►
From YouTube: Ask an OpenShift Admin (Ep 60) | NMstate and MetalLB L3
Description
Do you need declarative node network configuration driven through Kubernetes API? No matter how you run your OpenShift environment, network management is one of those things that's hard to get right. In this episode, we look at the NMState and MetalLB operators which provide load-balancer implementation for bare metal Kubernetes clusters and a Kubernetes API for performing state-driven network configuration across the OpenShift Container Platform cluster's nodes. We'll cover using MetalLB L3/BGP mode and how the NMState Operator provides users with the functionality to configure various network interface types, DNS, and routing on cluster nodes and look at how the daemons on the cluster nodes periodically report on the state of each node's network interfaces to the API server. So join us to learn more about MetalLB L3/BGP and the NMState library.
Want to learn more?
https://nmstate.io/
https://docs.openshift.com/container-platform/4.9/networking/k8s_nmstate/k8s-nmstate-about-the-k8s-nmstate-operator.html?sc_cid=7013a000002qG1LAAU
Try Red Hat OpenShift: https://red.ht/3uVxkya
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Jonathan Rickard https://twitter.com/jrocktx1
OpenShift https://twitter.com/openshift
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Jonathan Rickard sit down to answer your questions about Red Hat OpenShift.
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
OpenShift on redhat.com https://red.ht/3rYz5ZS
OpenShift on GitHub https://github.com/openshift/
#RedHat #OpenShift #Kubernetes #ContainerPlatform
A
A
B
Hello
and
welcome
to
this
week's
ask
an
open
shift.
Administrator
live
stream,
and
I
hear
something
coming
from
my
computer,
so
I'm
gonna
have
to
mute
it
real
quick
here.
I
don't
know
where
that
came
from,
but
hopefully
nobody
else
heard
something
playing.
In
the
background
there
isn't
an
echo
of
us
here,
johnny.
B
Glad
glad
that
it
didn't
impact
us
at
all
so
well,
happy
wednesday,
it's
a
it's
another
great
red
hat
day
here.
So
unfortunately,
here
in
raleigh
it
is
gray
and
disgusting
and
like
if
I,
if
I
look
more
washed
out
than
normal,
it's
because
most
of
the
light
in
my
room
is
coming
from
the
monitor
in
front
of
me.
Instead
of
from
the
windows.
A
B
Well,
hello
to
everyone
who
is
joining
us,
hello,
khalid!
Thank
you
for
the
welcome
our
hope,
nine
as
well.
So
today
this
week
we're
going
to
be
talking
about
a
couple
of
openshift
4.10
topics,
so
these
are
things
we
briefly
mentioned
them
last
week
and
they
were
talked
about
during
the
what's
new
session
by
the
product
management
team.
But
we
wanted
to
do
a
little
bit
more
of
a
deep
dive
on
these
because
they
can
be
a
little
bit
more
complex.
B
So
I've
done
some
testing.
I've
done
some
things
inside
of
my
lab.
Hopefully
we
can
illustrate
some
of
these
points.
That
being
said,
I
will
in
full
disclosure
say
that
andrew
is
not
a
networking
expert.
I've
been
many
things
in
my
life.
A
network
administrator
is
not
one
of
them.
I
have
kind
of
an
architect's
level.
Understanding
of
you
know
like
deep
down
networking
concepts.
B
So
don't
let
that
stop
you
from
asking
any
hard
questions,
because
I
would
very
much
love
to
go
back
to
engineering
and
the
super
smart
folks
that
are
working
on
these
things
and
take
those
questions
and
maybe
even
bring
them
on
to
the
live
stream
in
the
future.
So
we
can
talk
about
all
that
stuff.
So
if
you,
if
you're
curious
about
if
you're
interested
in
you
know
today
we're
going
to
be
focusing
on
nm
state,
so
nmstate
is
a
desired
state
engine
configurator!
B
B
In
order
to
do
that,
load,
balancing
so
we're
it's
gonna
be
an
interesting
day
and
we've
got
a
number
of
other
topics
that
we
can
talk
about
during
the
the
top
of
mind
section
so
johnny,
and
I
were
chatting
about
that
beforehand
of
we're
gonna.
One
of
these
we're
gonna
need
to
be
careful
to
not
eat
up
like
an
entire
show
with
so
oh
man,
yeah
for
sure
all
right.
Well,
so
my
normal
introduction
here
right.
B
This
is
one
of
the
office
hours
live
streams
here
on
red
hat
live
streaming,
which
means
that
we
are
here
for
you
for
our
audience.
Anything
that
is
on
your
mind,
any
questions
that
you
have
about
anything
openshift
related.
We
will
do
our
best
to
answer
those
questions,
so
please
don't
hesitate
to
submit
those.
B
B
We
go
and
find
the
smes,
whether
it's
product
management,
whether
it's
engineering,
whether
it's
anybody
else
inside
of
red
hat
and
we'll
get
those
answers
and
publish
them,
either
through
the
blog
posts
or
here
on
the
live
stream
itself,
as
the
case
may
be
kumar
when
is
openshift4.10ga
soon
I
I
will.
I
will
say
that,
so
if
everything
goes
according
to
plan
very
soon,
I
always
tell
people
you
know
internally,
at
red
hat.
It's
folks
can
find
specific
dates
that
english
that
english,
that
engineering
publishes.
B
B
Assuming
no
major
issues
are
found,
we
should
see
4.10
drop
drop
soon,
so
yeah.
Thank
you
for
asking
that
and
karate
chop.
Thank
you
for
your
very
kind
words.
We
appreciate
it,
although
johnny
and
I
are
just
sort
of
the
we're
the
the
tip
of
the
proverbial
ice
iceberg.
If
you
will
right
we're,
we
we're
the
faces
that
you
see,
I'm
so
so
sorry
for
that,
but
really.
B
There's
an
organization
of
you
know
thousands
of
people
behind
us
that
help
with
all
of
this,
whether
it's
our
individual
teams,
you
know
which
my
team
or
extended
team
has
something
like
30
folks
on
it.
Now
all
the
way
back
through
product
management,
which
is
another
50
or
70
folks
and
engineering,
which
is
hundreds
and
hundreds
of
folks
right.
It's
it's
not
just
us
so
and
of
course,
stephanie's
here
to
help
us
as
well
with
all
the
things
all
the
amazing
things
that
she
does.
A
B
So
yeah
anytime,
you
see
on
whatever
platform
you're
on.
If
you
see
like
openshift
or
red
hat
openshift
responding.
That's
that's
stephanie
in
the
background,
she's
keeping
us
honest
and
posting
posting
links
and
all
that
other
stuff
keeping
us
keeping
us
focused.
If
you
will
that's
right,
what
is
it
adult
onset,
adhd,
yeah.
B
B
B
B
My
lab
is
pretty
small
and
pretty
humble
and
usually
a
jumbled
mess
of
things
so
as
it
should
be
yeah
as
any
lab
is
all
right.
So
just
yeah,
please
any
comments
you
have
drop
them
in
chat.
Restream
puts
them
all
across
everywhere,
so
wherever
it
is
that
you're
at
we
will
see
those,
we
will
do
our
best
to
respond
to
those
and
get
you
answers
to
that.
B
So,
let's
talk
about
our
top
of
mind
topics,
so
the
first
thing
that
I
want
to
talk
about
here
is
something
that
we've
talked
about
a
couple
of
times
with
the
deep
dive.
So
we've
done,
like
the
disconnected
deep
dive,
we've
done
a
couple
of
other
topics
around
like
creating
managing.
You
know
updating
disconnected
clusters
and
in
the
last
week
or
so,
I've
had
we're
seeing
a
number
of
folks,
probably
four
or
five
different
questions,
either
in
chat
or
email
and
various
other
places
asking
about.
B
How
do
I
convert
a
disconnected
cluster
back
to
connected
or
how
do
I
disconnect
a
connected
cluster?
So
if
we
look
in
the
documentation
here,
I'm
going
to
share
my
window
with
the
documentation
there
we
go.
So
if
we
look
in
the
docs
here
we
have
this
process
which
describes
exactly
what
you
need
to
do
in
order
to
do
that.
