1. Create a project to store CNI configurations as CRs and the Pods that will use the CRs.

   $ oc new-project multinetwork-example

2. Create the CR that will define an additional network interface. Create a YAML file called macvlan-conf.yaml with the following contents:

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition 1
   metadata:
     name: macvlan-conf 2
   spec:
     config: '{ 3
         "cniVersion": "0.3.0",
         "type": "macvlan",
         "master": "eth0",
         "mode": "bridge",
         "ipam": {
           "type": "host-local",
           "subnet": "192.168.1.0/24",
           "rangeStart": "192.168.1.200",
           "rangeEnd": "192.168.1.216",
           "routes": [
             { "dst": "0.0.0.0/0" }
           ],
           "gateway": "192.168.1.1"
         }
       }'

   1

   kind: NetworkAttachmentDefinition. This is the name for the CR where this configuration will be stored. It is a custom extension of Kubernetes that defines how networks are attached to Pods.

   2

   name maps to the annotation, which is used in the next step.

   3

   config: The CNI configuration is packaged in the config field.

   The configuration is specific to a plug-in, which enables macvlan. Note the type line in the CNI configuration portion. Aside from the IPAM (IP address management) parameters for networking, in this example the master field must reference a network interface that resides on the node(s) hosting the Pod(s).

3. Run the following command to create the CR:

   $ oc create -f macvlan-conf.yaml

1. Create a YAML file for the openshift-sriov namespace with the following contents:

   apiVersion: v1
   kind: Namespace
   metadata:
     name: openshift-sriov
     labels:
       name: openshift-sriov
       openshift.io/run-level: "0"
     annotations:
       openshift.io/node-selector: ""
       openshift.io/description: "Openshift SR-IOV network components"

2. Run the following command to create the openshift-sriov namespace:

   $ oc create -f openshift-sriov.yaml

3. Create a YAML file for the sriov-device-plugin service account with the following contents:

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: sriov-device-plugin
     namespace: openshift-sriov

4. Run the following command to create the sriov-device-plugin service account:

   $ oc create -f sriov-device-plugin.yaml

5. Create a YAML file for the sriov-cni service account with the following contents:

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: sriov-cni
     namespace: openshift-sriov

6. Run the following command to create the sriov-cni service account:

   $ oc create -f sriov-cni.yaml

7. Create a YAML file for the sriov-device-plugin DaemonSet with the following contents:

   Note

   The SR-IOV network device plug-in daemon, when launched, will discover all the configured SR-IOV VFs (of supported NIC models) on each node and advertise discovered resources. The number of available SR-IOV VF resources that are capable of being allocated can be reviewed by describing a node with the oc describe node <node-name> command. The resource name for the SR-IOV VF resources is openshift.io/sriov. When no SR-IOV VFs are available on the node, a value of zero is displayed.

   kind: DaemonSet
   apiVersion: apps/v1
   metadata:
     name: sriov-device-plugin
     namespace: openshift-sriov
     annotations:
       kubernetes.io/description: |
         This daemon set launches the SR-IOV network device plugin on each node.
   spec:
     selector:
       matchLabels:
         app: sriov-device-plugin
     updateStrategy:
       type: RollingUpdate
     template:
       metadata:
         labels:
           app: sriov-device-plugin
           component: network
           type: infra
           openshift.io/component: network
       spec:
         hostNetwork: true
         nodeSelector:
           beta.kubernetes.io/os: linux
         tolerations:
         - operator: Exists
         serviceAccountName: sriov-device-plugin
         containers:
         - name: sriov-device-plugin
           image: quay.io/openshift/ose-sriov-network-device-plugin:v4.0.0
           args:
           - --log-level=10
           securityContext:
             privileged: true
           volumeMounts:
           - name: devicesock
             mountPath: /var/lib/kubelet/
             readOnly: false
           - name: net
             mountPath: /sys/class/net
             readOnly: true
         volumes:
           - name: devicesock
             hostPath:
               path: /var/lib/kubelet/
           - name: net
             hostPath:
               path: /sys/class/net

