William Caban Babilonia williamcaban

Example (Privileged deployment with privileges to modify network)

Create namespace & ServiceAccount (see 01-create-ns.yaml)
Assign privileges to ServiceAccount

# Move to the project
oc project net-pod-sa
# assign privileged SCC to SA

OVN IPSec for east-west traffic

With OCP 4.7 IPSec for east-west traffic is a day-1 configuraiton. With OCP 4.8 this can also be applied as a day-2 configuration.

Setup install-config.yaml to use IPSec

networking:
  networkType: OVNKubernetes

Using Sushy Tools with Libvirt

Add linux user to libvirt group

sudo usermod -a -G libvirt <your-user>
sudo -y install libvirt-devel gcc python3-devel

Login and validate user can execute virsh commands

Troubleshooting CPU isolation

Identifying cores assigned to a particular container

ID=$(crictl ps --label io.kubernetes.container.name=<name-of-container> -o json | jq -r '.containers[0].id')
PID=$(crictl inspect $ID | jq -r '.info.pid')
taskset -pc $PID

	---
	# Example of Pod using downwards API
	apiVersion: v1
	kind: Pod
	metadata:
	name: dapi-envars-fieldref
	spec:
	containers:
	- name: test-container
	image: registry.access.redhat.com/ubi8/ubi:latest

	# /etc/dnsmasq.d/lab.conf
	###############################################################################
	# DNS Server (simple)
	###############################################################################
	#log-facility=-
	log-facility=/opt/dnsmasq/dnsmasq.log
	log-async=25

	# default to 150
	dns-forward-max=500

	#!/bin/bash
	source ~/set-environment

	ADDING_NODES=${1:-"add-nodes"}
	USE_RENDERED=${2:-"true"}

	# path to rhcos-live iso
	export RHCOS_LIVE=~/images/rhcos-live.x86_64.iso

	if [ ! -f rhcos-live.x86_64.iso ]; then

	#!/bin/bash
	set -euoE pipefail

	# Redfish commands related to Virtual Media.
	# Redfish doc reference: https://www.supermicro.com/manuals/other/RedfishRefGuide.pdf

	export BMC_ADDRESS=''
	export ISO_IMAGE=http://192.168.117.9:8080/ocp4-rwn-1-small.iso
	export username_password='Administrator:superuser'

	---
	apiVersion: sriovnetwork.openshift.io/v1
	kind: SriovNetworkNodePolicy
	metadata:
	name: mh-vfio-ens2f0
	namespace: openshift-sriov-network-operator
	spec:
	# name of Midhaul it connects to
	resourceName: mh_vfio_ens2f0
	nodeSelector:

	apiVersion: machineconfiguration.openshift.io/v1
	kind: MachineConfig
	metadata:
	name: 50-worker-fix-keepalived
	labels:
	machineconfiguration.openshift.io/role: worker
	spec:
	config:
	ignition:
	version: 3.2.0