B
Actually,
this
one
is
conveying
connected
to
disconnected
so
the
short
version
is
this
mimics
exactly
the
disconnected
install
process
and
that
you
create
a
mirror
cluster,
a
mirror
registry,
with
all
of
the
images
that
you
need
and
all
that
other
stuff
and
then
effectively
you
go
through
and
so
mirroring
the
images
here.
I'm
scrolling
down
configuring
the
cluster
for
the
mirrored
edge.
B
Add
the
certificates
for
that
mirrored
registry
and
then
create
an
image
content
source
policy
that
redirects
everything
over
to
where
you
need
to
be
so,
if
you've
ever
done,
the
disconnected
or
mirrored
install
right.
This
image
content
source
policy
is
exactly
the
same
thing
and
in
fact
one
of
the
commands
that's
further
up
above
for
mirroring
the
images
it
spits
out,
the
icsp
that
you
need
to
do
that.
B
So
I
bring
this
up
because
in
particular-
and
I
scrolled
right
on
past
it
on
purpose,
you'll
notice
that
this
process
is
tech
preview.
So
the
process
of
converting
is
not
a
supported
process.
It's
technically
possible
and
I've
done
this
a
number
of
times,
but
it
is
not
one
that
the
support
team
is
able
to
help.
So,
if
you're,
trying
to
you,
know
disconnect
a
cluster
and
something's
not
working
effectively
the
support
team
doesn't
doesn't
you
know
they
can't
help
with
that.
B
So
if
we
take
this
process-
and
we
reverse
it-
that
is
how
we
connect
a
disconnected
cluster.
So
usually
the
biggest
thing
is
updating
your
pull
secret.
So
if
you
deployed
disconnected
and
used
just
a
private
pull
secret
without
your
you
know,
your
red
hat,
pull
secret,
so
update
the
pull
secret
and
then
remove
the
image,
content,
source
policy
and
then
that'll
point
everything
back
at
the
red
hats
registries,
and
it
should
behave
as
normal.
B
So
let
me
switch
over
to
this
tab
so
here
in
cluster
settings
when
it
when
it
looks
to
where
to
pull
these
updates
from,
you
can
actually
update
that.
So
you
can
change
it
to
be,
and
I've
had
several
folks
ask
you
know
even
for
connected
clusters.
Can
I
point
that
at
something
that's
not
valid,
so
that
I
can
prevent
some.
You
know
any
random
administrator
from
going
in
and
just
applying
updates.
I
I
can
control
when
it
sees
an
update,
available,
upgrade
path.
Yep.
Thank
you!
B
B
B
A
A
It
hasn't
been
completely
vetted
out
like
that
it
can
or
cannot
be
used,
and
so
that's
why
it's
still
an
an
issue.
So
right
now
it's
it's
it's
affecting
products,
but
it's
not
really
affecting
anything
that
you
might
have
in
in
your
system.
Anything
older
than
like
you
know,
like
roll
seven
roll
six.
You
know
something
with
like
an
older
four
dot
kernel
or
even
a
three
dot
kernel.
It's
unaffected.
B
A
Yep,
so
if
you
actually
look,
if
you
scroll
up
a
little
bit-
and
you
just
look
in
that
right
there,
so
you
can
see
that
that's
that's
the
flag
that
gets
sent.
So
what
essentially
happens
is
they're
they're,
overloading
a
pipe
this
flag
into
a
pipe
so
they're
just
putting
a
lot
of
data
in
it
and
then
that's
how
they're
able
to
take
over.
A
So
this
isn't
it's
part
of
our
kernel
base,
but
it
doesn't
actually
affect
anything
that
we
have
going
so
that
that
last
line
there
or
they're
talking
about
there's
another
flag
that
could
be
used.
That's
they're
still
investigating
whether
or
not
you
know
what
what
the
attack
vector
is
on
that.
If
there
is
one
got
it,
so
that's
that's
probably
why
it's
still
like
a
thing
for
us.
B
Okay,
so
short
term,
it
sounds
like
we
should
keep
an
eye
on
the
cve
page.
You
know
keep
an
eye
out
for
any
errata
for
the
fix,
but
it
shouldn't
be
cause
for
significant
alarm.
I
I
don't.
I
don't
want
to
undermine
or
or
understate
the
severity
of
the
issue,
but
just
that
rel,
eight,
with
the
known
vulnerability
or
known
yeah
known
vulnerability
is
affected,
but
not
vulnerable.
A
A
Yeah,
so
the
I
was
trying
to
remember
where,
like
so
the
dirty
pipe
name,
it
kind
of
stuck
out
to
me
right-
and
I
was
like
this-
is
so
weird
and
yeah.
So
I
I
think
it's
either
the
same.
The
same
person
or
the
same
group
of
researchers
found
it.
That's
it
that
found
dirty
cow.
So
that's
that's
where
the
names
kind
of
come
from.
So
that's
it's
actually
pretty
cool.
B
B
Slashdot
was
talking
about
how
it's
one
of
the
more
significant
linux
kernel
vulnerabilities
in
quite
some
time,
so,
okay,
so
as
always,
I
always
try
and
remind
folks
that
with
openshift
and
these
cves,
more
than
likely
will
only
see
rel
8
listed
here,
so
core
os
does
not
explicitly
get
called
out,
and
the
reason
for
that
is
because
red
hat
enterprise
linux
core
os,
is
not
a
distinct
product
or
offering
from
red
hat.
It
is
only
available
through
openshift,
so
we
may
see
openshift
4
get
added
to
this
list.
B
I
don't
know
how
they
do
all
of
that
in
behind
the
scenes.
I
know
after
the
last
one
of
these
I
had
pinged
the
security
team
and
there
is
a
bunch
of
stuff
in
the
backend
systems
that
needs
to
happen
so
that
they
can
track
core
os
errata
separately
from
rel
errata.
So
that's
blah
blah
blah
it's
beyond
my
understanding,
so
I
would
say
for
now.
B
If
you
have
questions
reach
out
to
your
account
team,
you
can
reach
out
to
me
and
johnny
we'll
do
our
best
to
connect
you
with
any
resources
that
we
have.
If
you
have
concerns,
but
yeah,
you
use
the
use
the
cve
here
as
sort
of
your
starting
point.
There
should
also
be
a
rel
security,
red
hat
security
bulletin
rhsb,
so
yns
never
understood
how
metal
will
be
layer,
two
works.
We
can
talk
about
that.
B
B
So
let
let's
talk
about
something
that
johnny
you
and
I
we
we
both
immediately
launched
into
this
one
when
we
were
chatting
about
it
earlier-
and
this
is
the
one
I
was
talking
about-
where
we
could
eat
up
a
whole,
show
oh
yeah
talking
about
cluster
architecture,
so
in
particular
I've
been
working
with
a
partner
and
we're
talking
about
what
happens
or
how
should
you
architect,
your
openshift
deployment?
If
you
have
a
small
hypervisor
cluster,
so
think,
I'm
deploying
to
you
know
maybe
three
hypervisor
nodes
or
four
hypervisor
nodes.
B
So
two
nodes
does
not
have
much
like
having
a
cluster
spread
across
two
sites
does
not
have
meaningful
high
availability
improvement
for
openshift.
The
reason
for
that
is
because
openshift
has
a
three-node
quorum
with
lcd,
so
you're
always
going
to
have
one
node.
That
has
an
imbalance
and
if
you
lose
that
one
node
right
that
one
node
is
a
single
point
of
failure,
so
I'm
going
to
kind
of
skip
over
two
nodes
and
assume
that
we
always
want
it
to
have
a
minimum
right,
the
hypervisor
cluster,
to
have
a
minimum
of
three
nodes.
B
So
that
way
we
can
have
anti-affinity
rules.
We
can
keep
our
control
plane
nodes
onto
separate
nodes
for
full
availability,
full
resiliency
in
the
event
of
a
a
single
node
failure.
So
what
are
some
of
the
impacts?
What
are
some
of
the
considerations?
