ON THIS PAGE
Static Routes
SUMMARY Juniper Cloud-Native Contrail Networking (CN2) release 23.1 supports static routes for your cluster. This article provides information about how to configure static routes for your CN2 cluster.
Understanding Static Routes
You can use static routes when a network doesn't require the complexity of a dynamic routing protocol. Routes that are permanent fixtures in routing and forwarding tables are often configured as static routes. The internal traffic from stub networks benefits from static routes.
The route consists of a destination prefix and a next-hop forwarding address. The static route is activated in the routing table and inserted into the forwarding table when the next-hop address is reachable. Traffic that matches the static route is forwarded to the specified next-hop address.
Static Routes in CN2
CN2 implements static routes through the following two custom resources (CRs):RouteTable
: Contains a user-defined next hop destination (nextHop
), along with a destination prefix to identify next hop traffic. ThenextHop
IP address must be an IP address of another VMI object. A prefix defines the destination network which acts as the next hop for matching traffic. ARouteTable
lets you define a static route. You can associate aRouteTable
with a virtual network (VN). The following is an example of aRouteTable
CR: Note that the fieldapiVersion: core.contrail.juniper.net/v3 kind: RouteTable metadata: name: static-rt namespace: static-route spec: routes: route: - nextHop: 10.20.30.2 nextHopType: ip-address prefix: 10.20.30.0/24 communityAttributes: communityAttribute: - accept-own - no-advertise
nextHopType
must have the valueip-address
. Any other value results in a user input error. ThecommunityAttributes
field enables you to control route learning via BGP.InterfaceRouteTable
: TheInterfaceRouteTable
configures static routing for a virtual machine interface (VMI). AnInterfaceRouteTable
contains the destination prefix without the need for a next hop entry. As with aRouteTable
, the prefix defines the destination network, or next hop. Unlike aRouteTable
, you do not need to define anextHop
IP address because when you associate anInterfaceRouteTable
with a VMI, the associated VMI acts as the next hop for this prefix.The following is an example of an
InterfaceRouteTable
CR: Note that the fieldapiVersion: core.contrail.juniper.net/v3 kind: InterfaceRouteTable metadata: name: static-rt namespace: static-route spec: interfaceRouteTableRoutes: route: - nextHopType: ip-address prefix: 10.20.30.0/24 communityAttributes: communityAttribute: - accept-own
nextHopType
must have the valueip-address
. Any other value results in a user input error.
Configure Static Routes for a Virtual Network
Configure theRouteTable
CR to apply static routes to a VN. A
VN references a RouteTable
in it's spec. As a result, the
RouteTable
is associated with that VN and the static route is configured.
The following is a VN object with an associated
RouteTable
:apiVersion: core.contrail.juniper.net/v3 kind: VirtualNetwork metadata: namespace: static-route name: vn-route spec: v4SubnetReference: apiVersion: core.contrail.juniper.net/v1alpha1 kind: Subnet namespace: static-route name: vn-subnet routeTableReferences: - apiVersion: core.contrail.juniper.net/v3 kind: RouteTable namespace: static-route name: static-rt
Configure Static Routes for a VMI
Configure anInterfaceRouteTable
to apply static routes to a VMI. A VMI references an
InterfaceRouteTable
in it's InterfaceRouteTableReference
section. The following is a VMI object with a reference to an
InterfaceRouteTable
:apiVersion: v3 kind: VirtualMachineInterface metadata: name: static-route-pod namespace: static-route annotations: core.juniper.net/interface-route-table: '[{"name": "static-rt", "namespace": "static-route"}]' spec: <VMI_SPEC> status: interfaceRouteTableReferences: - apiVersion: core.contrail.juniper.net/v3 kind: InterfaceRouteTable namespace: static-route name: static-rt
Configure Static Routes on Pod Interfaces
You can use the annotation section of a pod's manifest to configure static routes for a pod's default or secondary interface. The pod reconciler processes the annotation section to create a VMI object with an associatedInterfaceRouteTable
. The reconciler looks for
the string key: "core.juniper.net/interface-route-table" in the annotation section. The pod's
VMI uses that string as a metadata label to associate with an
InterfaceRouteTable
. The following is an example of a pod manifest with
an InterfaceRouteTable
defined for the default
interface:
apiVersion: v1 kind: Pod metadata: name: static-route-pod namespace: static-route annotations: core.juniper.net/interface-route-table: '[{"name": "vmi-rt", "namespace": "static-route"}]' spec: containers: - name: praqma image: <image-repository>:<tag> imagePullPolicy: Always securityContext: capabilities: add: - NET_ADMIN privileged: true
InterfaceRouteTable
defined
for the secondary
interface:apiVersion: v1 kind: Pod metadata: name: static-route-pod namespace: static-route annotations: k8s.v1.cni.cncf.io/networks: | [ { "name": "vn-route", "namespace": "static-route", "cni-args": { "core.juniper.net/interface-route-table": "[{\"name\": \"vmi-rt\", \"namespace\": "static-route\"}]" } } ] spec: containers: - name: praqma image: <image-repository>:<tag> imagePullPolicy: Always securityContext: capabilities: add: - NET_ADMIN privileged: true
name
for the primary interface InterfaceRouteTable
is vmi-rt
and that the name
for the secondary interface is
vn-route
. Defining two InterfaceRouteTables
with different
names
in the same namespace
automatically creates an
InterfaceRouteTable
for the primary and secondary interface of that pod. Configure Static Routes for a Virtual Network with a NAD
You can also specify static route properties in a network attachment definition (NAD) object. After the NAD is reconciled or applied, aRouteTable
is created
and the resulting VN object references that RouteTable
. The following is an
example of a NAD with static route information
defined:apiVersion: "k8s.cni.cncf.io/v1" kind: NetworkAttachmentDefinition metadata: name: vn-route namespace: static-route labels: vn: vn-route annotations: juniper.net/networks: '{ "ipamV4Subnet": "108.108.2.0/24" "routeTableReferences": '[{"name": "vn-rt", "namespace": "static-route"}]' }' spec: config: '{ "cniVersion": "0.3.1", "name": "vn-route", "type": "contrail-k8s-cni" }'
Multiple Static Routes on Pod Interfaces
Using InterfaceRouteTable,
you can associate multiple static routes to a
single pod interface (VMI). This means that that VMI object has multiple default next hop
destinations, depending on the IP prefix. You can specify multiple
InterfaceRouteTable
references using cluster service version (CSV) syntax
or JSON syntax annotations
.
