Configure Allowed Address Pairs

Release: CN2 23.3

date_range 20-Oct-23

arrow_backward

arrow_forward

Starting in CN2 Release 22.1 or later, Juniper Networks supports allowed address pairs (AAPs). Allowed address pairs enables you to add IP/MAC (CIDR) addresses to the guest interface (VirtualMachineInterface) by using a secondary IP address.

When you create a pod in a cluster, each pod automatically obtains its IP address from the virtual machine (VM) interface. If your pod is not on the same virtual network, you can add an AAP to allow traffic to flow through the port regardless of the subnet. For example, let's say that your pod's IP address is 192.168.2.0. If you define an AAP with subnet 192.168.2.0/24, the AAP allows the pods to communicate with the guest interface. The vRouter then forwards the traffic and advertises reachability to the pod.

To configure an allowed address pair, insert the following attributes into your pod YAML file. For example:

content_copy zoom_out_map
kind: Pod
metadata:
  name: my-pod
  namespace: my-namespace
  annotations:
    k8s.v1.cni.cncf.op/networks: |
      [
        {
          "name": "net-a",
          "cni-args": {
              "net.juniper.contrail.allowedAddressPairs": [{
                "ip": 192.168.2.0/24
                "mac": "02:3f:66:ad:00:e9",
                "addressMode": "active-active"
              }],}
          ...
        },
        {
          "name": "net-b",
          ...
        },

The AllowedAddressPairs attribute contains a list of allowed address pair definitions, as described in the following table:

Table 1: **Allowed Address Pair Definitions**
Definition	Description
ip	Specify the external pod IP address through which you want to allow traffic to pass.
mac	(Optional) Specify the MAC address of the external pod.
addressMode	(Optional) Specify a high availability (HA) address mode. Choose from active/active or active/standby. Active/standby is the default. The addressMode default value is an empty string. Active/standby is used for VRRP addresses. Active/active is used for ECMP.

In Kubemanager, the PodController watches for Pod events and reads the interface definitions for each new AAP. The controller then generates an AllowedAddressPair and adds it to the list of interfaces in the VirtualMachineInterface.

Alternative Configuration

Alternatively, you can configure AAP interfaces directly from the VirtualMachineInterface. For example:

content_copy zoom_out_map
kubectl patch --namespace project-kubemanager VirtualMachineInterface $VMINAME -p "$(cat ./aap.yaml)"

The preceding command updates the existing VirtualMachineInterface with the AAP configuration, as follows:

content_copy zoom_out_map
spec:
  allowedAddressPairs:
    allowedAddressPair:
      - ip:
          ipPrefix: 192.0.2.0          
          ipPrefixLen: 24

arrow_backward PREVIOUS Create an Isolated Namespace

NEXT arrow_forward Enable Packet-Based Forwarding on Virtual Interfaces

Cloud-Native Contrail Networking Feature Guide

Configure Allowed Address Pairs

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry