Skip to content

Commit 901f960

Browse files
w13915984028w13915984028
committed
Amend typos and fork to v1.2
Signed-off-by: Jian Wang <[email protected]>
1 parent 4797cdc commit 901f960

File tree

4 files changed

+234
-13
lines changed

4 files changed

+234
-13
lines changed

‎docs/networking/best-practice.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,15 @@ We will use the following diagram to illustrate an example and the best practice
2626
The diagram shows a Harvester cluster composed of two hosts. It contains:
2727
- **Hardware**:
2828
- Two Harvester servers with dual-port network cards.
29-
- One non-VLAN-aware switch and one VLAN-aware switch. We will use the Cisco-like configuration as an example.
29+
- One non-VLAN-aware switch and one VLAN-aware switch. We will use the Cisco-like configuration as an example.
3030
- One router. We will use the Cisco-like configuration as an example.
3131

3232
- **Cabling**:
3333
- The NIC eth0 of the node1 is connected to the port `ethernet1/1` of the switch1, while the NIC eth0 of the node2 is connected to the port `ethernet1/2` of the switch1.
3434
- The NIC eth1 of the node1 is connected to the port `ethernet1/1` of the switch2, while the NIC eth1 of the node2 is connected to the port `ethernet1/2` of the switch2.
3535
- The port `ethernet1/3` of the switch1 is connected to the port `ethernet0/1` of the router.
3636
- The port `ethernet1/3` of the switch2 is connected to the port `ethernet0/2` of the router.
37-
37+
3838
- **Network specification**:
3939
- The subnet of the Harvester hosts is in the VLAN untagged network.
4040
- All hosts are in the IPv4 subnet `10.10.0.0/24`, and the gateway IP address is `10.10.0.254`.
@@ -51,9 +51,9 @@ The diagram shows a Harvester cluster composed of two hosts. It contains:
5151
- One guest cluster `demo` composed of `VM3` and `VM4`.
5252
- Two VM load balancers and one guest Kubernetes cluster load balancer.
5353

54-
## Multiple Cluster Networks for Traffic Isolation
54+
## Multiple Cluster Networks for Traffic Isolation
5555

56-
The two Harvester hosts have two NICs. Specifically, NIC `eth0` is used for the management network (mapped to the cluster network `mgmt`), while NIC `eth1` is used for the VM network (mapped to the cluster network `vm`).
56+
The two Harvester hosts have two NICs. Specifically, NIC `eth0` is used for the management network (mapped to the cluster network `mgmt`), while NIC `eth1` is used for the VM network (mapped to the cluster network `vm`).
5757

5858
It's beneficial to use two cluster networks to achieve traffic isolation between the management plane and the data plane. If there is an issue with the VM network, you can still use the management network for emergency handling to ensure business continuity. Similarly, if there is a failure in the management network, VM traffic is not affected.
5959

@@ -68,7 +68,7 @@ Since the management network is under the untagged network, `switch1` can be a n
6868

6969
2. ** Switch2 configuration**:
7070

71-
Set the ports `ethernet1/1`, `ethernet1/2`, and `ethernet1/3` as trunk ports, and allow VLAN 100-200.
71+
Set the ports `ethernet1/1`, `ethernet1/2`, and `ethernet1/3` as trunk ports, and allow VLAN 100-200.
7272

7373
```
7474
switch2# config terminal
@@ -104,7 +104,7 @@ Set the ports `ethernet1/1`, `ethernet1/2`, and `ethernet1/3` as trunk ports, an
104104
router(dhcp-config)# network 10.10.0.0 255.255.255.0
105105
router(dhcp-config)# default-router 10.10.0.254
106106
router(dhcp-config)# interface ethernet0/1
107-
router(config-if)# ip address 10.10.0.254 255.255.255.0
107+
router(config-if)# ip address 10.10.0.254 255.255.255.0
108108
router(config-if)# no shutdown
109109
router(config)# exit
110110
router# copy running-config startup-config
@@ -177,19 +177,19 @@ Set the ports `ethernet1/1`, `ethernet1/2`, and `ethernet1/3` as trunk ports, an
177177
```
178178

179179
## Access Harvester Load Balancers from Different VLANs
180-
The Harvester load balancer is divided into two types: VM load balancer and guest Kubernetes cluster load balancer.
180+
The Harvester load balancer is divided into two types: VM load balancer and guest Kubernetes cluster load balancer.
181181

182-
1. The load balancer IP of the VM load balancer is only exposed within the same network as the Harvester hosts, or in other words, the management network. To access the VM load balancer from outside the network, you have to guarantee routing for external clients to the management network. For example, if the VM load balancer `lb1` has obtained its load balancer IP via DHCP and you want to access it from the VM `VM5`, you can add the following static routes:
182+
1. The load balancer IP of the VM load balancer is only exposed within the same network as the Harvester hosts, or in other words, the management network. To access the VM load balancer from outside the network, you have to guarantee routing for external clients to the management network. For example, if the VM load balancer `lb1` has obtained its load balancer IP via DHCP and you want to access it from the VM `VM5`, you can add the following static routes:
183183

184184
```
185185
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
186186
router(config)# ip route 192.168.0.0 255.255.255.0 ethernet0/2
187187
```
188188

189189
1. The load balancer IP of the guest Kubernetes cluster load balancer is exposed within the VM network. In the diagram above, the guest cluster `demo` is within the VM network `vlan200` because the VMs consisting of the guest cluster are in the `vlan200`. Thus, the guest Kubernetes cluster load balancer `lb2` is exposed within the VM network `vlan200`. There are three scenarios to explain how to access `lb2` if it has obtained the load balancer IP via DHCP:
190-
- You can access it from the VM `VM3` and `VM4` directly because they are in the `vlan200`.
190+
- You can access it from the VM `VM3` and `VM4` directly because they are in the `vlan200`.
191191
- You can also access it directly from the VMs in other VM networks because of the `A router on a stick` configuration.
192-
- You can access it from the Harvester hosts, or in other words, the management network, by adding the following static routes on the router.
192+
- You can access it from the Harvester hosts, or in other words, the management network, by adding the following static routes on the router.
193193

194194
```
195195
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1

‎docs/networking/deep-dive.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ External network devices typically refer to switches and DHCP servers. With a cl
107107
| --- | ----------- |
108108
| mode 0(balance-rr) | manual |
109109
| mode 1(active-backup) | none |
110-
| mdoe 2(balance-oxr) | manual |
110+
| mode 2(balance-oxr) | manual |
111111
| mode 3(broadcast) | manual |
112112
| mode 4(802.3ad) | LACP |
113113
| mode 5(balance-tlb) | none |
@@ -124,7 +124,7 @@ interface g0/25
124124
switchport mode trunk
125125
channel-group 1 mode active
126126

127-
interface g0/27
127+
interface g0/27
128128
switchport trunk encapsulation dot1q
129129
switchport mode trunk
130130
channel-group 1 mode active

‎versioned_docs/version-v1.2/networking/best-practice.md‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
---
2+
sidebar_position: 6
3+
sidebar_label: Best Practices
4+
title: "Harvester Network Best Practices"
5+
keywords:
6+
- Harvester
7+
- Networking
8+
---
9+
10+
<head>
11+
<link rel="canonical" href="https://docs.harvesterhci.io/v1.2/networking/best-pratice"/>
12+
</head>
13+
14+
## Overview
15+
16+
This best practice guide introduces how to configure Harvester and the external network to achieve the following goals:
17+
- Traffic isolation between the management plane and the data plane.
18+
- General external switch and router configurations.
19+
- Network access to VMs from different VLANs.
20+
- Access Harvester load balancers from different VLANs.
21+
22+
We will use the following diagram to illustrate an example and the best practices.
23+
24+
![](/img/v1.2/networking/best-practice.png)
25+
26+
The diagram shows a Harvester cluster composed of two hosts. It contains:
27+
- **Hardware**:
28+
- Two Harvester servers with dual-port network cards.
29+
- One non-VLAN-aware switch and one VLAN-aware switch. We will use the Cisco-like configuration as an example.
30+
- One router. We will use the Cisco-like configuration as an example.
31+
32+
- **Cabling**:
33+
- The NIC eth0 of the node1 is connected to the port `ethernet1/1` of the switch1, while the NIC eth0 of the node2 is connected to the port `ethernet1/2` of the switch1.
34+
- The NIC eth1 of the node1 is connected to the port `ethernet1/1` of the switch2, while the NIC eth1 of the node2 is connected to the port `ethernet1/2` of the switch2.
35+
- The port `ethernet1/3` of the switch1 is connected to the port `ethernet0/1` of the router.
36+
- The port `ethernet1/3` of the switch2 is connected to the port `ethernet0/2` of the router.
37+
38+
- **Network specification**:
39+
- The subnet of the Harvester hosts is in the VLAN untagged network.
40+
- All hosts are in the IPv4 subnet `10.10.0.0/24`, and the gateway IP address is `10.10.0.254`.
41+
- The VM network allows VLAN 100-200.
42+
- The IPv4 subnets of the VM network are:
43+
- Untagged network: `192.168.0.0/24`, and the gateway IP address is `192.168.0.254`.
44+
- VLAN 100: `192.168.100.0/24`, and the gateway IP address is `192.168.100.254`.
45+
- VLAN 200: `192.168.200.0/24`, and the gateway IP address is `192.168.200.254`.
46+
47+
- **Harvester configuration**:
48+
- Two cluster networks: `mgmt` and `vm`.
49+
- Three VM networks under the cluster network `vm`: `vlan100`, `vlan200`, and `untagged`.
50+
- Six VMs, from `VM1` to `VM6`.
51+
- One guest cluster `demo` composed of `VM3` and `VM4`.