8. Run the following command to create the sriov-device-plugin DaemonSet:

   oc create -f sriov-device-plugin.yaml

9. Create a YAML file for the sriov-cni DaemonSet with the following contents:

   kind: DaemonSet
   apiVersion: apps/v1
   metadata:
     name: sriov-cni
     namespace: openshift-sriov
     annotations:
       kubernetes.io/description: |
         This daemon set launches the SR-IOV CNI plugin on SR-IOV capable worker nodes.
   spec:
     selector:
       matchLabels:
         app: sriov-cni
     updateStrategy:
       type: RollingUpdate
     template:
       metadata:
         labels:
           app: sriov-cni
           component: network
           type: infra
           openshift.io/component: network
       spec:
         nodeSelector:
           beta.kubernetes.io/os: linux
         tolerations:
         - operator: Exists
         serviceAccountName: sriov-cni
         containers:
         - name: sriov-cni
           image: quay.io/openshift/ose-sriov-cni:v4.0.0
           securityContext:
             privileged: true
           volumeMounts:
           - name: cnibin
             mountPath: /host/opt/cni/bin
         volumes:
           - name: cnibin
             hostPath:
               path: /var/lib/cni/bin

10. Run the following command to create the sriov-cni DaemonSet:

    $ oc create -f sriov-cni.yaml

1. Create a YAML file for the Custom Resource (CR) with SR-IOV configuration. The name field in the following CR has the value sriov-conf.

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition
   metadata:
     name: sriov-conf
     annotations:
       k8s.v1.cni.cncf.io/resourceName: openshift.io/sriov 1
   spec:
     config: '{
         "type": "sriov", 2
         "name": "sriov-conf",
         "ipam": {
           "type": "host-local",
           "subnet": "10.56.217.0/24",
           "routes": [{
             "dst": "0.0.0.0/0"
           }],
           "gateway": "10.56.217.1"
         }
       }'

   1

   k8s.v1.cni.cncf.io/resourceName annotation is set to openshift.io/sriov.

   2

   type is set to sriov.

2. Run the following command to create the sriov-conf CR:

   $ oc create -f sriov-conf.yaml

3. Create a YAML file for a Pod which references the name of the NetworkAttachmentDefinition and requests one openshift.io/sriov resource:

   apiVersion: v1
   kind: Pod
   metadata:
     name: sriovsamplepod
     annotations:
       k8s.v1.cni.cncf.io/networks: sriov-conf
   spec:
     containers:
     - name: sriovsamplepod
       command: ["/bin/bash", "-c", "sleep 2000000000000"]
       image: centos/tools
       resources:
         requests:
           openshift.io/sriov: '1'
         limits:
           openshift.io/sriov: '1'

4. Run the following command to create the sriovsamplepod Pod:

   $ oc create -f sriovsamplepod.yaml

5. View the additional interface by executing the ip command:

   $ oc exec sriovsamplepod -- ip a

Procedure

1. Log in as a user with cluster-admin privileges.

2. Generate the default project template:

   $ oc adm create-bootstrap-project-template -o yaml > template.yaml

3. Use a text editor to modify the generated template.yaml file by adding objects or modifying existing objects.

4. The project template must be created in the openshift-config namespace. Load your modified template:

   $ oc create -f template.yaml -n openshift-config

5. Edit the project configuration resource using the web console or CLI.

   • Using the web console:

     1. Navigate to the Administration → Cluster Settings page.
     2. Click Global Configuration to view all configuration resources.
     3. Find the entry for Project and click Edit YAML.

   • Using the CLI:

     1. Edit the project.config.openshift.io/cluster resource:

        $ oc edit project.config.openshift.io/cluster

6. Update the spec section to include the projectRequestTemplate and name parameters, and set the name of your uploaded project template. The default name is project-request.