What
are
some
of
the
thoughts
that
we
should
have
as
openshift
administrators
when
we're
knowingly
deploying
into
a
relatively
small
hypervisor
cluster?
B
So
in
general,
I've
always
suggested
to
folks
that
infra
nodes
are
a
good
idea,
because
you're
you're
taking
workload
off
of
your
compute
nodes
and
putting
them
onto
nodes
that
you
don't
have
to
entitle.
So
it's
more
cores
that
you're
paying
for
that
are
devoted
to
you
know
your
your
actual
workload,
but
we
want
to
have
kind
of
a
minimum
of
two
infranodes
and
the
reason
for
that
is
ingress
controller
availability
right,
so
the
ingress
controller
will
always
have
at
least
two
instances.
You
can
scale
it
down
to
one.
B
But
of
course
that
means
that
if
that
node
is
lost,
then
you
have
lost
access
to
all
of
your
applications.
So
I
would
say
a
minimum
of
two
infrastructure
nodes.
It
may
make
sense
again,
three
or
four
hypervisor
nodes
to
have
it
match
the
number
of
hypervisor
nodes
that
you
have.
It
gives
some
availability
some
some
rationale
to
being
able
to
move
those
pods
or
recover
those
pods
in
the
event
of
failure,
and
I
think
it
also
ties
into
the
next
section,
which
is
compute
notes,
so
johnny
I'll
pause
there.
Any
thoughts.
A
Yeah,
so
I
mean,
if
you
do
anything
like
cluster
logging,
like
you'll
you'll,
understand
right
away.
Why
you
want
to
use
infrastructure
nodes,
I
mean
cluster
logging
can
eat
up
a
considerable,
very
considerable
amount
of
resources
on
your
application
nodes,
and
so
you'll
want
to
use
that
for
nodes
and
then
the
other
thing
with
it
is
like
you
know.
A
I
think
you
made
a
good
point
about
it
not
being
entitled
and
instead
of
paying
for
like
a
subscription
and
cloud
cost
right
now,
that's
what
you're
really
only
playing
for
you're
paying
for
cloud
cost
and
yeah.
It's
just
it's
a
good
idea.
It's
easy
to
implement
and
it's
worth
the
trouble
yeah
yeah.
B
Yeah
and
logging
logging
has,
I
think,
three
elastic
search
instances.
So
it's
another
one
of
those
where
you'd
want
to
have
three
infranodes.
If
you
deploy
the
logging
operator
or
the
logging
service
yeah,
I
hope
none
exactly
you
and
I
I
think
I
started
saying
that
at
the
same
moment
you
sent
that
so
great
minds.
Think
alike
right.
B
So
my
initial
thought
around
this
was
you
know,
one
with
let's
say
three
or
four
nodes:
I'm
going
to
use
that
interchangeably.
I'm
just
going
to
say
you
know
a
small
number
of
hypervisors
you
know.
Should
we
have
one
compute
node
per
hypervisor
node,
so
I've
got
four
compute
nodes
and
you
know
maybe
they
start
off,
as
I
don't
know,
10
of
the
physical
resources.
B
So
this
kind
of
makes
sense
right
in
that
I
can
evenly
distribute
my
compute
nodes
across
the
physical
resources
that
are
available
christian.
It
is
not
out
yet
so
I
can
evenly
distribute
my
resources,
my
my
virtual
resources
across
my
physical
resources.
So
that
way,
I
know
when
kubernetes,
when
openshift
schedules
a
pod
to
a
node,
it's
not
contending
with
other
things
that
are
on
there
and
that
last
point
is
kind
of
leading
into
so
where
do
we
go
from
there?
So
what
happens
when
I
need
to
you
know
scale
up
my
cluster.
B
I
need
more
resources
in
openshift.
Do
I
deploy
you
know
more
compute
nodes,
so
maybe,
instead
of
you
know
four,
I
don't
know
eight
cpu
32
gigabyte
of
ram
or
64
gigawatt
of
ram.
You
know
virtual
machines
for
my
compute
nodes.
Maybe
I
now
have
eight
of
those
you
know
two
per
per
worker
node
or
per
hypervisor
node.
B
So
there
can
be
positives
and
negatives
to
that.
I
think
that
is
particularly
useful
if
you're
encountering
any
pod
count
limitations
on
your
worker
nodes,
but
the
issue
becomes
now
I
am
now
I'm
paying
for
I'm
I'm
using
those
kind
of
core
core
os
without
meaning
to
be
redundant
there.
I
I'm
using
those
things
twice
right.
If
I
have
the
logging
service
deployed
right,
I've
got
two
instances
of
flue
and
d
forwarding
logs
over
instead
of
one.
B
I've
got
two
instances
of
core
s
that
need
to
be
rebooted
and
all
that
other
stuff,
so
it
makes
it
so
that
it's
a
little
bit
less
efficient.
The
alternative
is
well.
I
vertically
scale
my
compute
nodes,
so
I've
got
four
hypervisor
nodes.
I've
got
four
compute
nodes,
those
compute
nodes
they
vertically
scale
until
I
basically
encounter
a
pod
count
limitation
right
and
then
I
can
do
things
like
add
additional
compute
nodes
to
scale
up
my
pod
count.
B
So,
okay,
what
happens
if
I
lose
a
node
at
that
point
and
in
particular
what
happens
if
that
those
compute
nodes,
those
openshift
compute
nodes,
are
a
substantial
amount
of
the
physical
resources
right.
I'm
doing
this
vertical
scaling
thing.
You
know
now,
each
one
of
my
openshift
compute
nodes
is,
you
know,
30
40
percent
of
the
physical
resources
and
one
of
those
hypervisor
nodes
fails.
Now
I'm
trying
to
fit
two
of
those
potentially
two
of
those
onto
a
single
node
right,
letting
the
hypervisor
recover
my
lost
compute
node.
B
Is
that
a
good
idea?
Maybe
maybe
not
you
know
now?
If
I
lose
an
another
node
I've
now,
you
know
openshift
would
technically
still
be
running
because,
theoretically,
in
a
four
node
cluster,
I've
only
lost
one
etcd
vm,
so
the
control
plane
would
still
be
running,
but
my
compute
capacity
physically
is
reduced
by
50
right.
Two
nodes
failed
in
a
three
in
a
four
node
cluster.
B
If
open
shift
or
if
the
hypervisor
then
restarts
all
of
openshift's
compute
nodes
onto
the
surviving
hypervisor
nodes,
it
doesn't
know
that
that
capacity
is
lost,
so
we
could
end
up
in
a
race
condition
where
openshift
is
trying
to
scale
up
a
bunch
of
pods
or
add
a
bunch
of
pods
into
those.
You
know
nodes
that
have
just
recovered,
which
is
then
leading
us
to
do.
B
B
Maybe
that
doesn't
make
sense
right,
because
there
is
enough
excess
capacity
in
that
hypervisor
cluster
as
a
whole
to
you
know:
recover
our
compute
nodes
or
openshift
compute
nodes
inside
of
there,
so
anyways
architecture,
thoughts
for
the
day
johnny.
I
know
you've
been
chatting
in
there.
So
I
don't
know
if
you
have
anything
to
add
to
that.
A
No,
I
I
think
you
make
a
bunch
of
good
points
and,
like
I
was
telling
you
in
the
pre-show
right,
like
I,
I've
never
even
considered
about
scaling
out
and
like
the
the
even
distribution
of
the
workload
right.
It's
always
just
been
scaled
up
to
meet
the
the
demand,
and
you
know
I
probably
I
probably
should
have
thought
about
like
that
distribution,
but
it
just
never
did
you
know
especially
like
when
you're
in
cloud
you're.
Just
like.
Oh
just
skill,
you
know,
keep
going
keep
going,
yeah.
B
But
on
prem,
and
especially
again
in
those
you
know,
small
hypervisor,
you
know
small
hypervisor
count
deployments.
It
takes
a
little
more
thought,
I
think,
and
identifying
which
scenarios
you
want
to
protect
yourself
from
you
know.
For
years
you
know,
you
know
johnny
you
and
I
were
both
vmware
administrators.
You
know
once
upon
a
time
you
know,
and
for
years
it
was
always
everything
gets
vmware
turned
on
all
of
the
time,
with
no
exceptions
you
know,
maybe
we'll
set
a
restart
priority
type
of
thing.
So
that
way
we
get.
B
You
know
the
critical
stuff
back
up
first,
but
when
there's
a
whole
secondary,
scheduler
kubernetes
openshift
involved
in
that
recovery,
you
know
it
can
it's
something
that
needs
to
be
accounted
for.
You
know
when
we
do
those
recovery
plans,
so
yeah
anybody.
If
you
have
any
thoughts,
comments
in
chat,
please
don't
be
afraid
to
to
post
those
in
there
we'll
we'll
certainly
continue
that
discussion
as
needed.
You're
also
welcome
to
reach
out
on
social
media.
B
I
see
johnny's
information
there
up
on
the
screen
now
jrocktx1
on
social
media
or
johnnydoh
redhead.com.
You
can
also
reach
out
to
me
andrew.sullivan,
redhat.com
or
andrew
on
twitter
and
we're
both
also
on
reddit
as
well.
So
if
you
look
for
any
of
the
reddits
johnny's
been
pretty
good
about
putting
reddit
posts
up
about
each
one
of
our
live
streams,
so
you
can
of
course
respond
in
the
in
the
comments
there
and
we're
happy
to
have
a
conversation
all
right
in
the
interest
of
time.
B
We've
got
one
more
very
quick
top
of
mind
topic,
and
that
is
topics
for
the
future.
So
just
a
quick
recap.
Last
week
I
worked
up
our
schedule.
We
were
supposed
to
have
the
microshift
guys
on.
They
were
very,
very
generous
in
allowing
us
to
reschedule
so
we
will
have
in
two
weeks
time
we
will
be
talking
about
microshift,
so
that
would
be
the
23rd
march
23rd.
B
Next
week
we
will
be
joined
by
ortwin
schneider
to
talk
about
the
service
mesh.
So
that's
that's
kind
of
the
next
two
weeks
coming
up.
I
think
the
what's
new
excuse
me,
the
what's
next
presentation,
so
the
roadmap
presentation
is
coming
up
in
early
april,
so
whatever
day
that
that
happens,
it
overlaps
with
our
show.
So
we
won't
be
on
the
this
stream
will
not
be
airing
but
johnny,
and
I
will
be
here
to
help
answer,
questions
and
help.
B
You
know
funnel
things
over
to
the
pm
team,
et
cetera,
so
keep
an
eye
out
for
that.
As
always,
if
you
are
interested
in
all
that,
please
don't
be
afraid
to
subscribe
on
whatever
platform
you
happen
to
be
on,
so
you
can
be
notified.
I
also
always
encourage
folks
to
go
check
out
red
red.ht
live
streaming.
B
That
takes
you
to
our
landing
page
and
it
has
the
embedded
google
calendar
that
has
all
of
the
streams,
including
we
update
those
when
we
do
things
like
if
we
have
to
cancel
or
anything
like
that,
so
it
can
be
useful.
I
usually
copy
the
ones
that
I
know
I
want
to
attend
onto
my
personal
calendar,
so
I
get
reminders
all
right.
So,
let's
talk
about
some
some
networking
when
you
set
up
an
aha
proxy
on
helper
node
for
openshift
installation.
Is
that
the
exact
one
that
is
in
later
steps
transferred
to
the
control
plane?
B
So
helper
node
and
the
aha
proxy
instance
that
it
deploys
there
no
no
need
to
apologize
there
or
orpid.
I
apologize
if
I
butcher
anybody's
name
and
hello
mike
nice
of
you
to
join
us.
So
the
aha
proxy
instance
that's
deployed
to
helper
node
is
an
external
load
balancer,
that's
used
for
the
api,
apa,
api-int
and
star.apps
ingress
endpoints.
B
So
in
a
upi
or
a
non-integrated
installation,
we
need
that
external
load
balancer
to
send
traffic
from
outside.
So
when
you
browse
to
the
console
or
when
you
access
the
api
from
your
your
terminal
to
send
that
over
to
the
right
host
inside
of
the
cluster,
so
the
aha
proxy
instance
that
is
deployed
as
a
part
of
the
ingress
controller
is
going
to
be
different.
So
the
ingress
controller
is
going
to
accept
that
traffic
coming
from
outside,
so
maybe
that
external
load
balancer
and
identify
which
pods
inside
the
cluster
need
to
receive
that.
B
B
So
when
I
create
the
ingress
vip
when
I
assign
it
that
ip
address
keep
a
live
d
on
the
worker
nodes
on
the
compute
nodes
will
manage
that
virtual
ip
address
and
ensure
that
it
is
always
on
a
compute
node
that
has
an
endgress
controller
so
that
way
that
traffic
coming
from
outside
lands
on
one
of
those
nodes
right.
It
is
directed
one
of
those
nodes
and
then
h,
a
proxy
for
the
ingress
controller
manages
that
directly.
B
A
Yeah
so
so
fahad
was
asking
like
I,
I
apologize
if
I
butchered
your
name
there,
he
was
asking
about
like
what
services
can
go
on
the
infrastructure
nodes
and
I'm
trying
there's
a
kcs
that
actually
list
them
out.
I
just
can't
find
it
right
now,
but
I'm
gonna
keep
digging.
Essentially
it's
quay
the
opening
directory.
A
What's
that
it's
in
the
subscription
guide,
oh
okay,
awesome
and
then
so
I'll
find
that
and
post
that,
but
yeah,
it's
quay,
acs,
acm
things
like
red
hat
service
mesh
are
gonna,
be
like
because
it's
an
application
workload
or
it's
at
the
application
workload
level.
That's
why
it
would
typically
not
go
on
an
infrared
and
it
should
go
in
your
your
app
nodes.
B
So
we
we
have
this
instructure
notes
section
down
here,
and
it
tells
you
about
all
the
stuff
that
can
be.
That
is
considered
infrastructure
workload,
including
down
here.
It's
not
just
you
know
see
everything
up
here
is
either
open
shift
or
red
hat.
It's
not
just
those
things.
So,
for
example,
if
you
are
using
gosh
turbonomic
or
something
like
that-
and
you
know
they
have
a
monitoring
agent-
that
gets
deployed
that
that
doesn't
invalidate
its
status
as
an
infra
node.
B
You
know
if
you're
deploying
you
know,
cni
csi
drivers
and
the
stuff
that
they
use
that
doesn't
invalidate
his
infrastructure
node.
It's
when
you
deploy
your
applications
right
stuff
like
that
to
it
that
it
invalidates
that
what
we
call
customer
workload
or
customer
application
workload
that
it
invalidates
the
infranode
status.
B
It
is
the
user-friendly
version
of
the
official
like
legalese
red
hat,
subscription
guide,
so
we
basically
regularly
go
through
and
try
and
update
this
as
as
the
the
red
hat
you
know,
legal
policy
around
openshift
subscriptions
and
all
that
evolves
to
help
folks
to
understand.
You
know
how
to
work
with
it.
So
it's
my
quarterly
cat
hurting
exercise,
as
christian
knows
so.
Well,
because
we
have
to
go
out,
we
have
to
reach
reach
into
all
of
those
places
inside
of
of
red
hat
and
basically
say:
hey
is
there
any
changes?
B
So
yeah
there's
there's
a
lot
of
stuff
in
here
and
again,
if
it's
confusing
at
all,
if
there's
anything
that
you
need
help
with,
don't
hesitate
to
reach
out
to
your
account
team.
You
can
reach
out
to
johnny
and
I
and
we'll
do
our
best
to
figure
all
that
stuff
out
and
yes,
our
hope,
nine
trident
is,
is
okay
to
run
on
the
infra
notes.
A
Yeah
and
if
I
just
just
to
back
up
what
andrew's
saying
right
like
if
you're
asking
somebody
else
is
also
asking
right,
I
mean
like
so:
don't
don't
hesitate
to
reach
out
to
us
and
let
us
go
dig
in
on
it
for
you,
because
you
know
we
want
to
make
sure
that
everybody
has
all
the
information.
So
that
way
they
can.
You
know
they
could
be
successful.
B
B
One
of
them
is
the
old
one,
so
there
is
actually
two
of
them
that
are
floating
around
out
there.
So
the
difference
is
one
of
them.
This
one
has
the
table
of
contents
and
stuff
at
the
top,
and
you
notice
it
says
last
updated
february
8th
the
other
one
will
have
the
navigation
on
the
right
hand,
side
here
or
left
hand
side.
B
Rather
you
know
my
military
left
and
it
has
a
last
updated
date
of
like
last
july
or
something
like
that
that
one
is
not
valid,
so
it
has
been
superseded,
of
course,
by
this
one,
which
has
had
at
least
two,
if
not
three,
pretty
significant
updates
since
then,
so
just
keep
an
eye
on
that
last
updated
date.
The
current
release
is
february
8th,
so
we
are
trying
to
get
that
one
taken
down.
A
And
before
we
move
on,
there
was
another
question
from
g
kumar
about
it
really
says
it's
for
us
or
christian.
Is
there
a
preferred
way
of
managing
secrets?
Sealed
secret
is
a
community-based
operator.
Is
that
red
hat's
preferred
way
I
so
I
I
can
just
be
personally
for
marching
we're
using
hashtag
fault.
You
know
the
as
part
of
our
secrets.
Manager
still
secret
is
really
good.
There's
another
there's
another
group
within
red
hat
public
sector.
A
A
A
B
B
B
So
one
thing
to
notice
for
whoever
was
asking
about
when
4.10
will
be
released.
You
notice
that
we're
out
of
the
rc
stage,
however,
notice
that
we're
not
going
to
ga
with
4.10.0
more
than
likely
it
won't
be
4.10.2
either.
As
far
as
I
know,
that's
just
an
artifact
of
how
they
do
patching,
how
they
do
the
versions
and
all
that
other
stuff.
So
it
doesn't
mean
that
it
will
go
from
in
from
in
the
upgrade
branches
that
it
will
go
from
fast
to
stable,
any
faster
or
anything
like
that.
B
So
if
we
go
to
github.com
openshift
and
we
search
for
metal,
lb,
oops
metal
lb,
we
have
this
metal
lb
operator
here
effectively.
What
I
did
was
just
pull
this
in
right.
I
followed
the
documentation,
that's
in
here
for
how
to
go
through
and
deploy
it,
and
actually
I
think
I
actually
deployed
the
metal
lb
one,
not
the
openshift
one
yeah.
It
was
this
one.
B
B
B
B
B
So
I
did
a
created,
a
metal
lb
and
then
inside
of
there
and
it's
a
super
simple
like
there's
nothing
inside
of
here,
you
literally
give
it
a
name
and,
and
click
create
here,
metal,
obs,
we'll
do
a
create
one
see.
This
is
all
I
had
to
all.
I
had
to
provide
was
what
what
I
wanted
to
name
it
and
then,
once
the
operator
sees
that
hey,
you
do
want
to
deploy
a
metal
ob.
It
goes
through
and
deploys
everything
for
us
and
you'll
notice,
I'm
in
the
metal
lb
system
project
here.
B
B
So
let's
look
at
the
documentation
here
and
what
I
want
to
do
is
metal
lb
and
we'll
click
here.
So
this
is
the
4.9
documentation.
So
remember:
with
4.9
metal,
lb
layer,
2
mode
is
supported,
4.10
layer,
3
mode
is
added,
so
it'll
be
layer,
2
and
layer,
3
mode
with
4.10.,
so
with
layer.
Two
mode
where
am
I
at
here
when
I
create
an
address,
pool
you'll,
see
that
the
protocol
is
layer
two
and
then
I
can
specify
the
range
of
ip
addresses
that
I
wanted
to
create.
B
So
bgp,
if
you're
familiar
with
yeah,
thanks
christian
for
the
popcorn
emoji,
so
bgp
works
off
of
the
concept
of
autonomous
systems
or
a.s
right
and
we
define
between
different
entities
so
between
different
routing
groups,
effectively
as's
right,
separate
identifiers
for
each
one
of
those
and
what
they
do
is
they
publish
routes
they
publish
how
to
get
to
a
specific
network
based
off
of
the
networks.
That
are,
I
mean,
use
the
term
behind
but
but
are
accessible
from
inside
of
that
autonomous
system.
B
B
So
inside
of
my
house,
everything
routes,
fine
right,
my
routers
understand
how
to
connect
everything
together.
But
if
I
want
to
get
to
johnny's
house
it
needs
to
understand
how
like
how
do
I
route?
How
do
I
get
from
my
autonomous
system
to
his
autonomous
system
and
what
networks
are
behind
his
autonomous
system?
B
B
There's
a
lot
more
complexity
around
things
like
how
to
do
traversal.
So,
let's
say
that's
christian
who's
in
california.
Right.
Let's
say
that
christian
also
wants
to.
You
know
join
in
our
fun,
and
I
have
no
direct
connection
to
christian's
house
and
the
networks
at
christian's
house,
so
I
would
have
to
traverse
johnny's
autonomous
system
to
get
there,
there's
bgp
magic
that
happens
inside
of
there
and
how
all
of
that
is
set
up.
It's
way
beyond
one,
my
understanding
and
to
the
scope
of
what
I'm
trying
to
show
here.
B
So
the
core
of
all
of
this
is
essentially
bgp.
Much
like
rip
much
like
ospf
right,
all
the
others.
It
allows
us
to
create
networks
and
then
have
the
routing
protocol.
Basically
advertise
hey.
This
is
how
you
get
to
this
network.
This
is
how
you
get
here
without
each
host
having
to
understand
how
to
do
that
right,
a
specific
host.
You
know
my
desktop.
If
I
needed
to
get
to
johnny's
house,
I
just
say:
go
to
this
ip
address
and
we
rely
on
the
networking
devices
to
to
understand
how
to
get
there.
B
Excuse
me
so
that's
where
I'm
going
to
start
this
app
so
with
bgp.
What
I've
done
here
is
I'm
using
a
set
of
ip
addresses
that
do
not
exist
in
my
network
right
these.
These
are
that
my
network.
I
actually
have
a
bunch
of
different
networks
in
my
in
my
lab,
slash
house
here,
but
this
30.100
doesn't
exist
anywhere
except
right
here,
and
I
did
that
on
purpose
right.
So
I
do
have
some
172.30.
B
B
So
the
next
step
that
we
need
to
do,
let
me
go
back,
so
we
can
look
at
our
resources,
so
define
an
address,
pool
hey
when
you
create
a
service
of
type
load
balancer,
which
is
what
metal
lb
is
going
to
service.
No
pun
intended
it's
going
to
assign
it
one
of
those
ips
from
that
pool
when
you
create
that
ip
address
or
when
you
assign
that
ip
address
to
that
service,
you
need
to
advertise
it
to
the
bgp
peer.
B
So
in
this
instance
I
have
one
peer,
that's
been
created
and
if
we
look
at
that,
all
I'm
doing
is
saying
here
is
the
upstream
router.
So
this
happens
to
be
the
in
my
lab.
It's
the
gateway,
router
and
then
here
are
the
asn's
that
I
want
you
to
use
so
come
on.
Get
out
of
here
help
so
asn
is
autonomous
system
number
and
I'm
saying
that
the
pier
the
upstream
is
65512
and
this
instance
inside
of
my
cluster
is
65514.
B
B
And
I
think
I
can
bring
this
in
here
and
you
should
see
it
all
right.
So
here
is
my
router
right.
So
I've
got
this
bgp,
I'm
just
you
can
see
I'm
using
open
since
I
installed
the
fr
plugin
for
my
open
sense.
I
enabled
bgp
and
I
set
my
autonomous
system
number
inside
of
here.
So
that's
what
I
did
inside
of
my
lab
and
what
we
want
to
look
at
is
what
happens
to
our
routing
when
we
begin
to
deploy
services
inside
of
here.