52+
- Two VM load balancers and one guest Kubernetes cluster load balancer.
53+
54+
## Multiple Cluster Networks for Traffic Isolation
55+
56+
The two Harvester hosts have two NICs. Specifically, NIC `eth0` is used for the management network (mapped to the cluster network `mgmt`), while NIC `eth1` is used for the VM network (mapped to the cluster network `vm`).
57+
58+
It's beneficial to use two cluster networks to achieve traffic isolation between the management plane and the data plane. If there is an issue with the VM network, you can still use the management network for emergency handling to ensure business continuity. Similarly, if there is a failure in the management network, VM traffic is not affected.
59+
60+
If your hardware has more NICs, we recommend using at least two NICs for one cluster network. For example, you can use NIC `eth0` and `eth1` for the management network and NIC `eth2` and `eth3` for the VM network.
61+
62+
## External Switch and Router Configuration
63+
64+
1. ** Switch1 configuration**:
65+
66+
67+
Since the management network is under the untagged network, `switch1` can be a non-VLAN-aware switch. Typically, you can't configure a non-VLAN-aware switch.
68+
69+
2. ** Switch2 configuration**:
70+
71+
Set the ports `ethernet1/1`, `ethernet1/2`, and `ethernet1/3` as trunk ports, and allow VLAN 100-200.
72+
73+
```
74+
switch2# config terminal
75+
switch2(config)# interface ethernet1/1
76+
switch2(config-if)# switchport
77+
switch2(config-if)# switchport mode trunk
78+
switch2(config-if)# switchport trunk allowed vlan 100-200
79+
switch2(config-if)# switchport trunk native vlan 1
80+
switch2(config-if)# no shutdown
81+
switch2(config)# interface ethernet1/2
82+
switch2(config-if)# switchport
83+
switch2(config-if)# switchport mode trunk
84+
switch2(config-if)# switchport trunk allowed vlan 100-200
85+
switch2(config-if)# switchport trunk native vlan 1
86+
switch2(config-if)# no shutdown
87+
switch2(config)# interface ethernet1/3
88+
switch2(config-if)# switchport
89+
switch2(config-if)# switchport mode trunk
90+
switch2(config-if)# switchport trunk allowed vlan 100-200
91+
switch2(config-if)# switchport trunk native vlan 1
92+
switch2(config-if)# no shutdown
93+
switch2(config-if)# end
94+
switch2# copy running-config startup-config
95+
```
96+
97+
3. **Router configuration**:
98+
99+
- Configure a DHCP pool for the management network.
100+
101+
```
102+
router# config terminal
103+
router(config)# ip dhcp pool mgmt
104+
router(dhcp-config)# network 10.10.0.0 255.255.255.0
105+
router(dhcp-config)# default-router 10.10.0.254
106+
router(dhcp-config)# interface ethernet0/1
107+
router(config-if)# ip address 10.10.0.254 255.255.255.0
108+
router(config-if)# no shutdown
109+
router(config)# exit
110+
router# copy running-config startup-config
111+
```
112+
113+
- Configure three DHCP pools for the VM networks (untagged, vlan100, and vlan200).
114+
115+
```
116+
router# config terminal
117+
router(config)# ip dhcp pool vm-untagged
118+
router(dhcp-config)# network 192.168.0.0 255.255.255.0
119+
router(dhcp-config)# default-router 192.168.0.254
120+
router(dhcp-config)# ip dhcp pool vm-vlan100
121+
router(dhcp-config)# network 192.168.100.0 255.255.255.0
122+
router(dhcp-config)# default-router 192.168.100.254
123+
router(dhcp-config)# ip dhcp pool vm-vlan200
124+
router(dhcp-config)# network 192.168.200.0 255.255.255.0
125+
router(dhcp-config)# default-router 192.168.200.254
126+
router(config-if)# interface ethernet0/2
127+
router(config-if)# ip address 192.168.0.254 255.255.255.0
128+
router(config-if)# no shutdown
129+
router(config-subif)# interface ethernet0/2.100
130+
router(config-subif)# encapsulation dot1q 100
131+
router(config-subif)# ip address 192.168.100.254 255.255.255.0
132+
router(config-subif)# interface ethernet0/2.200
133+
router(config-subif)# encapsulation dot1q 200
134+
router(config-subif)# ip address 192.168.200.254 255.255.255.0
135+
router(config-subif)# end
136+
router# copy running-config startup-config
137+
```
138+
139+
## Network Access to VMs from Different VLANs
140+
141+
1. **Network connection between VM networks**:
142+
143+
The router configuration above uses the [`A router on a stick`](https://www.grandmetric.com/knowledge-base/design_and_configure/router-on-a-stick-approach-cisco-configuration/) technology to allow VMs among untagged network, `vlan100` and `vlan200`, to communicate with each other. Thus, adding more configurations to the router is not required.
144+
145+
1. **Network connection between VM networks and the management network**:
146+
147+