You must reference an InterfaceRouteTable
in a "namespace/name" format.
In the following example, static-route
is the namespace and
to-right
and to-zone-1
are the
InterfaceRouteTable
objects, or next hop destination for the
left-vn
VMI.
The following example is a Deployment
with multiple
InterfaceRouteTable
references:
apiVersion: apps/v1 kind: Deployment metadata: name: forwarder namespace: static-route labels: app: forwarder spec: replicas: 3 selector: matchLabels: app: forwarder template: metadata: labels: app: forwarder annotations: k8s.v1.cni.cncf.io/networks: | [ { "name": "left-vn", "namespace": "static-route", "cni-args": { "core.juniper.net/interface-route-table": "static-route/to-right,static-route/to-zone-1" } }, { "name": "right-vn", "namespace": "static-route", "cni-args": { "core.juniper.net/interface-route-table": "static-route/to-left" } }, { "name": "zone-1", "namespace": "static-route", "cni-args": { "core.juniper.net/interface-route-table": "static-route/to-left" } }, { "name": "zone-2", "namespace": "static-route", "cni-args": { "core.juniper.net/interface-route-table": "static-route/to-left" } } ] spec: containers: - name: praqma image: <repository>:<tag> securityContext: capabilities: add: - NET_ADMIN privileged: true
The following example is a pod manifest with multiple InterfaceRouteTable
references using JSON syntax:
apiVersion: v1 kind: Pod metadata: name: irt-right namespace: static-route annotations: k8s.v1.cni.cncf.io/networks: | [{ "name": "right-vn", "namespace": "static-route", "cni-args": { "core.juniper.net/interface-route-table": "[{\"namespace\": \"static-route\", "\name\": \"to-left\"}, {\"namespace\": \"static-route\", \"name\": \"to-zone-1\"}]" } }] spec: containers: - name: praqma image: <image-repository>:<tag> securityContext: capabilities: add: - NET_ADMIN privileged: true
You must use backward slashes in JSON syntax. Backward slashes are required to encode a JSON string inside another JSON string.
Troubleshooting RouteTable and InterfaceRouteTable
The following sections contain useful commands when troubleshooting various
RouteTable
and InterfaceRouteTable
issues.
Config Plane Verification
-
Verify the state of the
RouteTable
andInterfaceRouteTable
objects.-
Check the status of the reconciler for the
InterfaceRouteTable
object.kubectl get interfaceroutetable -n
-
Check the status of the reconciler for the
RouteTable
object.kubectl get routetable -n
-
-
Verify the
RouteTable
reference in the associated VN. Verify theInterfaceRouteTable
reference in the associated VMI.-
Check the status of the reconciler for the VMI. You should see the
InterfaceRouteTable
in the VMI with an associated universally unique identifier (UUID) the Contrail FQ (meta info such asapiversion
,kind
,namespace
,name
) name.kubectl get vmi -n -oyaml | grep -i interfaceRouteTable
kubectl get vn -n -oyaml | grep -i routeTable
-
Dataplane Verification
-
In the introspect, verify that the VRF of the VN shows a row with a matching static route prefix specified in the RT using the following steps:
-
Verify that the VRF is associated with the VN.
-
Navigate to the ucindex column in the VRF unicast
RouteTable
. -
Verify that the table contains a row with the correct static route prefix.
-
- In the introspect, verify that the next hop properties of the VN are valid. In the
introspect, the next hop column for the prefix should contain the following:
-
The next hop interface name must be a valid tap interface.
-
The
label
must be a positive integer. -
The
resolved
value must betrue
. -
The
route-type:
value must beInterfaceStaticRoute
.
-