B
B
B
And
what
we
should
see
here
in
just
a
moment
yep,
so
our
application
is
now
gone
right,
no
service.
I
come
up
here
to
pods.
I've
got
my
simple
deployments,
but
I
don't
have
my
hello
kubernetes
running
inside
of
here
anymore,
and
if
I
come
back
over
to
my
router
and
I
refresh
this,
you
notice
that
my
routes
have
gone
away.
It
no
longer
knows
how
to
get
to
my
particular
nodes
or
that
particular
service.
A
B
So
it's
a,
which
means
that
metal
lb
will
create,
will
be
the
one
to
service
that
service,
so
we'll
hit
create
here,
and
you
can
see
that
that
is
exactly
what
happened
right.
We
now
have
this
external
load
balancer,
it
reused
the
ip
address.
You
can
see
it's
the
100.10
ip
address
and
this
time,
if
I
browse
to
that
ip
address,
I
get
my
simple
service.
Simple
service
is
just
a
thing
that
I
created
to
get
a
json
response
for
who
is
requesting
this.
B
B
So
what
you
saw
me
do
there
is
destroy
one
service
that
was
using
a
metal,
lb
load
balancer
and
then
create
a
new
service
that
is
using
a
metal,
lb,
load
balancer
and
now,
if
I
come
back
over
here,
we'll
see
our
three
routes
get
created
again.
So
let's
talk
a
little
bit
about
what
we're
seeing
here.
So
first
you'll
notice
that
it
is
creating
a
slash
32
for
each
one
of
for
the
same
ip
to
each
one
of
my
nodes
in
the
cluster,
so
160,
161
and
162..
B
So
that
is
bgp
saying
I
know
how
to
get
here
is
going
to
be
one
of
these
particular
nodes.
Let
me
see
if
I
can
stretch
this
and
you'll
see
that
these
columns
right
so
valid.
All
three
of
them
are
valid,
but
it's
going
to
prefer
this
particular
link
here
or
this
particular
node
first,
so
that
can
be
changed.
B
B
B
So
that's
that's
how
it
works
in
a
nutshell,
right-
and
I
can't
see
chat
so
I'm
assuming
you're
going
to
interrupt
me
at
any
point
in
time
here.
Johnny
yep,
you're
doing
good
okay.
So
so
that's
how
it
works
in
a
nutshell.
So
there's
a
couple
of
other
things
that
we
may
or
may
not
want
to
know
about
what's
happening
inside
of
here.
B
So
let's
click
back
over
here
and
if
I
come
up
here
to
deployments,
we've
got
our
hello
kubernetes
back
and
if
I
click
over
here
to
services,
we've
got
our
hello
kubernetes
service
back.
You
can
see
this
time
it
was
assigned
the
ip
address
of
100.11
and
just
like
before
I
browse
to
that.
I
get
my
hello
world
application.
B
B
B
You
know
facebook
has
done
it
recently.
I
want
to
say:
cloudfair
has
done
it
recently.
There
was
a
very
public
one
back
when
some
country
black
holed,
all
of
youtube.
Do
you
remember
that
it
was
like
they
were?
They
wanted
to
block
youtube
in
the
country
and
they
updated
the
routing
table
and
propagated
it
outward
instead
of
inward,
and
they
ended
up
creating
a
black
hole
for
all
youtube
traffic.
B
B
B
B
So
what
that
means
is
that,
instead
of
creating
a
slash
32
where
in
my
window
go
here
instead
of
creating
a
slash
32
for
each
one
of
these?
So
if,
if
I
refresh
this
now,
there
should
be
six
right
one
for
eleven
one
for
ten,
it
will
create
a
slash
24
for
all
of
them,
so
there'll
be
one
one,
slash
24
entry
into
each
one
of
the
nodes
that
is
acting
as
a
speaker
for
metal
lb.
B
I've
been
realizing
now
that
I
may
have
skipped
what
a
speaker
is:
let's
go
back
to
our
pods
and
let's
look
at
the
metal
lb
system
namespace.
So
if
we
look
inside
of
here
so
this
is
the
metal
lb
deployment.
So
you
see
I've
got
my
operator
controller.
So
when
I
went
and
deployed
the
operator,
this
is
what
it
deploys.
B
B
So
you
can
see
here
it's
creating
arp,
responder
ndpr,
right
all
the
things
that
it
does.
Yes
resume
stream
service
announced
on
the
ips
for
our
100.10
and
100.11
load.
Balancers
right.
The
speakers
are
the
pods
deployed
to
each
node
that
are
actually
managing
that
traffic,
and
if
I
were
to
look
at
the
expanded
view,
there
would
be
one
of
these
on
each
each
node.
It's
a
demon
set
speaker.
B
Just
be
aware
that
that
is
right,
those
are
effectively
ingress
points
for
your
cluster
right,
so
you
would
treat
them
just
like
you
do
a
infranode
that
is
running
an
ingress
controller,
including
having
the
ability
right.
It
is
going
to
be
sharing
network
throughput
and
all
that
other
stuff
with
the
application.
That's
running
that
as
well
as
anything
else
that's
running
on
there,
so
you
may
not
want
to
have
it
on
the
same
node
as
an
ingress
controller.
B
B
B
So
that's
bgp,
metal,
lb,
bgp
mode
in
a
nutshell,
right
again
work
closely
with
your
networking
peers.
They
should
be
able
to
feed
us
all
of
this
information
right,
they're
going
to
tell
us
specifically
which
asn
we
need
to
use
and
unless
the
pure
asn
and
local
asn
are
inverted
and
match.
On
the
other
side,
it's
not
going
to
successfully
instantiate
the
bgp
session,
and
you
know
it's
not
going
to
work.
You
know.
If
they
want
to
do
aggregation,
then
we
would
want
to
you
know,
work
with
them
to
determine
what
is
the
appropriate.
B
You
know
subnetting
to
use
for
that
aggregation.
You
know
they
should
also
assign
us
the
ipool
that
is
coming
from
that.
So
the
communities
are
an
interesting
thing.
So
the
communities-
and
there
are
three
common
communities.
There's
no
advertise
no
gosh.
What
are
they
now
anyways?
They
they
control.
B
B
So
the
other
thing
that
I
wanted
to
talk
about
quickly
is
bfd
so
effectively
bfd,
as
it
says
here
quicker
path.
Failure
detection
than
bgp
alone
provides
so
again
work
with
your
network
peers
in
order
to
determine
what
the
correct
settings
for
the
bfd
profile
is
the
goal
being.
If
that
router
fails,
for
whatever
reason
the
up,
whatever
the
next
hop
the
upstream
router
is.
B
B
What
this
will
do
eventually,
because
the
upstream
external
dns
operator
has
alpha
level
support
for
updating
many
other
types
of
dns
servers,
eventually
we'll
be
able
to
create
annotations
on
our.
Let
me
see
if
I
can
find
an
example
here
we
able
to
create
annotations
on
our
server
services
and
blah
blah.
B
B
So
we'll
be
able
to
create
annotations,
and
it's
not
going
to
show
me
in
here
that
say
I
not
only
want
to
publish
using
metal
lb
or
you
know
whatever
my
external
load
balancer
is
this
service
so
that
it's
externally
accessible
directly.
I
also
want
to
create
a
dns
entry
for
it
so
that
you
can
now.
You
know,
basically
publish
something
outside
of
the
openshift
ingress
controller
mechanism
inside
of
there,
but
again
with
4.10,
it's
only
tech
preview.
It
only
works
on
amazon,
azure
and
google.
B
B
So
if
we
look
at
this
guy,
you
see
there's
a
whole
bunch
of
different
dns
providers
supported
if
you're
using
bind
like
I
am
rfc
2136
would
be
yeah.
I
don't
want
to
look
at
the
actual
rfc.
Thank
you.
The
rfc
would
be
2136
would
be
how
we
want
to
update
that
and
then,
if
I
click
down
here
on
the
actual
documentation
link,
it
tells
us
precisely
how
to
how
to
configure
that
here's
an
example
right
so
annotations,
external
dns,
blah
blah
blah
blah
blah
service.example.org.