   Project configuration resource with custom project template

   apiVersion: config.openshift.io/v1
   kind: Project
   metadata:
     ...
   spec:
     projectRequestTemplate:
       name: <template_name>

7. After you save your changes, create a new project to verify that your changes were successfully applied.

Procedure

1. Edit the default template for a new project by running the following command:

   $ oc edit template <project_template> -n openshift-config

   Replace <project_template> with the name of the default template that you configured for your cluster. The default template name is project-request.

2. In the template, add each NetworkPolicy object as an element to the objects parameter. The objects parameter accepts a collection of one or more objects.

   In the following example, the objects parameter collection includes several NetworkPolicy objects:

   objects:
   - apiVersion: networking.k8s.io/v1
     kind: NetworkPolicy
     metadata:
       name: allow-from-same-namespace
     spec:
       podSelector:
       ingress:
       - from:
         - podSelector: {}
   - apiVersion: networking.k8s.io/v1
     kind: NetworkPolicy
     metadata:
       name: allow-from-openshift-ingress
     spec:
       ingress:
       - from:
         - namespaceSelector:
             matchLabels:
               network.openshift.io/policy-group: ingress
       podSelector: {}
       policyTypes:
       - Ingress
   ...

3. Optional: Create a new project to confirm that your network policy objects are created successfully by running the following commands:

   1. Create a new project:

      $ oc new-project <project> 1

      1

      Replace <project> with the name for the project you are creating.

   2. Confirm that the network policy objects in the new project template exist in the new project:

      $ oc get networkpolicy
      NAME                           POD-SELECTOR   AGE
      allow-from-openshift-ingress   <none>         7s
      allow-from-same-namespace      <none>         7s

Procedure

1. Update the NetNamespace resource with the egress IP address using the following JSON:

    $ oc patch netnamespace <project_name> --type=merge -p \ 1
     '{
       "egressIPs": [
         "<ip_address>" 2
       ]
     }'

   1

   Specify the name of the project.

   2

   Specify a single egress IP address. Using multiple IP addresses is not supported.

   For example, to assign project1 to an IP address of 192.168.1.100 and project2 to an IP address of 192.168.1.101:

   $ oc patch netnamespace project1 --type=merge -p \
     '{"egressIPs": ["192.168.1.100"]}'
   $ oc patch netnamespace project2 --type=merge -p \
     '{"egressIPs": ["192.168.1.101"]}'

2. Indicate which nodes can host egress IP addresses by setting the egressCIDRs parameter for each host using the following JSON:

   $ oc patch hostsubnet <node_name> --type=merge -p \ 1
     '{
       "egressCIDRs": [
         "<ip_address_range_1>", "<ip_address_range_2>" 2
       ]
     }'

   1

   Specify a node name.

   2

   Specify one or more IP address ranges in CIDR format.

   For example, to set node1 and node2 to host egress IP addresses in the range 192.168.1.0 to 192.168.1.255:

   $ oc patch hostsubnet node1 --type=merge -p \
     '{"egressCIDRs": ["192.168.1.0/24"]}'
   $ oc patch hostsubnet node2 --type=merge -p \
     '{"egressCIDRs": ["192.168.1.0/24"]}'

   OpenShift Container Platform automatically assigns specific egress IP addresses to available nodes in a balanced way. In this case, it assigns the egress IP address 192.168.1.100 to node1 and the egress IP address 192.168.1.101 to node2 or vice versa.

Procedure

1. Update the NetNamespace resource by specifying the following JSON object with the desired IP addresses:

   $ oc patch netnamespace <project> --type=merge -p \ 1
     '{
       "egressIPs": [ 2
         "<ip_address>"
         ]
     }'

   1

   Specify the name of the project.

   2

   Specify one or more egress IP addresses. The egressIPs parameter is an array.

   For example, to assign the project1 project to an IP address of 192.168.1.100:

   $ oc patch netnamespace project1 --type=merge \
     -p '{"egressIPs": ["192.168.1.100"]}'

   You can set egressIPs to two or more IP addresses on different nodes to provide high availability. If multiple egress IP addresses are set, pods use the first IP in the list for egress, but if the node hosting that IP address fails, pods switch to using the next IP in the list after a short delay.

