Add user document for Antrea native secondary network support #6015

jianjuns · 2024-02-22T00:44:59Z

jianjuns · 2024-02-22T00:46:20Z

docs/antrea-ipam.md

antoninbas · 2024-02-23T22:56:10Z

docs/antrea-ipam.md

-other CNIs which are managed by Multus. The [Antrea + Multus guide](cookbooks/multus)
-talks about how to use Antrea with Multus, including the option of using Antrea
-IPAM for secondary networks.
+For other network types, the VLAN field will be ignored.


Suggested change

For other network types, the VLAN field will be ignored.

For other network types, the VLAN field in the `IPPool ` will be ignored.

antoninbas · 2024-02-23T23:01:15Z

docs/antrea-ipam.md

-other CNIs which are managed by Multus. The [Antrea + Multus guide](cookbooks/multus)
-talks about how to use Antrea with Multus, including the option of using Antrea
-IPAM for secondary networks.
+For other network types, the VLAN field will be ignored.


question: I am not sure what happens if the network type is vlan but there is no provided vlan (neither in the IPPool nor in the NetworkAttachmentDefinition), or if there are 2 subnets with different vlans in the IPPool?

We default to VLAN 0, I explained that when describing NetworkAttachmentDefinition.

Antrea IPAM code returns the first non-zero VLAN in the configured IPPool subnets.

Antrea IPAM code returns the first non-zero VLAN in the configured IPPool subnets.

But then shouldn't we have IPPool validation to prevent users from using different VLAN values in the same IPPool, or is there a use case for that?

I meant two IPPools with different VLAN IDs, as you can specify multiple IPPools per Network, e.g. one for IPv4 and one IPv6.

antoninbas · 2024-02-23T23:38:12Z

docs/secondary-network.md

+
+Starting with Antrea v1.15, Antrea can also provision secondary network
+interfaces and connect them to VLAN networks. This document describes Antrea's
+native support of VLAN secondary networks.


antoninbas · 2024-02-23T23:38:49Z

docs/secondary-network.md

+in the `antrea-agent` configuration. If you need IPAM for the secondary
+interfaces, you should also enable the `AntreaIPAM` feature gate in both
+`antrea-agent` and `antrea-controller` configuration. At the moment, Antrea IPAM
+is only available IPAM option for secondary networks managed by Antrea. The


is the only available option

Thanks! Fixed.

antoninbas · 2024-02-24T00:43:21Z

docs/secondary-network.md

+network's `config`, `antrea-agent` will configure the VLAN ID to the OVS port,
+so the interface's traffic will be isolated within the VLAN. And before the
+traffic is forwarded out the Node via the secondary bridge's physical interface,
+OVS will insert the VLAN tag to the packets.


s/to the packets/in the packets

antoninbas · 2024-02-24T00:43:46Z

docs/secondary-network.md

+A few extra notes about the NetworkAttachmentDefinition `config` fields:
+
+* `type` - must be set to `antrea`.
+* `networkType` - the only supported network type is `VLAN` as of now.


is it case sensitive? You use vlan in the examples

vlan makes sense. Changed.

antoninbas · 2024-02-24T00:43:55Z

docs/secondary-network.md

+
+* `type` - must be set to `antrea`.
+* `networkType` - the only supported network type is `VLAN` as of now.
+* `mtu` - defaults to 1500 is not set.


s/is not set/if not set

antoninbas · 2024-02-24T00:46:04Z

docs/secondary-network.md

+* `networkType` - the only supported network type is `VLAN` as of now.
+* `mtu` - defaults to 1500 is not set.
+* `vlan` - can be set to 0 or a valid VLAN ID (1 - 4094). Defaults to 0. Also
+note, VLAN can be speficied in the spec of an IPPool in the `ipam` section too;


s/speficied/specified

For this sentence, I would just use:

The VLAN ID can also be specified as part of the spec of an IPPool referenced in the ipam section

antoninbas · 2024-02-24T00:48:08Z

docs/secondary-network.md

+`k8s.v1.cni.cncf.io/networks` annotation to the Pod. The following example Pod
+includes two secondary interfaces, one in network `vlan100` which should be
+created in the same Namespace as the Pod, the other in network `vlan200` which
+is created in Namespace `default`.


nit: given that the Namespace of the Pod is actually default, I would recommend using a different Namespace (either for the Pod or for the network), to emphasize that cross-Namespace references are possible.

Changed to networks. Let me know if you have a better Namespace name.

antoninbas · 2024-02-26T19:24:13Z

docs/secondary-network.md

+ labels:
+   app: antrea-secondary-network-demo
+ annotations:
+   k8s.v1.cni.cncf.io/networks: [vlan100, {name: vlan200, namespace: networks, interface: eth200"]


the annotation value doesn't look right to me. There is an orphan " at the end, and if the annotation is JSON, then all the strings should be quoted

You are right. Fixed it and added an example of a Pod with a single secondary interface.

antoninbas · 2024-02-26T19:24:31Z

docs/secondary-network.md

+
+At the moment, Antrea supports only a single OVS bridge for secondary networks,
+and supports only a single physical interface on the bridge. The physical
+interface cannot be the Node's management interface, otherwise a Node's


you may have missed that

antoninbas · 2024-02-26T19:24:35Z

docs/secondary-network.md

+secondary OVS bridge on the Node. If a non-zero VLAN is speficied in the
+network's `config`, `antrea-agent` will configure the VLAN ID to the OVS port,
+so the interface's traffic will be isolated within the VLAN. And before the
+traffic is forwarded out the Node via the secondary bridge's physical interface,


antoninbas · 2024-02-26T19:26:36Z

docs/antrea-ipam.md

-other CNIs which are managed by Multus. The [Antrea + Multus guide](cookbooks/multus)
-talks about how to use Antrea with Multus, including the option of using Antrea
-IPAM for secondary networks.
+For other network types, the VLAN field will be ignored.


