Subnets: console walkthrough¶
The same operations as the step-by-step guide, done in the console.
There is a guided tour on the page itself
Click Guide me beside the create button for a walkthrough that highlights each field as you go.
List¶
Networking > Subnets lists the subnets on the cluster.
The Type column says whether a subnet is Public or Private, worked out from whether a route advertisement exists for it. On a public subnet the value is a link to that advertisement.
Use this list before creating anything: it shows every range already claimed, which is what you need to pick a free one.
The project selector does not affect this page
Create Subnet is available whatever the selector reads, All Projects included. The form creates a project of its own rather than using the selected one.
Create¶
Create Subnet opens a guided form that creates the project, the network and your access to it together.
- Subnet name - also the name of the project that gets created, so it must not clash with an existing project. The form tells you if it does.
- Type - Private by default. Public is what makes the range reachable from outside the cluster.
- Subnet (CIDR) - the address range.
For a public subnet the range comes out of the platform's public pool, with a prefix
of /28 or /29. The pool is small and shared.
The first two usable addresses go to the platform automatically - the gateway and the node
management port - so a /29 gives four usable addresses, not six. Neither has a field.
A Summary appears once the range is valid. Read it before submitting.
What happens on save¶
The form works through three steps and shows its progress: it creates the project, waits for the network, then grants you admin access. Only the first is done by the form - the project carries your answers as annotations and the platform builds the rest from them. It usually takes a few seconds.
A rejected range is the common failure, and it is recoverable
An overlapping or out-of-pool range is rejected by the cluster policy on submit. The message is shown verbatim, and Back to form returns you to the form with your values still filled in so you can correct the range.
Retry alone will not help - the same range fails the same way every time.
Change¶
A subnet's range cannot be changed after creation, and the console offers no edit form.
To make a private subnet public, or the reverse, add or remove its route advertisement - see Change.
Delete¶
Delete on the subnet's row removes all three. The dialog lists what goes with it: the project and everything in it, and the route advertisement on a public subnet.
Delete the subnet, not the project
Deleting the project from the Projects page instead leaves it terminating forever - it
holds a network attachment whose finalizer is only released when the network is deleted.
Use Delete here, or oc delete clusteruserdefinednetworks.k8s.ovn.org <subnet>.
Deleting the subnet deletes the workloads in its project.
Where the console differs from the CLI¶
| Console | oc |
|
|---|---|---|
| What gets created | Project, network, role binding, advertisement - in one step | Same - you create the annotated project |
| Free ranges | Visible in the list you came from | oc get clusteruserdefinednetworks |
| Rejected range | Shown on the form, values kept | An error from oc apply |
| Deleting | Delete on the row removes all three | oc delete clusteruserdefinednetworks.k8s.ovn.org does the same |