Egress IP validator

In a loop, this application send requests to the external server EXT_SERVER_HOST on port EXT_SERVER_PORT and validates if EGRESS_IP_ADDRESS is part of the response data. It updates the metrics based on this validation.

Metrics

Application exposes the following metrics which can be viewed in OCP console

• "scale_eip_startup_latency_total" Time it takes in seconds for a connection to have a source IP of EgressIP at startup with polling interval of DELAY_BETWEEN_REQ_SEC seconds, where X is defined as an env var in k8s.yaml
• "scale_eip_recovery_latency" Time it takes in seconds for a connection to recover from failure with polling interval of DELAY_BETWEEN_REQ_SEC seconds
• "scale_eip_total" Increments every time EgressIP seen as source IP in the loop validation
• "scale_non_eip_total" Increments every time EgressIP not seen as source IP in the loop validation
• "scale_failure_total" Increments every time there a connection failure (not status 200) in the loop validation
• "scale_startup_non_eip_total" During startup, increments every time EgressIP not seen as source IP in the loop validation

Testing the App

In order to test the application on k8s cluster,

1. create an external node with the subnet used for OCP cluster node's primary interface. Set EXT_SERVER_HOST to this external node's IP
2. Spawn an nginx server in external node using nginx.conf.template in this repo. Configure this nginx server with port 9002 and set EXT_SERVER_PORT=9002 This is customized nginx server which adds request's sources IP to response data field.
3. Set EGRESS_IP_ADDRESS to a free IP from OCP cluster node's primary interface subnet

Once you create external nginx server and exported the environment variables, run deploy/k8.yaml to create resources and validate egress IP

# export EXT_SERVER_HOST=10.0.33.143; export EXT_SERVER_PORT=9002; export EGRESS_IP_ADDRESS=10.0.0.5; envsubst < deploy/k8.yaml | oc apply -f -
namespace/monitor-eip created
role.rbac.authorization.k8s.io/prometheus-k8s created
rolebinding.rbac.authorization.k8s.io/prometheus-k8s created
podmonitor.monitoring.coreos.com/pod-monitor created
egressip.k8s.ovn.org/egressip-obj created
pod/eip-monitor created
# oc rsh -n monitor-eip eip-monitor
$ curl 10.0.33.143:9002
10.0.0.5$ 
$ exit

k8s.yaml creates a

1. namespace, RBAC and a PodMonitor. This is required to consume the metrics generated by the following workload.
2. egress IP and pod with this application. Application connects to provided target external server which reports the source IP seen. The pod will poll the target contineously until an EgressIP is seen. It also records the number of times a non-Egress IP is seen.