Red Hat build of MicroShift

Add a pod to an additional network

You can add a pod to an additional network. At the time a pod is created, additional networks are attached to it. The pod continues to send normal node-related network traffic over the default network.

If you want to attach additional networks to a pod that is already running, you must restart the pod.

Prerequisites

The OpenShift CLI (oc) is installed.
The node is running.
A network defined by a NetworkAttachmentDefinition object that you want to attach the pod to exists.

Procedure

Add an annotation to a Pod YAML file. Only one of the following annotation formats can be used:
1. To attach an additional network without any customization, add an annotation with the following format. Replace <network> with the name of the additional network to associate with the pod:
  apiVersion: v1 kind: Pod metadata: annotations: k8s.v1.cni.cncf.io/networks: <network>[,<network>,...] # ...
  Replace <network> with the name of each additional network to associate with the pod. To specify more than one additional network, separate each network with a comma. Do not include whitespaces between the commas. If you specify the same additional network multiple times, that pod has multiple network interfaces attached to that network.
  
  The following example annotation specifies a bridge-type additional network:
  apiVersion: v1 kind: Pod metadata: annotations: k8s.v1.cni.cncf.io/networks: bridge-conf # ...
2. To attach an additional network with customizations, add an annotation with the following format:
  apiVersion: v1 kind: Pod metadata: annotations: k8s.v1.cni.cncf.io/networks: |- [ { "name": "<network>", "namespace": "<namespace>", "default-route": ["<default-route>"] } ] # ...
  where:
  
  name
  
  Specifies the name of the additional network defined by a NetworkAttachmentDefinition object.
  
  namespace
  
  Specifies the namespace where the NetworkAttachmentDefinition object is defined.
  
  default-route
  
  Specifies an optional field to provide an override for the default route, such as 192.168.17.1.

To create a Pod YAML file and add the NetworkAttachmentDefinition annotation for an additional network, run the following command and use the example YAML:

$ oc apply -f ./<test_bridge>.yaml

Replace <test_bridge> with the pod name that you want to use.

The following example output shows that the test_bridge pod has been created:

pod/test_bridge created

Example test_bridge pod YAML

apiVersion: v1
kind: Pod
metadata:
  name: test_bridge
  annotations:
    k8s.v1.cni.cncf.io/networks: bridge-conf
  labels:
    app: test_bridge
spec:
  terminationGracePeriodSeconds: 0
  containers:
  - name: hello-microshift
    image: quay.io/microshift/busybox:1.36
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo -ne \"HTTP/1.0 200 OK\r\nContent-Length: 16\r\n\r\nHello MicroShift\" | nc -l -p 8080 ; done"]
    ports:
    - containerPort: 8080
      protocol: TCP
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1001
      runAsGroup: 1001
      seccompProfile:
        type: RuntimeDefault

Make sure that the NetworkAttachmentDefinition annotation is correct:

The following example NetworkAttachmentDefinition annotation specifies a bridge-type additional network:
```
apiVersion: v1
kind: Pod
metadata:
  annotations:
    k8s.v1.cni.cncf.io/networks: bridge-conf
# ...
```
Optional: To confirm that the NetworkAttachmentDefinition annotation exists in a Pod YAML, run the following command, replacing <name> with the name of the pod.
```
$ oc get pod <name> -o yaml
```
Replace <name> with the pod name you want to use. In the following example, <test_bridge> is used.

In the following example, the test_bridge is attached to the net1 additional network:
```
$ oc get pod <test_bridge> -o yaml
```
Replace <test_bridge> with the name of the bridge you want to use.

The following example output shows that the test_bridge pod is attached to the net1 additional network:
```
apiVersion: v1
kind: Pod
metadata:
  annotations:
    k8s.v1.cni.cncf.io/networks: bridge-conf
    k8s.v1.cni.cncf.io/network-status: |-
      [{
          "name": "ovn-kubernetes",
          "interface": "eth0",
          "ips": [
              "10.42.0.18"
          ],
          "default": true,
          "dns": {}
      },{
          "name": "bridge-conf",
          "interface": "net1",
          "ips": [
              "20.2.2.100"
          ],
          "mac": "22:2f:60:a5:f8:00",
          "dns": {}
      }]
  name: pod
  namespace: default
spec:
# ...
status:
# ...
```
The k8s.v1.cni.cncf.io/network-status parameter is a JSON array of objects. Each object describes the status of an additional network attached to the pod. The annotation value is stored as a plain text value.

Verify that the pod is running by running the following command:

$ oc get pod

Example output

NAME          READY   STATUS    RESTARTS   AGE
test_bridge   1/1     Running   0          81s