20230320 Azure Red Hat OpenShift Network Concepts

Transcript

1. Azure Red Hat OpenShift
   Network Concepts
   Phil Huang
   Sr. Cloud Solution Architect
   2023/3/20
   Ingress and Egress Network Traffic
   

   View Slide

2. Ingress Traffic
   ARO Network Concepts
   

   View Slide

3. • Ingress Traffic 需要討論 2 個部分
   1. API Server visibility
   2. Ingress visibility
   • Public 和 Private 的差異?
   • Public: 服務有對 Internet
   • Private: 服務沒有對 Internet
   • 設定後，不能事後修改
   設計初始就需決定 Ingress 的方向
   了解 Ingress Traffic (Inbound Data Flow) 流
   Ref:
   API Server Visibility Ingress Visibility
   Scenario
   https://api. https://*.apps.
   Case 1 Public Public 全部對外服務，包含 API Server
   Case 2 Private Private 常見，全部都不能出外網
   Case 3 Private Public 常見，API 在內網，但服務對外
   Case 4 Public Private N/A
   

   View Slide

4. API Server
   Visibility
   Ingress Visibility
   Public Public
   

   View Slide

5. API Server
   Visibility
   Ingress Visibility
   Private Private
   

   View Slide

6. API Server
   Visibility
   Ingress Visibility
   Private Public
   

   View Slide

7. Egress
   ARO Network Concepts
   

   View Slide

8. • Egress 需要分 2 個層次討論
   • Pod Level
   • Node Level
   • 有否需要管控 Egress Traffic 的方向，如 Azure Firewall 或 NAT Gateway 搭 UDR
   Egress 網路連線探討
   ARO Network Settings
   Ref:
   

   View Slide

9. 連線到外網
   了解 Egress Traffic (Outbound Data Flow) 流
   From Pod to Internet
   The IP is from Pod CIDR of ARO
   From Node to Internet
   The IP is from VNet Subnet
   

   View Slide

10. API Server
    Visibility
    Ingress Visibility
    Public Public
    Node: night9aro-vpvq9-worker-eastus1-vgkzx
    Pod: ocp-debug-container
    

    View Slide

11. API Server
    Visibility
    Ingress Visibility
    Private Private
    Node: night9aro-vpvq9-worker-eastus1-vgkzx
    Pod: ocp-debug-container
    

    View Slide

12. Restrict Egress Traffic
    

    View Slide

13. Demo
    ARO Network Concepts
    

    View Slide

14. pichuang/debug-container
    該 Container 包含常見的除錯工具
    Ref: https://github.com/pichuang/debug-container
    

    View Slide

15. Invent with purpose.
    

    View Slide