A
B
Yeah,
it's
I
can
see
it
either
way
right,
good
or
bad
ingress.
You
know
openshift
ingress
controller.
The
routes
mechanism
adds
a
lot
of
value,
in
my
opinion,
most
especially
like
certificates
and
all
of
that
other
stuff-
and
you
know
you
don't
have
to
manage
those
yourself
yeah
everything
old
is
new
again.
Yes,
my
my
children
wearing
you
know
1990s
clothing.
I
yeah,
I
distinctly
remember
the
90s
and
it's
funny
what
is
qwerty123
I
it's
a
very
terrible
password
is
what
that
is.
I
don't
know
where
that
came
from.
B
B
I
chose
to
use
regular
off-the-shelf
desktops
because
they
were
very,
very
one,
affordable
and
too
customizable,
which
is
what
I've
done
kind
of
to
an
extreme.
Almost
I
would
love
to
simplify.
I
just
haven't
found
a
way
that
I
can
still
do
all
the
things
that
I
want
to
do
and-
and
you
know
upgrade
to
something
like
I
think
christian
has
a
was
an
r720
or
something
or
an
r730
in
in
his
home
lab.
B
B
A
B
Over
here
I
have
like
an
iscsi
one.
That
comes
off
of
that.
I
have
an
nfs
expert
that
comes
off
of
that,
so
that
virtual
machine
is
the
only
one
that
uses
local
storage
on
this
host.
So
when
I
go
and
turn
on
my
lab,
I
I
turn
on
the
host
that
has
this
virtual
machine
attached
to
it,
and
then
it
has
pci
passthrough
for
all
of
those
storage
devices
and
then
creates
the
shared
storage
pool.
That
then,
has
everything
else
on
it
from
there.
I
have
a
helper.
B
B
B
When
I
need
that
vcenter,
interestingly,
I
don't
turn
on
vcenter
very
often,
unless
I'm
doing
something
like
a
vmware,
ipi
installation
or
something
like
that,
so
you'll
notice,
if
you
were
quick
guide,
I
have
a
three
node
compact
cluster,
but
I
actually
deployed
it
using
the
ipi
method.
So
that's
completely
unsupported
right.
You
can't
do
a
a
platform
integrated
compact
cluster,
but
it
works,
and
it
helps
to
illustrate
my
purpose
without
having
to
jump
through
a
bunch
of
hoops
so
yeah.
B
I
turn
on
vcenter
for
things
like
that,
but
most
of
the
time
I
just
connect
directly
to
my
esx
hosts
and
turn
things
on
so
this
this
vm,
I
was
using
the
other
day
for
what
was
I
using
it
for
oh,
that
was
my
the
one
that
we
used
for
the
oc
mirror
the
local
mirror
and
all
that
other
stuff-
and
this
is
my
my
usual
demo
cluster.
This
is
the
one
that
I
use
for
most
things.
B
So
this
is
a
non-integrated
cluster,
that's
deployed
onto
vsphere,
and
then
this
one
I
I
recreate
on
a
regular
basis.
It's
it's
non-integrated
specifically,
so
that
I
can
you
know
I
don't
have
to
worry
about
the
infrastructure
integrations
and
stuff
like
that,
but
I
also
do
things
like
nested
virtualization
in
here.
B
I
don't
know
what
the
difference
is,
but
it
fixed
my
problem
and
that's
what
I
use
when
I
want
to
do
things
like
create
vlans
that
get
passed
through.
You
know
into
the
bigger
network,
so
the
other
side
of
that
is,
if
you
were
quick
with
it
or
a
quick
guide
here,
you'll
see,
I've
got
a
couple
of
different
networks
that
I
use
for
all
of
my
lab
stuff.
So
one
is
the
work
stuff.
B
This
is
what,
like
my
work,
desktop
sit
on
it's
kind
of
the
management
interface
for
most
things,
the
other
one
is
the
lab.
This
one
is
isolated.
It's
what
I
consider
the
disconnected
network
so
when
I
want
to
deploy
things
and
test
it
that
way
so
yeah
my
lab
is
pretty
simple.
All
in
all,
I'm
happy
to
answer
any
questions
about
it.
Folks
can
send
me
somebody
messages
on
social
media
or
send
me
an
email.
If
you
have
any
questions
about
how
I
set
it
up,
there
are
some
limitations
right.
B
B
B
So
if
I
do
a
search
for
that,
you
can
see
that
it
comes
up
and
talks
about
the
the
upstream
project
for
nmstate,
and
this
is
something
that
red
hat
has
been
using
for
a
while.
So
if
you're
familiar
with
red
hat
virtualization,
so
red
hat,
virtualization
manager,
4.4
uses
nmstate
to
apply
network
configuration
to
the
hosts
right,
so
it
uses
it
for
all
hosts
and
it's
also
the
the
thing
that
works.
When
you
do
in
4.4,
you
can
like
copy
a
host
network
configuration
and
apply
it
to
other
hosts.
B
So
I
want
to
create
a
bond
that
is
in
a
state
of
up.
I
want
to
assign
it
to
this
ipv4
address
for
the
bond.
I
want
it
to
use
a
balance
rr
mode,
and
I
want
these
two
interfaces
to
be
members
of
that
bond.
It's
it's
literally.
All.
It
is
right
if
I
want
to
create
a
bridge
interface
right,
so
I
want
to
create
an
ovs
bridge.
B
I
want
it
to
be
on
top
of
this
particular
you
know
network
adapter
and
you
can
define
you
know
a
bond
to
be
a
part
of
that
as
well,
and
you
can
combine
these
right,
so
I
don't
have
to
have
these
as
separate.
You
know
files
or
separate
implementations.
I
can
combine
all
these
into
one
and
effectively
because
it's
a
state
engine
it
will
ensure
that
it
matches
that
particular
configuration.
B
So
how
does
all
of
this
fit
in
with
openshift?
So
let
me
find
a
documentation.
I
thought
I
had
a
documentation
page
up,
so
nmstate
has
been
a
part
of
openshift
since
4.6,
which
is
when
openshift
virtualization
was
released
and
since
4.6
nm
state
has
been
fully
supported
when
used
with
openshift
virtualization.
B
B
We
are
now
expanding
that
to
be
generally
available
and
fully
supported
with
all
bare
metal
deployments
right.
So
that
means
that
I
can
go
in
and
I
can
apply
day
two
that
networking
configuration.
So
let's
come
down
here
and
find
an
example.
I
apply
that
networking
configuration
to
my
cluster
as
I
see
fit.
B
So
if
I
search
my
crds
here
for
nm
state
you'll
see
that
I
get
these
nm
state
set
of
crds,
so
the
node
network
state
represents
the
current
status
of
the
network.
Configuration
of
our
node,
a
node
network
configuration
policy
in
ncp
represents
how
we
want
to
configure
the
network
for
a
particular
node.
So
if
we
jump
back
over
to
our
documentation
example
here,
this
is
a
node
network
configuration
policy
and
then
our
node
network
configuration
enactment
is
on
a
per
node
basis.
The
status
of
the
node
network
configuration
policy
being
applied.
B
B
So
let's
look
at
our
node
network
state
and
you'll
notice
that
I
have
an
instance
of
this
for
each
one
of
the
nodes
inside
of
my
cluster.
So
I'm
going
to
select
one
of
these
guys
and
look
at
the
yaml
and
down
here
in
the
status.
We
have
our
current
state
and
it
walks
through
and
shows
us
everything
that
we
know
about
the
network
right
so
effectively.
If
you
were
to
use
nmcli
and
kind
of
show
the
tree
of
configuration
for
our
network.
This
is
all
the
information
that
we
would
find
out
right.
B
So
we
have
this.
Where
is
it
so
here
is
br0
right,
which
is
an
ovs
interface.
It's
currently
down.
I
have
two
ip
addresses:
I'm
not
sure
why
that
one
has
a
32
again.
I
just
tested
this.
So
who
knows
what
we're
going
to
find
out
and
then
so?
Here's
our
mtu,
here's
the
network,
adapter
that
it's
using
right.
It
is
vmware,
so
ens
192..
