OpenStack networks and security group considerations for Kubernetes
Tags: openstack, kubernetes, docker, systemadministration
Published: 2019-01-01 00:13:19

---
title: OpenStack networks and security group considerations for Kubernetes
published: true
description: 
tags: openstack, kubernetes, docker, system-administration
---

The [OpenStack cloud provider for Kubernetes](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#openstack) allows on-prem provisioning of resources like Cinder volumes and LBaaS to provide Kubernetes persistent storage and LoadBalancer services.

If you run Kubernetes on OpenStack-provided cloud services, and have API access in your project, as I do, the following configuration allows you to create a cluster-only network, with an appropriate Security Group.

If you do not currently have the OpenStack CLI tools installed on your machine, you can use the following:

```bash
pip install --upgrade --requirement \
http://raw.githubusercontent.com/platform9/support-locker/master/openstack-clients/requirements.txt \
--constraint \
http://raw.githubusercontent.com/openstack/requirements/stable/newton/upper-constraints.txt
```
to install them. 

I make the following assumption for your network configuration: if you have a [physical upstream network-connected](https://docs.openstack.org/install-guide/launch-instance-networks-provider.html) IPv4 subnet provided to you by your infrastructure provider (or your infra team if you operate OpenStack yourself), this will be configured as a Floating IP pool, and we'll call that subnet `public_subnet` in the `public` network object. I also make the assumption that you are using Neutron networking. 

Create a router, which we'll use for, both the above Floating IP pool, and your private network:

```bash
neutron router-create router-name
```

and set it as the default gateway for your `public` network:

```bash
neutron router-gateway-set router-name public
```

We'll create a private network that we'll use for the Kubernetes nodes, and as the anchor for the floating IP pool we'll create shortly:

```bash
neutron net-create kube_private_network && \
neutron subnet-create --name private_subnet kube_private_network 192.168.200.0/24 && \
neutron router-interface-add router-name private_subnet
```

so when creating instances attached to that network, they'll get an address from 192.168.200.2-254. You'll provision the floating IPs from your `public` network subnet as one-off tasks:

```
neutron floatingip-create public
```

and associate them at creation time. 

For your Kubernetes `cloud.conf`, you'll need the Subnet ID of the range of IPs you'd like to use for your LoadBalancer objects when creating resoures in Kubernetes:

```bash
~ » openstack subnet list                                                                                         2 ↵
+--------------------------------------+----------------+--------------------------------------+------------------+
| ID                                   | Name           | Network                              | Subnet           |
+--------------------------------------+----------------+--------------------------------------+------------------+
| 05a55a42-ff5e-4b53-a6a7-e9f4d1cc5a56 | subnet1        | 0048fce6-c715-4106-a810-473620326cb0 | 192.168.100.0/24   |
| ecc841d0-1ac4-419f-9a2e-a9fffbd44922 | private_subnet | a133a2c0-e16a-4a23-ac8e-df1e270169ed | 192.168.200.0/24 |
+--------------------------------------+----------------+--------------------------------------+------------------+
```

so, for example, I want to use my `192.168.100.0/24` subnet, so I'll make node of that subnet ID for later.

You can, then, proceed to create the security group:

```bash
openstack security group create kubernetes
```

and you'll just need your project ID from your Openstack RC file to proceed to create your rules:

```bash
openstack security group rule create \                                                                        
--dst-port 6443 \
--ingress \
--project $PROJECT_ID \
--src-ip 192.168.200.0/24 \
kubernetes
```
this, for example, allows all the nodes in the cluster access to the API server port. 

Once all of this is complete, usually independent of which Kube deployment method you use, you'll need to populate your `cloud.conf`, as I noted earlier, for the [OpenStack cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#typical-configuration) in Kubernetes, and with the OpenStack subnet ID noted earlier, you can populate it like so:

```yaml
[Global]
username=${user_name}
tenant-id=${tenant_id}
password=${password}
auth-url=$AUTH_URL
[LoadBalancer]
subnet-id=${lb_subnet_id}
floating-network-id=${floating_network_id}
lb-method=ROUND_ROBIN
lb-provider=amphora
[BlockStorage]
bs-version=auto
```
before you complete the rest of the setup. For Kubeadm users, the following guide is an excellent resource to setting up the Openstack cloud-provider for Kubernetes:

[Kubernetes with OpenStack Cloud Provider](https://medium.com/@arthur.souzamiranda/kubernetes-with-openstack-cloud-provider-current-state-and-upcoming-changes-part-1-of-2-48b161ea449a)