Chapter 2. Configuring private connections

Procedure

1. Log in to the Web Console for the Red Hat OpenShift Service on AWS AWS Account and navigate to the VPC Dashboard in the region where the cluster is being hosted.
2. Go to the Peering Connections page and click the Create Peering Connection button.

3. Verify the details of the account you are logged in to and the details of the account and VPC you are connecting to:

   1. Peering connection name tag: Set a descriptive name for the VPC Peering Connection.
   2. VPC (Requester): Select the Red Hat OpenShift Service on AWS Cluster VPC ID from the list.
   3. Account: Select Another account and provide the Customer AWS Account number (without dashes).
   4. Region: If the Customer VPC Region differs from the current region, select Another Region and select the customer VPC Region from the list.
   5. VPC (Accepter): Set the Customer VPC ID.
4. Click Create Peering Connection.
5. Confirm that the request enters a Pending state. If it enters a Failed state, confirm the details and repeat the process.

Procedure

1. Log in to the AWS Web Console.
2. Navigate to VPC Service.
3. Go to Peering Connections.
4. Click Pending peering connection.
5. Confirm the AWS Account and VPC ID that the request originated from. This should be from the Red Hat OpenShift Service on AWS AWS Account and Red Hat OpenShift Service on AWS Cluster VPC.
6. Click Accept Request.

Procedure

1. Log in to the AWS Web Console for the Red Hat OpenShift Service on AWS AWS Account.
2. Navigate to the VPC Service, then Route tables.

3. Select the Route Table for the Red Hat OpenShift Service on AWS Cluster VPC.

   Note

   On some clusters, there may be more than one route table for a particular VPC. Select the private one that has several explicitly associated subnets.

4. Select the Routes tab, then Edit.
5. Enter the Customer VPC CIDR block in the Destination text box.
6. Enter the Peering Connection ID in the Target text box.
7. Click Save.

8. You must complete the same process with the other VPC’s CIDR block:

   1. Log into the Customer AWS Web Console VPC Service Route Tables.
   2. Select the Route Table for your VPC.
   3. Select the Routes tab, then Edit.
   4. Enter the Red Hat OpenShift Service on AWS Cluster VPC CIDR block in the Destination text box.
   5. Enter the Peering Connection ID in the Target text box.
   6. Click Save changes.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard, and navigate to the VPC Dashboard.
2. Under Virtual private cloud click Your VPCs and identify the name and VPC ID for the VPC containing the Red Hat OpenShift Service on AWS cluster.
3. Under Virtual private network (VPN) click Customer gateways.
4. Click Create customer gateway and give it a meaningful name.
5. Enter the ASN of your customer gateway device in the BGP ASN field.
6. In the IP address field, enter the IP address of an external interface for your customer gateway devices.
7. Click Create customer gateway.

8. If you do not already have a Virtual Private Gateway attached to the intended VPC:

   1. From the VPC Dashboard, click Virtual Private Gateways.
   2. Click Create virtual private gateway, give it a meaningful name.
   3. Click Create virtual private gateway, leaving the Amazon default ASN.
   4. Select the newly created gateway.
   5. Select Actions from the list and click Attach to VPC.
   6. Select the newly created gateway under Available VPC’s and click Attach to VPC to attach it to the cluster VPC you identified earlier.

Procedure

1. From the VPC dashboard, under Virtual private network (VPN) click Site-to-Site VPN connections.

2. Click Create VPN connection.

   1. Give it a meaningful name tag.
   2. Select the Virtual private gateway created previously.
   3. For Customer gateway, select Existing.
   4. Select the Customer gateway ID by name.
   5. If the VPN uses the Border Gateway Protocol (BGP), select Dynamic, otherwise select Static and enter the Static IP Classless Inter-Domain Routings (CIDRs). If there are multiple CIDRs, add each CIDR as Another Rule.
   6. Click Create VPN connection.
   7. Under State wait for the VPN status to change from Pending to Available, approximately 5 to 10 minutes.

3. Select the VPN you just created and click Download configuration.

   1. From the list, select the vendor, platform, and version of the customer gateway device, then click Download.

   2. The Generic vendor configuration is also available for retrieving information in a plain text format.

      Note

      After the VPN connection has been established, set up Route Propagation or the VPN might not function as expected. Note the VPC subnet information, which you must add to your configuration as the remote network.

