Skip to content

Latest commit

 

History

History
29 lines (18 loc) · 1.14 KB

k8s-best-practices-operations-that-can-not-be-executed-by-openshift.adoc

File metadata and controls

29 lines (18 loc) · 1.14 KB

Operations that can not be executed by OpenShift

All the CNI plugins are only invoked during pod creation and deletion. If your workload needs perform any operations mentioned above at runtime, the NET_ADMIN capability is required.

There are some other functionalities that are not currently supported by any of the OpenShift components which also require NET_ADMIN capability:

  • Link state modification at runtime

  • IP/MAC modification at runtime

  • Manipulate pod’s route table or firewall rules at runtime

  • SR/IOV VF setting at runtime

  • Netlink configuration

  • For example, ethtool can be used to configure things like rxvlan, txvlan, gso, tso, etc.

  • Multicast

    Note

    If your application works as a receiving member of IGMP groups, you need to specify the NET_ADMIN capability in the pod manifest. So that the app is allowed to assign multicast addresses to the pod interface and join an IGMP group.

  • Set SO_PRIORITY to a socket to manipulate the 802.1p priority in ethernet frames

  • Set IP_TOS to a socket to manipulate the DSCP value of IP packets