A feasible method to ensure network connectivity between VM networks and the management network is manually adding static routes. The following commands add static routes on the router to allow VMs in the untagged network, `vlan100` and `vlan200`, to access the management network.
148+
149+
```
150+
router(config)# config terminal
151+
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
152+
router(config)# ip route 192.168.0.0 255.255.255.0 ethernet0/2
153+
router(config)# ip route 192.168.100.0 255.255.255.0 ethernet0/2
154+
router(config)# ip route 192.168.200.0 255.255.255.0 ethernet0/2
155+
router(config)# end
156+
```
157+
158+
The route table would look like this:
159+
160+
```
161+
Router#show ip route
162+
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
163+
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
164+
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
165+
E1 - OSPF external type 1, E2 - OSPF external type 2
166+
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
167+
ia - IS-IS inter area, * - candidate default, U - per-user static route
168+
o - ODR, P - periodic downloaded static route
169+
170+
Gateway of last resort is not set
171+
172+
C 192.168.200.0/24 is directly connected, Ethernet0/2.200
173+
10.0.0.0/24 is subnetted, 1 subnets
174+
C 10.10.0.0 is directly connected, Ethernet0/1
175+
C 192.168.0.0/24 is directly connected, Ethernet0/2
176+
C 192.168.100.0/24 is directly connected, Ethernet0/2.100
177+
```
178+
179+
## Access Harvester Load Balancers from Different VLANs
180+
The Harvester load balancer is divided into two types: VM load balancer and guest Kubernetes cluster load balancer.
181+
182+
1. The load balancer IP of the VM load balancer is only exposed within the same network as the Harvester hosts, or in other words, the management network. To access the VM load balancer from outside the network, you have to guarantee routing for external clients to the management network. For example, if the VM load balancer `lb1` has obtained its load balancer IP via DHCP and you want to access it from the VM `VM5`, you can add the following static routes:
183+
184+
```
185+
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
186+
router(config)# ip route 192.168.0.0 255.255.255.0 ethernet0/2
187+
```
188+
189+
1. The load balancer IP of the guest Kubernetes cluster load balancer is exposed within the VM network. In the diagram above, the guest cluster `demo` is within the VM network `vlan200` because the VMs consisting of the guest cluster are in the `vlan200`. Thus, the guest Kubernetes cluster load balancer `lb2` is exposed within the VM network `vlan200`. There are three scenarios to explain how to access `lb2` if it has obtained the load balancer IP via DHCP:
190+
- You can access it from the VM `VM3` and `VM4` directly because they are in the `vlan200`.
191+
- You can also access it directly from the VMs in other VM networks because of the `A router on a stick` configuration.
192+
- You can access it from the Harvester hosts, or in other words, the management network, by adding the following static routes on the router.
193+
194+
```
195+
router(config)# ip route 10.10.0.0 255.255.255.0 ethernet0/1
196+
router(config)# ip route 192.168.200.0 255.255.255.0 ethernet0/2
197+
```
198+
199+
200+
:::note
201+
202+
Except for the static routes above, you can use dynamic routing protocols such as RIP, BGP, OSPF, and ISIS according to your network planning and requirements.
203+
204+
:::

‎versioned_docs/version-v1.2/networking/deep-dive.md‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,12 +107,29 @@ External network devices typically refer to switches and DHCP servers. With a cl
107107
| --- | ----------- |
108108
| mode 0(balance-rr) | manual |
109109
| mode 1(active-backup) | none |
110-
| mdoe 2(balance-oxr) | manual |
110+
| mode 2(balance-oxr) | manual |
111111
| mode 3(broadcast) | manual |
112112
| mode 4(802.3ad) | LACP |
113113
| mode 5(balance-tlb) | none |
114114
| mode 6(balance-alb) | none |
115115

116+
For example, if the bond mode is `802.3ad`, you need to configure LACP on the switch. The following is an example of LACP configuration on a Cisco switch:
117+
```
118+
interface port-channel1
119+
switchport trunk encapsulation dot1q
120+
switchport mode trunk
121+
122+
interface g0/25
123+
switchport trunk encapsulation dot1q
124+
switchport mode trunk
125+
channel-group 1 mode active
126+
127+
interface g0/27
128+
switchport trunk encapsulation dot1q
129+
switchport mode trunk
130+
channel-group 1 mode active
131+
```
132+
116133
- If you want VMs in a VLAN to be able to obtain IP addresses through the DHCP protocol, configure an IP pool for that VLAN in the DHCP server.
117134
118135

0 commit comments

Comments
 (0)