4. From the VPC Dashboard, under Virtual private cloud, click on Route tables.

5. Select the private Route table associated with the VPC that contains your Red Hat OpenShift Service on AWS cluster.

   Note

   On some clusters, there may be more than one route table for a particular VPC. Select the private one that has several explicitly associated subnets.

6. Click on the Route Propagation tab.

7. In the table that shows, you see the Virtual Private Gateway you created. Check the value in the Propagate column.

   1. If Propagation is set to No, click Edit route propagation, and check the Enable checkbox in Propagation.

   2. Click Save.

      After you configure your VPN tunnel and AWS detects it as Up, your static or BGP routes are automatically added to the route table.

Procedure

1. Verify the tunnel is up in AWS.

   1. From the VPC Dashboard, under Virtual private network (VPN), click on Site-to-Site VPN connections.
   2. Select the VPN connection you created previously and click the Tunnel details tab.
   3. You should see that at least one of the VPN tunnels is in an Up status.

2. Verify the connection.

   To test network connectivity to an endpoint device, nc (or netcat) is a helpful troubleshooting tool. It is included in the default image and provides quick and clear output if a connection can be established:

   1. Create a temporary pod using the busybox image, which cleans up after itself:

      $ oc run netcat-test \
          --image=busybox -i -t \
          --restart=Never --rm \
          -- /bin/sh

   2. Check the connection using nc.

      • Example successful connection results:

        / nc -zvv 192.168.1.1 8080
        10.181.3.180 (10.181.3.180:8080) open
        sent 0, rcvd 0

      • Example failed connection results:

        / nc -zvv 192.168.1.2 8080
        nc: 10.181.3.180 (10.181.3.180:8081): Connection refused
        sent 0, rcvd 0

   3. Exit the container, which automatically deletes the Pod:

      / exit

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. Select Direct Connect from the Services menu.
3. There will be one or more Virtual Interfaces waiting to be accepted, select one of them to view the Summary.
4. View the Virtual Interface type: private or public.
5. Record the Amazon side ASN value.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the AWS region, select VPC from the Services menu.
3. From Virtual private network (VPN), select Virtual private gateways.
4. Click Create virtual private gateway.
5. Give the Virtual Private Gateway a suitable name.
6. Select Custom ASN in the Enter custom ASN field.
7. Enter the Amazon side ASN value gathered previously.
8. Click Create virtual private gateway.
9. Click the newly created Virtual Private Gateway and choose Attach to VPC from the Actions tab.
10. Select the Red Hat OpenShift Service on AWS Cluster VPC from the list, and click Attach VPC.

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
3. Select one of the Direct Connect Virtual Interfaces from the list.
4. Check the Interface State has become Available.
5. Check the Interface BGP Status has become Up.

6. Repeat this verification for any remaining Direct Connect Interfaces.

   After the Direct Connect Virtual Interfaces are available, you can log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and download the Direct Connect configuration file for configuration on your side.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
3. Select Direct Connect gateways and Create Direct Connect gateway.
4. Give the Direct Connect gateway a suitable name.
5. In the Amazon side ASN, enter the Amazon side ASN value gathered previously.
6. Click Create the Direct Connect gateway.

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
3. Select one of the Direct Connect Virtual Interfaces from the list.
4. Check the Interface State has become Available.
5. Check the Interface BGP Status has become Up.

6. Repeat this verification for any remaining Direct Connect Interfaces.

   After the Direct Connect Virtual Interfaces are available, you can log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and download the Direct Connect configuration file for configuration on your side.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select VPC from the Services menu.
3. From Virtual private network (VPN), select Virtual private gateways.
4. Select Create virtual private gateway.
5. Give the virtual private gateway a suitable name in the Details field.
6. Click Custom ASN and enter the Amazon side ASN value gathered previously or use the Amazon Provided ASN.
7. Click Create virtual private gateway.

Procedure

1. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
2. Click virtual private gateways and select the virtual private gateway.
3. Click View details.
4. Click the Direct Connect gateway associations tab.
5. Click Associate Direct Connect gateway
6. Under Association account type, for Account owner, click Another account.
7. Under Association settings, for Direct Connect gateway ID, enter the ID of the Direct Connect gateway.
8. For Direct Connect gateway owner, enter the ID of the AWS account that owns the Direct Connect gateway.
9. Optional: Add prefixes to Allowed prefixes, separating them using commas or put them on separate lines.
10. Click Associate Direct Connect gateway.