mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
52 lines
1.9 KiB
Plaintext
52 lines
1.9 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * networking/network_security/ebpf_manager/ebpf-manager-operator-about.adoc
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="bpfman-infw-configure_{context}"]
|
|
= Configuring Ingress Node Firewall Operator to use the eBPF Manager Operator
|
|
|
|
The Ingress Node Firewall uses link:https://www.kernel.org/doc/html/latest/bpf/index.html[eBPF] programs to implement some of its key firewall functionality. By default these eBPF programs are loaded into the kernel using a mechanism specific to the Ingress Node Firewall.
|
|
|
|
As a cluster administrator, you can configure the Ingress Node Firewall Operator to use the eBPF Manager Operator for loading and managing these programs instead, adding additional security and observability functionality.
|
|
|
|
.Prerequisites
|
|
|
|
* You have installed the OpenShift CLI (`oc`).
|
|
* You have an account with administrator privileges.
|
|
* You installed the Ingress Node Firewall Operator.
|
|
* You have installed the eBPF Manager Operator.
|
|
|
|
.Procedure
|
|
|
|
. Apply the following labels to the `ingress-node-firewall-system` namespace:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc label namespace openshift-ingress-node-firewall \
|
|
pod-security.kubernetes.io/enforce=privileged \
|
|
pod-security.kubernetes.io/warn=privileged --overwrite
|
|
----
|
|
|
|
. Edit the `IngressNodeFirewallConfig` object named `ingressnodefirewallconfig` and set the `ebpfProgramManagerMode` field:
|
|
+
|
|
.Ingress Node Firewall Operator configuration object
|
|
[source,yaml]
|
|
----
|
|
apiVersion: ingressnodefirewall.openshift.io/v1alpha1
|
|
kind: IngressNodeFirewallConfig
|
|
metadata:
|
|
name: ingressnodefirewallconfig
|
|
namespace: openshift-ingress-node-firewall
|
|
spec:
|
|
nodeSelector:
|
|
node-role.kubernetes.io/worker: ""
|
|
ebpfProgramManagerMode: <ebpf_mode>
|
|
----
|
|
+
|
|
--
|
|
where:
|
|
|
|
`<ebpf_mode>`: Specifies whether or not the Ingress Node Firewall Operator uses the eBPF Manager Operator to manage eBPF programs. Must be either `true` or `false`. If unset, eBPF Manager is not used.
|
|
--
|