share data in a Red Hat OpenStack Services on OpenShift (RHOSO) environment, you can use the Networking service (neutron) RBAC policy feature to share a security group. You create security groups and Networking service role-based access control (RBAC) policies using the OpenStack Client. You can apply a security group directly to an instance during instance creation, or to a port on the running instance. Note You cannot apply a role-based access control (RBAC)-shared security group directly to an instance during instance creation. To apply an RBAC-shared security group to an instance you must first create the port, apply the shared security group to that port, and then assign that port to the instance. See Adding a security group to a port in Creating and managing instances . Prerequisites You have at least two RHOSO projects that you want to share. In one of the projects, the current project , you have created a security group that you want to share with another project, the target project . In this example, the ping_ssh security group is created: Example USD openstack security group create ping_ssh You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. Procedure Access the remote shell for the OpenStackClient pod from your workstation: Obtain the names or IDs of the project that contains the security group and the target project. USD openstack project list Obtain the name or ID of the security group that you want to share between RHOSO projects. USD openstack security group list Using the identifiers from the steps, create an RBAC policy using the openstack network rbac create command. In this example, the ID of the target project is 32016615de5d43bb88de99e7f2e26a1e . The ID of the security group is 5ba835b7-22b0-4be6-bdbe-e0722d1b5f24 : Example USD openstack network rbac create --target-project \ 32016615de5d43bb88de99e7f2e26a1e --action access_as_shared \ --type security_group 5ba835b7-22b0-4be6-bdbe-e0722d1b5f24 --target-project specifies the project that requires access to the security group. Tip You can share data between all projects by using the --target-all-projects argument instead of --target-project <target_project> . By default, only the admin user has this privilege. --action access_as_shared specifies what the project is allowed to do. --type indicates that the target object is a security group. 5ba835b7-22b0-4be6-bdbe-e0722d1b5f24 is the ID of the particular security group which is being granted access to. The target project is able to access the security group when running the OpenStack Client security group commands, in addition to being able to bind to its ports. No other users (other than administrators and the owner) are able to access the security group. Tip To remove access for the target project, delete the RBAC policy that allows it using the openstack network rbac delete command. Exit the openstackclient pod: USD exit 8.2. Specifying the name that DNS assigns to ports In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you can specify the name assigned to ports by the internal DNS. You enable this functionality in the Networking service (neutron), by loading the ML2 extension driver, DNS domain for ports, dns_domain_ports . After loading the driver, you can use the OpenStack Client port commands, port set or port create , with --dns-name to assign a port name. Important You must enable the DNS domain for ports extension ( dns_domain_ports ) for DNS to internally resolve names for ports in your RHOSO environment. Using the NeutronDnsDomain default value, openstacklocal , means that the Networking service does not internally resolve port names for DNS. Also, when the DNS domain for ports extension is enabled, the Compute service automatically populates the dns_name attribute with the hostname attribute of the instance during the boot of VM instances. At the end of the boot process, dnsmasq recognizes the allocated ports by their instance hostname. Prerequisites You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. Procedure Update the control plane with the key value pair, service_plugins=dns_domain_ports : USD oc patch -n openstack openstackcontrolplane openstack-galera-network-isolation --type=merge --patch " --- spec: neutron: template: customServiceConfig: | [ml2] extension_drivers=dns_domain_ports " Note If you set dns_domain_ports , ensure that the deployment does not also use dns_domain , the DNS Integration extension. These extensions are incompatible, and both extensions cannot be defined simultaneously. RHOSO users can now set up port forwarding for floating IPs. Verification Access the remote shell for the OpenStackClient pod from your workstation: Confirm that the Networking service has successfully loaded the dns_domain_ports ML2 extension driver: USD openstack extension list --network --max-width 75 | \ grep dns-domain-ports --os-cloud <cloud_name> Replace <cloud_name> with the name of the cloud on which you are running the command. Sample output A successful verification produces output similar to the following: | dns_domain for ports | dns-domain-ports | Allows the DNS domain to be specified for a network port. Create a new port ( new_port ) on a network ( public ). Assign a DNS name ( my_port ) to the port. Example USD openstack port create --network public --dns-name my_port new_port Display the details for your port ( new_port ). Example USD openstack port show -c dns_assignment -c dns_domain -c dns_name -c name new_port Sample output +-------------------------+----------------------------------------------+ | Field | Value | +-------------------------+----------------------------------------------+ | dns_assignment | fqdn='my_port.example.com', | | | hostname='my_port', | | | ip_address='10.65.176.113' | | dns_domain | example.com | | dns_name | my_port | | name | new_port | +-------------------------+----------------------------------------------+ Under dns_assignment , the fully qualified domain name ( fqdn ) value for the port contains a concatenation of the DNS name ( my_port ) and the domain name ( example.com ) that you set earlier with NeutronDnsDomain . Create a new VM instance ( my_vm ) using the port ( new_port ) that you just created. Example USD openstack server create --image rhel --flavor m1.small --port new_port my_vm Display the details for your port ( new_port ). Example USD openstack port show -c dns_assignment -c dns_domain -c dns_name -c name new_port Sample output +-------------------------+----------------------------------------------+ | Field | Value | +-------------------------+----------------------------------------------+ | dns_assignment | fqdn='my_vm.example.com', | | | hostname='my_vm', | | | ip_address='10.65.176.113' | | dns_domain | example.com | | dns_name | my_vm | | name | new_port | +-------------------------+----------------------------------------------+ Note that the Compute service changes the dns_name attribute from its original value ( my_port ) to the name of the instance with which the port is associated ( my_vm ). Exit the openstackclient pod: USD exit 8.3. Enabling NUMA affinity on ports In Red Hat OpenStack Services on OpenShift (RHOSO) environments, to enable users to create instances with NUMA affinity on the port, you must load the Networking service (neutron) ML2 extension driver, NUMA port affinity policy, port_numa_affinity_policy . Prerequisites You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. Procedure Update the control plane with the key value pair, extension_drivers=port_numa_affinity_policy : USD oc patch -n openstack openstackcontrolplane openstack-galera-network-isolation --type=merge --patch " --- spec: neutron: template: customServiceConfig: | [ml2] extension_drivers=port_numa_affinity_policy " Verification Access the remote shell for the OpenStackClient pod from your workstation: Confirm that the Networking service has successfully loaded the port_numa_affinity_policy ML2 extension driver: USD openstack extension list --network --max-width 74 | \ grep port-numa-affinity-policy --os-cloud <cloud_name> Replace <cloud_name> with the name of the cloud on which you are running the command. Sample output A successful verification produces output similar to the following: | Port NUMA affinity policy | port-numa-affinity-policy | Expose the port NUMA affinity policy Create a new port. When you create a port, use one of the following options to specify the NUMA affinity policy to apply to the port: --numa-policy-required - NUMA affinity policy required to schedule this port. --numa-policy-preferred - NUMA affinity policy preferred to schedule this port. --numa-policy-legacy - NUMA affinity policy using legacy mode to schedule this port. Example Display the details for your port. Example Sample output When the extension is loaded, the Value column should read, legacy , preferred or required . If the extension has failed to load, Value reads None : Exit the openstackclient pod: USD exit Additional resources "Instance PCI NUMA affinity policy" in Flavor metadata in Configuring the Compute service for instance creation 8.4. Limiting queries to the metadata service To protect Red Hat OpenStack Services on OpenShift (RHOSO) environments against cyber threats such as denial of service (DoS) attacks, the Networking service (neutron) offers administrators the ability to limit the rate at which VM instances can query the Compute metadata service. Administrators do this by assigning values to a set of parameters that the Networking service uses to configure HAProxy servers to perform the rate limiting. The HAProxy servers run inside the metadata service. To add metadata rate limiting for a node set, complete these tasks: Create a ConfigMap custom resource (CR) to configure the nodes. Create a custom service for the feature that runs the playbook for the service. Include the ConfigMap CR in the custom service. A detailed procedure follows. Prerequisites You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. Your RHOSP environment uses IPv4 networking. Currently, the Networking service does not support metadata