2. Manually assign the egress IP to the node hosts. Set the egressIPs parameter on the HostSubnet object on the node host. Using the following JSON, include as many IPs as you want to assign to that node host:

   $ oc patch hostsubnet <node_name> --type=merge -p \ 1
     '{
       "egressIPs": [ 2
         "<ip_address_1>",
         "<ip_address_N>"
         ]
     }'

   1

   Specify the name of the project.

   2

   Specify one or more egress IP addresses. The egressIPs field is an array.

   For example, to specify that node1 should have the egress IPs 192.168.1.100, 192.168.1.101, and 192.168.1.102:

   $ oc patch hostsubnet node1 --type=merge -p \
     '{"egressIPs": ["192.168.1.100", "192.168.1.101", "192.168.1.102"]}'

   In the previous example, all egress traffic for project1 will be routed to the node hosting the specified egress IP, and then connected (using NAT) to that IP address.

Procedure

1. Create a policy rule:

   1. Create a <policy-name>.yaml file where <policy-name> describes the egress policy rules.
   2. In the file you created, define an egress policy object.

2. Enter the following command to create the policy object:

   $ oc create -f <policy-name>.yaml -n <project>

   In the following example, a new EgressNetworkPolicy object is created in a project named project1:

   $ oc create -f default-rules.yaml -n project1
   egressnetworkpolicy.network.openshift.io/default-rules created

3. Optional: Save the <policy-name>.yaml so that you can make changes later.

1. Find the name of the EgressNetworkPolicy object for the project. Replace <project> with the name of the project.

   $ oc get -n <project> egressnetworkpolicy

2. Optionally, if you did not save a copy of the EgressNetworkPolicy object when you created the egress network firewall, enter the following command to create a copy.

   $ oc get -n <project> \ 1
     egressnetworkpolicy <name> \ 2
     -o yaml > <filename>.yaml 3

   1

   Replace <project> with the name of the project

   2

   Replace <name> with the name of the object.

   3

   Replace <filename> with the name of the file to save the YAML.

3. Enter the following command to replace the EgressNetworkPolicy object. Replace <filename> with the name of the file containing the updated EgressNetworkPolicy object.

   $ oc replace -f <filename>.yaml

1. Find the name of the EgressNetworkPolicy object for the project. Replace <project> with the name of the project.

   $ oc get -n <project> egressnetworkpolicy

2. Enter the following command to delete the EgressNetworkPolicy object. Replace <project> with the name of the project and <name> with the name of the object.

   $ oc delete -n <project> egressnetworkpolicy <name>

Procedure

1. Use the following command to join projects to an existing project network:

   $ oc adm pod-network join-projects --to=<project1> <project2> <project3>

   Alternatively, instead of specifying specific project names, you can use the --selector=<project_selector> option to specify projects based upon an associated label.

2. Optional: Run the following command to view the pod networks that you have joined together:

   $ oc get netnamespaces

   Projects in the same pod-network have the same network ID in the NETID column.

Procedure

1. Edit the Network.operator.openshift.io Custom Resource (CR) by running the following command:

   $ oc edit network.operator.openshift.io cluster

2. Modify the kubeProxyConfig parameter in the CR with your changes to the kube-proxy configuration, such as in the following example CR:

   apiVersion: operator.openshift.io/v1
   kind: Network
   metadata:
     name: cluster
   spec:
     kubeProxyConfig:
       iptablesSyncPeriod: 30s
       proxyArguments:
         iptables-min-sync-period: ["30s"]

3. Save the file and exit the text editor.

   The syntax is validated by the oc command when you save the file and exit the editor. If your modifications contain a syntax error, the editor opens the file and displays an error message.

