williamcaban

---
apiVersion: ingressnodefirewall.openshift.io/v1alpha1
kind: IngressNodeFirewallConfig
metadata:
  name: ingressnodefirewallconfig
  namespace: openshift-ingress-node-firewall
spec:
  nodeSelector:
    node-role.kubernetes.io/control-plane: ""
---

williamcaban

• Installing the Redis Operator

# create namespace for operator
oc create ns redis-operator

# register Helm repo
helm repo add ot-helm https://ot-container-kit.github.io/helm-charts/

# install redis-operator using helm
helm upgrade redis-operator ot-helm/redis-operator \

williamcaban

Static routes in MacOS

• Find the name of the network adapters

# List network interface name
networksetup -listallnetworkservices

An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN

williamcaban

---
# Using unsupported SR-IOV NICs w/OpenShift
apiVersion: v1
kind: ConfigMap
metadata:
  name: unsupported-nic-ids
  namespace: openshift-sriov-network-operator
data:
  X520: 8086 154d 10ed
  X540: 8086 154d 10ee

williamcaban

# If $USERNAME and $PASSWORD are not defined
# in the environment prompt for them
if [ -z "${USERNAME+x}" ]; then
    read -p 'Username: ' USERNAME
fi
if [ -z "${PASSWORD+x}" ]; then
    read -sp 'Password: ' PASSWORD
fi

echo -e "\nAttempting to find the K8s API Server and token"

williamcaban

Stand-alone Container Registry

• Complete 01-prerequisites.md
• Copy pod-registry.service to /etc/systemd/system/poc-registry.service
• chmod 664 to /etc/systemd/system/poc-registry.service
• systemctl daemon-reload
• podman pull docker.io/library/registry:2
• systemctl enable --now poc-registry
• systemctl status poc-registry
• Update pull-secret to have access to local registry 02-create-pull-secret.md

williamcaban

---
# Example of Pod using downwards API
apiVersion: v1
kind: Pod
metadata:
  name: dapi-envars-fieldref
spec:
  containers:
    - name: test-container
      image: registry.access.redhat.com/ubi8/ubi:latest

williamcaban

# /etc/dnsmasq.d/lab.conf
###############################################################################
# DNS Server (simple)
###############################################################################
#log-facility=-
log-facility=/opt/dnsmasq/dnsmasq.log
log-async=25

# default to 150
dns-forward-max=500

williamcaban

Example (Privileged deployment with privileges to modify network)

1. Create namespace & ServiceAccount (see 01-create-ns.yaml)

2. Assign privileges to ServiceAccount

# Move to the project
oc project net-pod-sa
# assign privileged SCC to SA

williamcaban

OVN IPSec for east-west traffic

With OCP 4.7 IPSec for east-west traffic is a day-1 configuraiton. With OCP 4.8 this can also be applied as a day-2 configuration.

• Setup install-config.yaml to use IPSec

networking:
  networkType: OVNKubernetes