rate limiting on IPv6 networks. You have a scheduled maintenance window. This procedure requires you to restart the OVN metadata service. Procedure Create a ConfigMap CR that defines a new configuration for metadata rate limiting, and save it to a YAML file on your workstation, for example, neutron-metadata-rate-limit.yaml . Note Do not use the name of the default configuration file, because it would override the infrastructure configuration, such as the transport_url . Set values for the following rate limiting parameters: rate_limit_enabled enables you to limit the rate of metadata requests. The default value is false . Set the value to true to enable metadata rate limiting. ip_versions the IP version, 4 , used for metadata IP addresses on which you want to control query rates. RHOSP does not yet support metadata rate limiting for IPv6 networks. base_window_duration the time span, in seconds, during which query requests are limited. The default value is 10 seconds. base_query_rate_limit the maximum number of requests allowed during the base_window_duration . The default value is 10 requests. burst_window_duration the time span, in seconds, that a request rate higher than the base_window_duration is allowed. The default value is 10 seconds. burst_query_rate_limit the maximum number of requests allowed during the burst_window_duration . The default value is 10 requests. Example In this example, the Networking service is configured for a base time and rate that allows instances to query the IPv4 metadata service IP address 6 times over a 60 second period. The Networking service is also configured for a burst time and rate that allows a higher rate of 2 queries during shorter periods of 10 seconds each: Create the ConfigMap object by using the ConfigMap CR file. Example USD oc create -f neutron-metadata-rate-limit.yaml -n openstack Create an OpenStackDataPlaneService CR that defines the metadata rate limit custom service, and save it to a YAML file on your workstation, for example neutron-metadata-rate-limit-service.yaml : Add the ConfigMap CRs to the custom service, and specify the Secret CR for the cell that the node set that runs this service connects to: Specify the Ansible commands to create the custom service, by referencing an Ansible playbook or by including the Ansible play in the playbookContents field: Create the metadata-rate-limit service: USD oc apply -f neutron-metadata-rate-limit -n openstack Verification Confirm that the custom service is created: USD oc get openstackdataplaneservice neutron-metadata-rate-limit -o yaml -n openstack Additional resources Configuring a node set for a feature or workload in Customizing the Red Hat OpenStack Services on OpenShift deployment 8.5. Enabling and configuring FDB learning In Red Hat OpenStack Services on OpenShift (RHOSO) environments, you can use forwarding database (FDB) learning to prevent traffic flooding on ports that have port security disabled. You can set the maximum time set a removal limit to prevent OVN from removing a large number of FDB table entries at the same time. Warning The content in this section is available in this release as a Documentation Preview , and therefore is not fully supported by Red Hat. It should only be used for testing, and should not be deployed in a production environment. Prerequisites You have the oc command line tool installed on your workstation. You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges. Procedure Open your OpenStackControlPlane custom resource (CR) file, openstack_control_plane.yaml , on your workstation. Add the following configuration to the neutron service configuration: spec: neutron: template: customServiceConfig: | [ovn] localnet_learn_fdb = true 1 fdb_age_threshold = 300 2 fdb_removal_limit = 50 3 1 Enables FDB learning. 2 Sets the maximum time (seconds) that the learned MACs stay in the FDB table. 3 Limits the number of FDB table entries that can be removed at the same time by aging function. Update the control plane: Wait until RHOCP creates the resources related to the OpenStackControlPlane CR. Run the following command to check the status: The OpenStackControlPlane resources are created when the status is "Setup complete". Tip Append the -w option to the end of the get command to track deployment progress.

Commands:
openstack security group create ping_ssh
oc rsh -n openstack openstackclient
openstack project list
openstack security group list
openstack network rbac create --target-project 32016615de5d43bb88de99e7f2e26a1e --action access_as_shared --type security_group 5ba835b7-22b0-4be6-bdbe-e0722d1b5f24
exit
oc patch -n openstack openstackcontrolplane openstack-galera-network-isolation --type=merge --patch " --- spec: neutron: template: customServiceConfig: | [ml2] extension_drivers=dns_domain_ports "
oc rsh -n openstack openstackclient
openstack extension list --network --max-width 75 | grep dns-domain-ports --os-cloud <cloud_name>
| dns_domain for ports | dns-domain-ports | Allows the DNS domain to be specified for a network port.