4. Run the following command to confirm the configuration update:

   $ oc get networks.operator.openshift.io -o yaml

   The command returns output similar to the following example:

   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: Network
     metadata:
       name: cluster
     spec:
       clusterNetwork:
       - cidr: 10.128.0.0/14
         hostPrefix: 23
       defaultNetwork:
         type: OpenShiftSDN
       kubeProxyConfig:
         iptablesSyncPeriod: 30s
         proxyArguments:
           iptables-min-sync-period:
           - 30s
       serviceNetwork:
       - 172.30.0.0/16
     status: {}
   kind: List

5. Optional: Run the following command to confirm that the Cluster Network Operator accepted the configuration change:

   $ oc get clusteroperator network
   NAME      VERSION     AVAILABLE   PROGRESSING   DEGRADED   SINCE
   network   4.1.0-0.9   True        False         False      1m

   The AVAILABLE field is True when the configuration update is applied successfully.

Procedure

1. Using the oc annotate command, add the timeout to the route:

   $ oc annotate route <route_name> \
       --overwrite haproxy.router.openshift.io/timeout=<timeout><time_unit> 1

   1

   Supported time units are microseconds (us), milliseconds (ms), seconds (s), minutes (m), hours (h), or days (d).

   The following example sets a timeout of two seconds on a route named myroute:

   $ oc annotate route myroute --overwrite haproxy.router.openshift.io/timeout=2s

Procedure

1. Log in to OpenShift Container Platform.

2. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

3. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/openshift3/mysql-55-rhel7

4. Run the following command to see that the new service is created:

   $ oc get svc -n openshift-ingress
   NAME                      TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                      AGE
   router-default            LoadBalancer   172.30.16.119   52.230.228.163   80:30745/TCP,443:32561/TCP   2d6h
   router-internal-default   ClusterIP      172.30.101.15   <none>           80/TCP,443/TCP,1936/TCP      2d6h

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. Run the following command to expose the route:

   $ oc expose service <service_name>

   For example:

   $ oc expose service mysql-55-rhel7
   route "mysql-55-rhel7" exposed

4. Use a tool, such as cURL, to make sure you can reach the service using the cluster IP address for the service:

   $ curl <pod_ip>:<port>

   For example:

   $ curl 172.30.131.89:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connected to the service.

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p
   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml
   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: IngressController
     metadata:
       name: sharded
       namespace: openshift-ingress-operator
     spec:
       domain: <apps-sharded.basedomain.example.net>
       nodePlacement:
         nodeSelector:
           matchLabels:
             node-role.kubernetes.io/worker: ""
       routeSelector:
         matchLabels:
           type: sharded
     status: {}
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that have the label type: sharded.

Procedure

1. Edit the router-internal.yaml file:

   # cat router-internal.yaml
   apiVersion: v1
   items:
   - apiVersion: operator.openshift.io/v1
     kind: IngressController
     metadata:
       name: sharded
       namespace: openshift-ingress-operator
     spec:
       domain: <apps-sharded.basedomain.example.net>
       nodePlacement:
         nodeSelector:
           matchLabels:
             node-role.kubernetes.io/worker: ""
       namespaceSelector:
         matchLabels:
           type: sharded
     status: {}
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

2. Apply the Ingress Controller router-internal.yaml file:

   # oc apply -f router-internal.yaml

   The Ingress Controller selects routes in any namespace that is selected by the namespace selector that have the label type: sharded.

Procedure

1. Log in to OpenShift Container Platform.

2. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

3. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/openshift3/mysql-55-rhel7

4. Run the following command to see that the new service is created:

   $ oc get svc -n openshift-ingress
   NAME                      TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                      AGE
   router-default            LoadBalancer   172.30.16.119   52.230.228.163   80:30745/TCP,443:32561/TCP   2d6h
   router-internal-default   ClusterIP      172.30.101.15   <none>           80/TCP,443/TCP,1936/TCP      2d6h

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. Run the following command to expose the route:

   $ oc expose service <service_name>

   For example:

   $ oc expose service mysql-55-rhel7
   route "mysql-55-rhel7" exposed

4. Use a tool, such as cURL, to make sure you can reach the service using the cluster IP address for the service:

   $ curl <pod_ip>:<port>

   For example:

   $ curl 172.30.131.89:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connected to the service.

