Security design - 2 nics on nodes - splitting management flows than application ones

Solution In Progress - Updated -

Environment

  • Openshift 3

Issue

  • Is it possible to route master<->node communication via one NIC and client<->router communication via another?
  • And then his second question is, is it possible to put https://master.example.com on one NIC and master<->node communication on another ?
  • Also is it is possible to have a private IP address for a node and a public IP address too ?

Resolution

  • Is it possible to route master<->node communication via one NIC and client<->router communication via another?

Simple answer is yes. the openshift_public_ip and openshift_public_hostname variables configure the "externally available" hostnames/ips for the hosts, generally this is used for cloud based deployments (or any deployments where the publicly accessible ip/hostname are not attached physically to the host, such as cloud public ips or a NAT environment), but this should also allow for configuring the publicly accessible over a separate interface as well.

I suspect we may hit a snag or two, since this scenario hasn't been fully tested, but anything that doesn't work right should be considered a bug.

  • And then his second question is, is it possible to put https://master.example.com on one NIC and master<->node communication on another.

Same as above. the values assigned to openshift_public_ip and openshift_public hostname will dictate what is accessible externally, while openshift_hostname and openshift_ip are used for internal cluster communication.

  • Also is it is possible to have a private IP address for a node and a public IP address too ?
    Same as above.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.