IBM Cloud networking and infrastructure

Physical structure

The physical infrastructure required to deploy a Red Hat® OpenShift® production instance onto a VMware Cloud Foundation for Classic - Automated cluster requires the following minimum specification.

In addition to the Red Hat OpenShift hardware requirements, you must create persistent volumes in the Red Hat OpenShift environment to store images from the container register or customer workloads.

Virtual structure

Within the VCF for Classic - Automated instance, the Red Hat OpenShift instance is deployed with a dedicated NSX® Edge Services Gateway (ESG) and Distributed Logical Router (DLR). The Red Hat OpenShift installation is loaded into the VXLAN subnet that is defined in the previous components.

The ESG is configured with a source NAT rule (SNAT) to allow outbound traffic, which enables internet connectivity to download the Red Hat OpenShift prerequisites and to connect to GitHub and Red Hat®. Alternatively, you can use a web-proxy for internet connectivity. The ESG is also configured to provide access to DNS and NTP services within the IBM Cloud® environment.

The ESG is also configured to use the load balancer capability, thus reducing the need for HAProxy nodes. The load balancers are configured for the apps wildcard DNS URL and the API / API-INT DNS Records. The apps DNS record load balancers to the worker nodes provisioned, while the api and api-int DNS records are load balanced against the control-plane nodes.

Red Hat OpenShift 4.1 installation on the VMware platform requires a capability to download their ignition files to install and configure the RHCOS bootstrap / control-plane and worker nodes. The ESG is configured to provide DHCP and DHCP relay services for the Red Hat OpenShift logical switch / VXLAN defined.

NSX Edge specifications

The first component that is configured within the VCF for Classic - Automated with Red Hat OpenShift is a pair of NSX Edge virtual machines. The NSX Edge virtual machines are configured as an active-passive pair of X-Large NSX Edge devices.

The Quad-Large NSX Edge was chosen and as part of the configuration process, the NSX Edge is connected to the IBM Cloud public and private VLAN.

Because the NSX Edges are configured as active/passive in either the internal or dedicated deployment, vSphere® Distributed Resource Scheduler (DRS) anti-affinity rules must be created by the user to ensure that NSX Edges do not run on the same host as their respective peer appliance.

NSX Load Balancer specifications

Within the Red Hat OpenShift environment, two load balancers for accessing the control plane nodes and the worker nodes are required. The NSX Edge is enabled to use load balancing and is configured with application profiles that use a certificate for inbound connection from the source. The NSX Edge is also configured with load-balancing pools to point to the Red Hat OpenShift Primaries and Red Hat OpenShift Workers. Additionally, a virtual server is created with a virtual IP address (vIP) on the private interface with rules that connect the pools with vIP.

Red Hat OpenShift specifications

The following tables show the specifications of the management node, control plane node, and worker node.

Related links

• VCF for Classic and Red Hat OpenShift architecture overview
• System context for VCF for Classic and Red Hat OpenShift architecture
• Red Hat OpenShift architecture
• IBM Cloud for VMware Solutions SDDC architecture