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p
   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

1. Log into OpenShift Container Platform.

2. Load the project where the service you want to expose is located.

   $ oc project project1

3. Open a text file on the master node and paste the following text, editing the file as needed:

   Example 10.1. Sample load balancer configuration file

   apiVersion: v1
   kind: Service
   metadata:
     name: egress-2 1
   spec:
     ports:
     - name: db
       port: 3306 2
     loadBalancerIP:
     type: LoadBalancer 3
     selector:
       name: mysql 4

   1

   Enter a descriptive name for the load balancer service.

   2

   Enter the same port that the service you want to expose is listening on.

   3

   Enter loadbalancer as the type.

   4

   Enter the name of the service.

4. Save and exit the file.

5. Run the following command to create the service:

   oc create -f <file-name>

   For example:

   oc create -f mysql-lb.yaml

6. Execute the following command to view the new service:

   $ oc get svc
   NAME       TYPE           CLUSTER-IP      EXTERNAL-IP                             PORT(S)          AGE
   egress-2   LoadBalancer   172.30.22.226   ad42f5d8b303045-487804948.example.com   3306:30357/TCP   15m

   The service has an external IP address automatically assigned if there is a cloud provider enabled.

7. On the master, use a tool, such as cURL, to make sure you can reach the service using the public IP address:

   $ curl <public-ip>:<port>

   ++ For example:

   $ curl 172.29.121.74:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connecting with the service:

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p
   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Log in to OpenShift Container Platform.

2. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

3. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/openshift3/mysql-55-rhel7

4. Run the following command to see that the new service is created:

   $ oc get svc -n openshift-ingress
   NAME                      TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                      AGE
   router-default            LoadBalancer   172.30.16.119   52.230.228.163   80:30745/TCP,443:32561/TCP   2d6h
   router-internal-default   ClusterIP      172.30.101.15   <none>           80/TCP,443/TCP,1936/TCP      2d6h

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. Run the following command to expose the route:

   $ oc expose service <service_name>

   For example:

   $ oc expose service mysql-55-rhel7
   route "mysql-55-rhel7" exposed

4. Use a tool, such as cURL, to make sure you can reach the service using the cluster IP address for the service:

   $ curl <pod_ip>:<port>

   For example:

   $ curl 172.30.131.89:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connected to the service.

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p
   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>

Procedure

1. Log in to OpenShift Container Platform.

2. Create a new project for your service:

   $ oc new-project <project_name>

   For example:

   $ oc new-project myproject

3. Use the oc new-app command to create a service. For example:

   $ oc new-app \
       -e MYSQL_USER=admin \
       -e MYSQL_PASSWORD=redhat \
       -e MYSQL_DATABASE=mysqldb \
       registry.redhat.io/openshift3/mysql-55-rhel7

4. Run the following command to see that the new service is created:

   $ oc get svc -n openshift-ingress
   NAME                      TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                      AGE
   router-default            LoadBalancer   172.30.16.119   52.230.228.163   80:30745/TCP,443:32561/TCP   2d6h
   router-internal-default   ClusterIP      172.30.101.15   <none>           80/TCP,443/TCP,1936/TCP      2d6h

   By default, the new service does not have an external IP address.

1. Log in to OpenShift Container Platform.

2. Log in to the project where the service you want to expose is located:

   $ oc project project1

3. Run the following command to expose the route:

   $ oc expose service <service_name>

   For example:

   $ oc expose service mysql-55-rhel7
   route "mysql-55-rhel7" exposed

4. Use a tool, such as cURL, to make sure you can reach the service using the cluster IP address for the service:

   $ curl <pod_ip>:<port>

   For example:

   $ curl 172.30.131.89:3306

   The examples in this section use a MySQL service, which requires a client application. If you get a string of characters with the Got packets out of order message, you are connected to the service.

   If you have a MySQL client, log in with the standard CLI command:

   $ mysql -h 172.30.131.89 -u admin -p
   Enter password:
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   
   MySQL [(none)]>