B
B
Right
so
on
and
so
forth,
I
can
keep
scrolling
down
through
here.
You
know
here
is
the
ovs,
so
this
is
going
to
be
the
sdn
right
down
here.
I've
got
route
config,
so
it's
it's
a
breakdown
of
what
is
the
current
configuration
of
my
of
my
nodes
of
my
host,
so
you'll
notice
here
that
I
have
two
network
adapters
on
my
hosts.
So
let's
come
over
here,
so
I've
got
two
network
adapters,
one
connected
each
one
of
these,
so
you'll
notice
that
that
second
adapter
also
pulled
an
ip
address.
B
B
B
So
let's
say
that
I
wanted
to
keep
the
ip
address.
That's
assigned
there.
I
can
leave
this
ipv4.
I
can
basically
omit
it
and
actually
because
we're
creating
a
new
interface,
I
think
it
would
inherit
the
default
which
is
going
to
be
dhcp
or
I
can
expressly
configure
dhcp
or
a
static
ip
address
on
it,
and
it
will
apply
that,
but
because
it's
set
to
enabled
false
it
will
remove
that
ip
address
and
it
won't
reconfigure
it.
A
B
If
I
go
back
to
my
custom
resource
definitions
and
find
my
nncp,
what
we
should
see
is
that
this
one
is
also
set
to
successfully
configured
with
three
out
of
three
nodes.
So
how
do
we
verify
that?
How
do
we
check
that?
So
one
thing
that
we
can
do
here
is
look
at
our
node
network
state.
Again,
I'm
going
to
go
back
to
the
same
node
and
now,
if
we
scroll
down,
we
should
see
a
new
bridge.
B
Let's
see
where's
that
here,
so
here's
our
the
the
start
of
a
new
entry.
So
we
see
it's
a
bridge
and
we
have
ports
224
assigned
to
it
in
trunk
mode,
but
no
ip
address
assigned
to
it.
There
pr1
all
right,
no
ip
address
assigned
to
it
so
that
ip
is
removed
from
from
the
host,
but
we
still
have
our
other
ip
address
the
162
that's
down
here.
B
B
B
A
Yeah
so
there's
one
question
yeah,
so
I
was
answering
some
questions
from
not
I've
lost
it,
but
anyways.
It
was
about
sr
iov
and
like
a
linux
bridge
or
ovs
bridge,
so
ovs
bridge
is
software
defined.
You
know
bridging
in
the
linux
network
world
so
or
in
a
linux
bridge.
It's
essentially
just
like.
If
you
look
at
it's
like
a
switch
port
right,
I
mean
it's.
Just
it
just
says:
hey
I
need
to
get
from
here
to
here.
A
So
it's
a
layer,
two
interaction
where
sriov
is
like
a
pass
through
networking.
So
if
I
understand
that
correctly,
it's
like
a
full
line,
it's
like
a
legit,
you
know
pci
to
vm
or
to
to
machine
and
it
bypasses
any
sdn
type
stuff.
So
that
was
that
was
one
of
the
conversations
going
on
and
then
kaiser
asked.
If
you
could
expand
more
on
fully
supported
when
used
with
openshift
virtualization.
B
Yes,
as
far
as
I
know
yes,
so
I
don't
know
that
anybody-
you
know,
whoever
on
the
support
side
goes
through
and
like
double
checks
like
have
you
deployed
any
vms,
to
make
sure
that
that
it's
there
before
they
do
that.
So
I
would
say
yes,
if
you
deploy
openshift
virtualization,
it
will
automatically
deploy
the
nm
state
operator
as
a
part
of
that
and
then
you'll
be
able
to
do
that
configuration
stuff.
B
B
B
A
B
B
A
B
B
A
B
It's
funny
I
was
telling
johnny
before
we
started
here
that
I
normally
I
spend
the
morning
before
the
stream
kind
of
prepping
and
make
sure
that
making
sure
that
everything
is
staged
and
I
have
the
flow
in
my
head
and
I
lost
like
an
hour
and
a
half
this
morning
to
a
phone
call
with
that.
That
was
unexpected.
So
I
I
didn't
have
as
much
time
to
prep
kind
of
funny.
B
B
B
B
So
here
is
our
ovs
for
the
sdn,
both
of
them
but
you'll
notice
that
my
bridge
is
no
longer
there
and
now
I
can
simply
go
back
and
now
that
it
has
been
unconfigured.
If
I
want
to,
I
can,
you
know,
delete
this
nncp
so
that
way
it
doesn't
have
to
right.
It's
not
constantly
trying
to
apply
that
so
yeah,
that's
how
to
configure
and
then
unconfigure
networking
using
enum
state.
A
B
Yeah
it
we
get
a
lot
of
questions
right.
I
know
you
see
them
as
well
of
you
know,
hey,
I
want
to
add
in
a
second
adapter
for
a
storage
network
or
for
something
like
that.
You
know
how
do
I
configure
that,
and
you
know
a
lot
of
folks
assume
that
the
answer
is
use.
Machine
config
and
machine
config
works
in
some
scenarios,
mostly
where
dhcp
is
available.
B
A
B
Yeah,
I'm
I'm
looking
forward
to
getting
more
familiar
with
it
as
well.
Like
I
said,
I
I
scratched
the
surface
of
bgp
as
I
was
you
know
going
through
and
implementing
this
inside
of
my
lab
and
just
all
the
stuff
that
is
possible
with
it
there's
a
whole
unexplored
avenue
of
things
of
like
how
it
makes
a
determination
of
which
interface
to
send
it
to
I.
I
will
note
that
you
know
a
I
I
don't
understand.
I
don't
know
what
algorithm
it
uses
to
determine.
You
know.
Last
time
I
sent
the
traffic
out
this.
B
You
know
to
this
ip
address
next
time,
I'm
going
to
send
it
to
this
one
next
time,
I'm
going
to
send
it
to
this
one.
You
know,
whereas
with
a
quote,
unquote
real
load,
balancer,
there's
a
lot
of
policies
you
can
put
in
place
around
that
right
least
number
of
sessions
least
amount
of
traffic.
You
know
least
recently
used
straight
vanilla
round.
Robin
gosh.
Excuse
me
so
yeah
it's
one
of
those
there's
more
to
learn.
I
am
curious
about
and
I
would
love
if
anybody
is
a
networking.
B
A
bgp
expert
like
what's
the
impact
to
the
router
on
that
you
know
if
I'm
using
a
metal,
lb,
bgp,
load,
balancer
and
it's
pushing
you
know
tens
of
gigabits
of
traffic.
Is
there
an
impact
to
the
router
as
it's
having
to
make
those
decisions
with
you
know,
potentially
thousands
of
sessions?
I
I
don't
know.
B
So,
okay,
well,
I'm
I'll
quit
rambling!
You
know
we're
we're
37
minutes
past
our
normal
stopping
point.
So
thank
you.
Everybody
who
has
joined
us
today
we'll
definitely
follow
up
on
a
blog
post
with
this
one,
we'll
link
to
all
of
the
relevant
places
inside
of
the
stream
here.
So
that
way
you
can
find
the
information
that
you
need.
B
So,
as
is
on
the
screen
now
you
can
reach
me
on
social
media
at
practicalandrew,
on
twitter
or
on
reddit.
You
can
also
send
me
an
email
at
any
point
in
time.
Andrew.Sullivan,
redhat.com
so
and
johnny
is
jayrocktx1
on
twitter
johnny
with
no
h,
j-o-n-n-y
redhat.com.
I
don't
remember
what
your
reddit
username
is.
B
Look
for
this
look
for
the
live
stream.
Look
at
the
live
stream
posts
on
the
openshift
subreddit
right
yeah!
We
are.
We
are
more
than
happy
to
help
with
any
of
those
questions,
anything
that
comes
up.
So,
thank
you.
Everybody
a
reminder.
Next
week
we
will
be
talking
about
service
mesh
two
weeks,
we'll
be
talking
about
micro
shift,
christian's
been
doing
a
lot
of
really
cool
stuff
with
micro
shift.
You
know
I've
been
chatting
on
the
side.