Antrea IPAM code returns the first non-zero VLAN in the configured IPPool subnets.

But then shouldn't we have IPPool validation to prevent users from using different VLAN values in the same IPPool, or is there a use case for that?

antoninbas · 2024-02-27T01:58:14Z

docs/secondary-network.md

+```
+
+If the Pod has only a single secondary network interface, you can also set
+the `k8s.v1.cni.cncf.io/networks` annotatin to `<network-name>`,


s/annotatin/annotation

Signed-off-by: Jianjun Shen <[email protected]>

antoninbas

Still unsure about having 2 subnets in the IPPool with 2 different VLANs for the same IP family (is it allowed for secondary networks?), but it's orthogonal to this documentation change.

jianjuns · 2024-02-27T04:48:02Z

Still unsure about having 2 subnets in the IPPool with 2 different VLANs for the same IP family (is it allowed for secondary networks?), but it's orthogonal to this documentation change.

I checked the IPPool validation code. Seems we do not validate VLANs of all IP ranges should be same. In this case, the resulted VLAN will come from the IP range used to allocate the interface IP. In 2.0, with the planned IPPool spec changes, an IPPool will have a single shared VLAN (and subnet and gateway), and this will not be problem any more.

jianjuns · 2024-02-27T04:48:30Z

/skip-all

jianjuns added kind/documentation Categorizes issue or PR as related to a documentation. area/secondary-network Issues or PRs related to support for secondary networks in Antrea labels Feb 22, 2024

jianjuns requested a review from antoninbas February 22, 2024 00:44

jianjuns force-pushed the secnet-doc branch 4 times, most recently from 9b4a0e4 to 39cc2ca Compare February 22, 2024 01:02

antoninbas reviewed Feb 24, 2024

View reviewed changes

jianjuns force-pushed the secnet-doc branch from 39cc2ca to 30c4a6c Compare February 24, 2024 18:58

antoninbas reviewed Feb 26, 2024

View reviewed changes

jianjuns force-pushed the secnet-doc branch from 30c4a6c to b9c26c3 Compare February 26, 2024 20:18

antoninbas reviewed Feb 27, 2024

View reviewed changes

Add user document for Antrea native secondary network support

9dab945

Signed-off-by: Jianjun Shen <[email protected]>

jianjuns force-pushed the secnet-doc branch from b9c26c3 to 9dab945 Compare February 27, 2024 02:01

antoninbas approved these changes Feb 27, 2024

View reviewed changes

jianjuns merged commit 8c9aa23 into antrea-io:main Feb 27, 2024
50 of 53 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add user document for Antrea native secondary network support #6015

Add user document for Antrea native secondary network support #6015

jianjuns commented Feb 22, 2024 •

edited

Loading

jianjuns commented Feb 22, 2024

antoninbas Feb 23, 2024

jianjuns Feb 24, 2024

antoninbas Feb 23, 2024

jianjuns Feb 24, 2024

antoninbas Feb 26, 2024

jianjuns Feb 27, 2024

antoninbas Feb 23, 2024

jianjuns Feb 24, 2024

antoninbas Feb 23, 2024

jianjuns Feb 24, 2024

antoninbas Feb 24, 2024

antoninbas Feb 24, 2024

jianjuns Feb 24, 2024

antoninbas Feb 24, 2024

jianjuns Feb 24, 2024

antoninbas Feb 24, 2024

jianjuns Feb 24, 2024

antoninbas Feb 24, 2024

jianjuns Feb 24, 2024

antoninbas Feb 26, 2024

jianjuns Feb 26, 2024

antoninbas Feb 26, 2024

antoninbas Feb 26, 2024

antoninbas Feb 26, 2024

antoninbas Feb 27, 2024

jianjuns Feb 27, 2024

antoninbas left a comment

jianjuns commented Feb 27, 2024 •

edited

Loading

jianjuns commented Feb 27, 2024

	For other network types, the VLAN field will be ignored.
	For other network types, the VLAN field in the `IPPool ` will be ignored.

Add user document for Antrea native secondary network support #6015

Add user document for Antrea native secondary network support #6015

Conversation

jianjuns commented Feb 22, 2024 • edited Loading

jianjuns commented Feb 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas left a comment

Choose a reason for hiding this comment

jianjuns commented Feb 27, 2024 • edited Loading

jianjuns commented Feb 27, 2024

jianjuns commented Feb 22, 2024 •

edited

Loading

jianjuns commented Feb 27, 2024 •

edited

Loading