Shared Interface Setup

Overview

In a shared layout, each machine has a single network: the cluster’s own traffic and client traffic both use the interface holding the default route. This is the simplest layout, for machines with one network interface.

Security note: Cluster traffic shares the public network, so it is not isolated from clients. For production, a segregated backplane is recommended.

Configuration

Leave backplane_network empty in /etc/acd/deploy/group_vars/all.yaml. This is the default:

backplane_network: ""

Each machine’s cluster address is then its public address. The machines may be on one subnet or on routed subnets, as long as each can reach the others’ addresses.

What deploy Sets Up

On each machine, with manage_firewall: true:

• The public interface is placed in firewalld’s public zone, with the ports clients need opened through the acd-public policy.
• The other machines’ addresses, and the pod and service networks, are trusted in the acd-cluster zone, which accepts all traffic. Hosts other than the cluster machines get only the ports open in public.
• Routing rules keep traffic to the pod and service networks, and to the machine’s own subnet, on the main routing table. If your machines are on different subnets and use policy routing, make sure traffic to the other machines’ subnets also uses the main table.

Verification

After deploy, on any machine:

firewall-cmd --get-active-zones
firewall-cmd --zone=acd-cluster --list-sources

The acd-cluster zone lists the pod and service networks (10.42.0.0/16 and 10.43.0.0/16 by default) and the other cluster machines’ addresses, and the public interface is in the public zone.

For the ports the cluster uses, and for managing the firewall yourself, see the Networking Guide.