Configure Allowed Address Pairs
Juniper Networks supports Allowed Address Pairs (AAPs) using Cloud-Native Contrail® Networking™ Release 22.1 or later in a Kubernetes-orchestrated environment.
Allowed address pairs in Contrail Networking enables you to add IP/MAC (CIDR) addresses to
the guest interface (VirtualMachineInterface) by using a secondary IP
address.
When you create a pod in a cluster, each pod automatically obtains its IP address from the virtual machine interface. If your pod is not on the same virtual network, you can add an AAP to allow traffic to flow through the port regardless of the subnet. For example, let's say that your pod's IP address is 192.168.2.0. If you define an AAP with subnet 192.168.2.0/24, the AAP allows the pods to communicate with the guest interface. The vRouter forwards the traffic and advertises reachability to the pod.
To configure an AAP, insert the following attribute into your pod YAML file, as shown in the code block that follows:
kind: Pod
metadata:
name: my-pod
namespace: my-namespace
annotations:
k8s.v1.cni.cncf.op/networks: |
[
{
"name": "net-a",
"cni-args": {
"net.juniper.contrail.allowedAddressPairs": [{
"ip": 192.168.2.0/24
"mac": "02:3f:66:ad:00:e9",
"addressMode": "active-active"
}],}
...
},
{
"name": "net-b",
...
},
The AllowedAddressPairs attribute contains a list of allowed address pair
definitions, as described in the following table.
| Definition | Description |
|---|---|
| ip | Specify the external pod IP address through which you want to allow traffic to pass. |
| mac | (Optional) Specify the MAC address of the external pod. |
| addressMode | (Optional) Specify a high availability (HA) mode. Choose from
active/active or active/standby. Active/standby is the default. The addressMode default value is an empty string. Active/standby is used for VRRP addresses. Active/active is used for ECMP. |
In Kubemanager, the PodController watching for Pod events, reads the
interface definitions for each new AAP. The controller then generates an
AllowedAddressPair and adds it to the list of interfaces in the
VirtualMachineInterface.
Alternative Configuration
Alternatively, you can configure AAP interfaces directly from the
VirtualMachineInterface.To apply an AAP this configuration, run the
following command from the kubectl command-line tool:
kubectl patch --namespace project-kubemanager VirtualMachineInterface $VMINAME -p "$(cat ./aap.yaml)"
The preceding command updates the existing VirtualMachineInterface with
the AAP configuration, as shown in the following code block:
spec:
allowedAddressPairs:
allowedAddressPair:
- ip:
ipPrefix: 192.0.2.0
ipPrefixLen: 24