openstack port create --network public --dns-name my_port new_port
openstack port show -c dns_assignment -c dns_domain -c dns_name -c name new_port
+-------------------------+----------------------------------------------+ | Field | Value | +-------------------------+----------------------------------------------+ | dns_assignment | fqdn='my_port.example.com', | | | hostname='my_port', | | | ip_address='10.65.176.113' | | dns_domain | example.com | | dns_name | my_port | | name | new_port | +-------------------------+----------------------------------------------+
openstack server create --image rhel --flavor m1.small --port new_port my_vm
openstack port show -c dns_assignment -c dns_domain -c dns_name -c name new_port
+-------------------------+----------------------------------------------+ | Field | Value | +-------------------------+----------------------------------------------+ | dns_assignment | fqdn='my_vm.example.com', | | | hostname='my_vm', | | | ip_address='10.65.176.113' | | dns_domain | example.com | | dns_name | my_vm | | name | new_port | +-------------------------+----------------------------------------------+
exit
oc patch -n openstack openstackcontrolplane openstack-galera-network-isolation --type=merge --patch " --- spec: neutron: template: customServiceConfig: | [ml2] extension_drivers=port_numa_affinity_policy "
oc rsh -n openstack openstackclient
openstack extension list --network --max-width 74 | grep port-numa-affinity-policy --os-cloud <cloud_name>
| Port NUMA affinity policy | port-numa-affinity-policy | Expose the port NUMA affinity policy
openstack port create --network public --numa-policy-legacy myNUMAAffinityPort
openstack port show myNUMAAffinityPort -c numa_affinity_policy
+----------------------+--------+ | Field | Value | +----------------------+--------+ | numa_affinity_policy | legacy | +----------------------+--------+
exit
apiVersion: v1 kind: ConfigMap metadata: name: neutron-metadata-rate-limit data: 20-neutron-metadata-rate.conf: | [metadata_rate_limiting] rate_limit_enabled = True ip_versions = 4 base_window_duration = 60 base_query_rate_limit = 6 burst_window_duration = 10 burst_query_rate_limit = 2
oc create -f neutron-metadata-rate-limit.yaml -n openstack
apiVersion: dataplane.openstack.org/v1beta1 kind: OpenStackDataPlaneService metadata: name: neutron-metadata-rate-limit
apiVersion: dataplane.openstack.org/v1beta1 kind: OpenStackDataPlaneService metadata: name: neutron-metadata-rate-limit spec: dataSources: - configMapRef: name: neutron-metadata-rate-limit - secretRef: name: neutron-ovn-metadata-agent-neutron-config - secretRef: name: nova-metadata-neutron-config - configMapRef: name: neutron-metadata-rate-limit tlsCerts: default: contents: - dnsnames - ips networks: - ctlplane issuer: osp-rootca-issuer-ovn keyUsages: - digital signature - key encipherment - client auth caCerts: combined-ca-bundle containerImageFields: - EdpmNeutronMetadataAgentImage
apiVersion: dataplane.openstack.org/v1beta1 kind: OpenStackDataPlaneService metadata: name: neutron-metadata-rate-limit spec: playbook: osp.edpm.neutron_metadata dataSources: - configMapRef: name: neutron-metadata-rate-limit - secretRef: name: neutron-ovn-metadata-agent-neutron-config - secretRef: name: nova-metadata-neutron-config tlsCerts: default: contents: - dnsnames - ips networks: - ctlplane issuer: osp-rootca-issuer-ovn keyUsages: - digital signature - key encipherment - client auth caCerts: combined-ca-bundle containerImageFields: - EdpmNeutronMetadataAgentImage
oc apply -f neutron-metadata-rate-limit -n openstack
oc get openstackdataplaneservice neutron-metadata-rate-limit -o yaml -n openstack
spec: neutron: template: customServiceConfig: | [ovn] localnet_learn_fdb = true 1 fdb_age_threshold = 300 2 fdb_removal_limit = 50 3
oc apply -f openstack_control_plane.yaml -n openstack
oc get openstackcontrolplane -n openstack