Enabling VM communication - Part 3
Scenario
The virtual machines exercise12-a
and exercise12-b
are operational with their IP addresses properly configured. However, the virtual machine exercise12-a
is unable to access the application running on port 80 on exercise12-b
.

|
The steps to fix exercise12 are:
Console
-
Login to Openshift console using the assigned user account
userx
{password}
-
Go to virtualization → Virtual Machines - select project for the assigned user account

-
Verify the
exercise-12-a
virtual machine IP address

-
Verify the
exercise-12-b
virtual machine IP address

-
On
Virtualization
→Virtual Machines
menu, click onexercise12-a
virtual machine and open it’sConsole
Test the communication is not working onexercise12-b
IP on port 80

-
On left side menu, click on
Networking
→MultiNetworkPolicies

-
Click on
deny-by-default
MultiNetworkPolicy and check it’s YAML.

-
On left side menu, click on
Networking
→MultiNetworkPolicies
and click onallow-80-on-exercise12
and check it’s YAML. Verify that the label onfrom
is configured asexercise12-b
virtual machine

-
Change it to
exercise12-a
label and clickSave
.

-
Test the connection from
exercise12-a
virtual machineConsole
and it’s working now.

lab grade exercise12
Command line (CLI)
-
Login to Openshift server API using the assigned user account with
oc
command if not logged in.
{login_command}
-
Go to the assigned namespace-userx
oc project namespace-userx
-
List the virtual machines
oc get virtualmachine
-
Getting the exercise12-a IP address
oc get vmi exercise12-a -n namespace-userx \
-o jsonpath='{.status.interfaces[1].ipAddress}'
-
Getting the exercise12-b IP address
oc get vmi exercise12-b -n namespace-userx \
-o jsonpath='{.status.interfaces[1].ipAddress}'
-
Try to access the application running on virtual machine exercise12-b using IP and verify that it’s not working.
Do not forget to change the IP to value defined on step 5. |
virtctl ssh lab-user@exercise12-a \
-c 'curl --silent --connect-timeout 3 http://IP'
Warning: Permanently added 'vmi/exercise12-a.namespace-userx' (ED25519) to the list of known hosts.
exit status 28
-
Check that there are two multi-networkpolicies configured on project namespace-userx
oc get multi-networkpolicies.k8s.cni.cncf.io
-
Verify that multi-networkpolicy
deny-by-default
is blocking all connections on namespace-userx
oc get multi-networkpolicies.k8s.cni.cncf.io \
deny-by-default -o yaml
apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
name: deny-by-default
namespace: namespace-userx
spec:
ingress: []
podSelector: {}
policyTypes:
- Ingress
-
Verify that multi-networkpolicy
allow-80-on-exercise12
is allowing only all connections fromexercise12-b
Virtual Machines
oc get multi-networkpolicies.k8s.cni.cncf.io \
allow-80-on-exercise12 -o yaml
apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
name: allow-80-on-exercise12
namespace: namespace-userx
spec:
ingress:
- from:
- podSelector:
matchLabels:
vm.kubevirt.io/name: exercise12-b
ports:
- port: 80
protocol: TCP
podSelector:
matchLabels:
app: exercise12
policyTypes:
- Ingress
-
In this network-policy there’s an error on label used on
podSelector
. The correct label isvm.kubevirt.io/name: exercise12-a
apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
name: allow-80-on-exercise12
namespace: namespace-userx
spec:
ingress:
- from:
- podSelector:
matchLabels:
vm.kubevirt.io/name: exercise12-b <--
ports:
- port: 80
protocol: TCP
podSelector:
matchLabels:
app: exercise12
policyTypes:
- Ingress
-
Edit the multi-networkpolicy and change the label content to
exercise12-a
once the virtual machine exercise12-a is the connection origin.
oc edit multi-networkpolicies.k8s.cni.cncf.io \
allow-80-on-exercise12
-
Try to access the application running on virtual machine exercise12-b using IP and verify that it’s working now.
Do not forget to change the IP to value defined on step 5. |
virtctl ssh lab-user@exercise12-a \
-c 'curl --silent --connect-timeout 3 http://IP'
Warning: Permanently added 'vmi/exercise12-a.namespace-userx' (ED25519) to the list of known hosts.
Hey Hey Hey, it's working!!