Enabling VM communication - Part 3

Scenario

The virtual machines exercise12-a and exercise12-b are operational with their IP addresses properly configured. However, the virtual machine exercise12-a is unable to access the application running on port 80 on exercise12-b.

Your task is to identify and troubleshoot the issue preventing communication between the VMs. Resolve it to restore connectivity.

The steps to fix exercise12 are:

Console

{openshift_console_url}

Username

userx

Password

{password}

Go to virtualization → Virtual Machines - select project for the assigned user account

Verify the exercise-12-a virtual machine IP address

Verify the exercise-12-b virtual machine IP address

On Virtualization → Virtual Machines menu, click on exercise12-a virtual machine and open it’s Console Test the communication is not working on exercise12-b IP on port 80

On left side menu, click on Networking → MultiNetworkPolicies

Click on deny-by-default MultiNetworkPolicy and check it’s YAML.

On left side menu, click on Networking → MultiNetworkPolicies and click on allow-80-on-exercise12 and check it’s YAML. Verify that the label on from is configured as exercise12-b virtual machine

Change it to exercise12-a label and click Save.

Test the connection from exercise12-a virtual machine Console and it’s working now.

Run grade to validate the exercise

lab grade exercise12

Command line (CLI)

OpenShift login command

{login_command}

Go to the assigned namespace-userx

oc project namespace-userx

List the virtual machines

oc get virtualmachine

Getting the exercise12-a IP address

oc get vmi exercise12-a -n namespace-userx \
-o jsonpath='{.status.interfaces[1].ipAddress}'

Getting the exercise12-b IP address

oc get vmi exercise12-b -n namespace-userx \
-o jsonpath='{.status.interfaces[1].ipAddress}'

Try to access the application running on virtual machine exercise12-b using IP and verify that it’s not working.

Do not forget to change the IP to value defined on step 5.

virtctl ssh lab-user@exercise12-a \
-c 'curl --silent --connect-timeout 3 http://IP'

Warning: Permanently added 'vmi/exercise12-a.namespace-userx' (ED25519) to the list of known hosts.
exit status 28

Check that there are two multi-networkpolicies configured on project namespace-userx

oc get multi-networkpolicies.k8s.cni.cncf.io

Verify that multi-networkpolicy deny-by-default is blocking all connections on namespace-userx

oc get multi-networkpolicies.k8s.cni.cncf.io \
deny-by-default -o yaml

apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
  name: deny-by-default
  namespace: namespace-userx
spec:
  ingress: []
  podSelector: {}
  policyTypes:
  - Ingress

Verify that multi-networkpolicy deny-by-default is blocking all connections on namespace-userx

oc get multi-networkpolicies.k8s.cni.cncf.io \
allow-80-on-exercise12 -o yaml

apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
  name: allow-80-on-exercise12
  namespace: namespace-userx
spec:
  ingress:
  - from:
    - podSelector:
        matchLabels:
          vm.kubevirt.io/name: exercise12-b
    ports:
    - port: 80
      protocol: TCP
  podSelector:
    matchLabels:
      app: exercise12
  policyTypes:
  - Ingress

In this network-policy there’s an error on label used on podSelector. The correct label is vm.kubevirt.io/name: exercise12-a

apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
  name: allow-80-on-exercise12
  namespace: namespace-userx
spec:
  ingress:
  - from:
    - podSelector:
        matchLabels:
          vm.kubevirt.io/name: exercise12-b   <--
    ports:
    - port: 80
      protocol: TCP
  podSelector:
    matchLabels:
      app: exercise12
  policyTypes:
  - Ingress

Edit the multi-networkpolicy and change the label content to exercise12-a once the virtual machine exercise12-a is the connection origin.

oc edit multi-networkpolicies.k8s.cni.cncf.io \
allow-80-on-exercise12

Try to access the application running on virtual machine exercise12-b using IP and verify that it’s working now.

Do not forget to change the IP to value defined on step 5.

virtctl ssh lab-user@exercise12-a \
-c 'curl --silent --connect-timeout 3 http://IP'

Warning: Permanently added 'vmi/exercise12-a.namespace-userx' (ED25519) to the list of known hosts.
Hey Hey Hey, it's working!!

What you learned

In this exercise, you learned that a MultiNetworkPolicy custom resource definition is used to restrict communication between two virtual machines connected with a secondary network attached.