diff --git a/static/img/kubeovnDNATFlow.mermaid b/static/img/kubeovnDNATFlow.mermaid new file mode 100644 index 0000000000..1e7f6ac92e --- /dev/null +++ b/static/img/kubeovnDNATFlow.mermaid @@ -0,0 +1,74 @@ +--- +title: DNAT flow — external to VM (inbound) +config: + theme: base + securityLevel: loose + themeVariables: + fontFamily: 'SUSE, Verdana, sans-serif' + fontSize: '14px' + primaryColor: '#0ca678' + primaryTextColor: '#092a1d' + primaryBorderColor: '#0ca678' + lineColor: '#212529' + secondaryColor: '#1c7ed6' + tertiaryColor: '#e6fcf5' + mainBkg: '#ffffff' + nodeBorder: '#212529' + clusterBkg: '#f8f9fa' + clusterBorder: '#adb5bd' + titleColor: '#092a1d' + edgeLabelBackground: '#ffffff' + themeCSS: | + * { font-family: 'SUSE', Verdana, sans-serif; } + code, code * { font-family: 'SUSE Mono', 'Roboto Mono', monospace; font-weight: 500; font-size: 0.92em; } + flowchart: + rankSpacing: 70 + nodeSpacing: 50 + subGraphTitleMargin: + top: 6 + bottom: 14 +--- +flowchart TD + classDef default fill:#ffffff,stroke:#212529,stroke-width:1px,color:#212529; + classDef overlay fill:#e6fcf5,stroke:#0ca678,stroke-width:2.5px,color:#092a1d; + classDef nat fill:#f3f0ff,stroke:#7048e8,stroke-width:2.5px,color:#3b0764; + classDef ext fill:#e7f5ff,stroke:#1c7ed6,stroke-width:2.5px,color:#0b2e5c; + classDef inet fill:#f8f9fa,stroke:#868e96,stroke-width:2px,color:#212529; + classDef annot fill:#f8f9fa,stroke:#adb5bd,stroke-width:1.5px,stroke-dasharray: 4 3,color:#495057; + classDef netVpc fill:#ffffff,stroke:#0ca678,stroke-width:2px,stroke-dasharray: 6 4,color:#092a1d; + classDef netExt fill:#ffffff,stroke:#1c7ed6,stroke-width:2px,stroke-dasharray: 6 4,color:#0b2e5c; + + INET["External client
curl 10.115.8.7:8888"]:::inet + + subgraph EXT ["External subnet / provider network (eno50 — VLAN 2012)"] + direction LR + UGW["Upstream gateway
10.115.15.254"]:::ext + ESUB["External subnet
subnetexternal 10.115.8.0/21
EIP 10.115.8.7 on net2"]:::ext + UGW -->|"② routed in"| ESUB + end + + subgraph VPC ["Custom VPC: commonvpc"] + direction TB + NATGW["VPC NAT gateway pod
(vpc-nat-gw-gw1-0)
net2: 10.115.8.3 (external)
PREROUTING → DNAT_FILTER"]:::nat + LS["OVN logical switch
subnetinternal 172.20.10.0/24"]:::overlay + VM["VM (nginx)
172.20.10.8:80"]:::overlay + NATGW ==>|"④ DNAT: dst 10.115.8.7:8888 → 172.20.10.8:80"| LS + LS -->|"⑤ forwarded via net1
172.20.10.254"| VM + end + + IPT["iptables DNAT rule (inside nat gw pod):
-A DNAT_FILTER -d 10.115.8.7 -p tcp --dport 8888
-j DNAT --to-destination 172.20.10.8:80"]:::annot + + INET -->|"① dst 10.115.8.7:8888"| UGW + ESUB -->|"③ arrives on net2 (10.115.8.3)"| NATGW + NATGW -.->|"implements"| IPT + + class VPC netVpc; + class EXT netExt; + + %% edge colours: 0 UGW-ESUB, 1 NATGW-LS(DNAT), 2 LS-VM, 3 INET-UGW, 4 ESUB-NATGW, 5 NATGW-IPT + linkStyle 0 stroke:#1c7ed6,stroke-width:2px; + linkStyle 1 stroke:#7048e8,stroke-width:3px; + linkStyle 2 stroke:#0ca678,stroke-width:2px; + linkStyle 3 stroke:#1c7ed6,stroke-width:2px; + linkStyle 4 stroke:#1c7ed6,stroke-width:2px; + linkStyle 5 stroke:#adb5bd,stroke-width:1.5px; diff --git a/static/img/kubeovnDNATFlow.png b/static/img/kubeovnDNATFlow.png index e6983bd136..44dae04c56 100644 Binary files a/static/img/kubeovnDNATFlow.png and b/static/img/kubeovnDNATFlow.png differ diff --git a/static/img/kubeovnSNATFlow.mermaid b/static/img/kubeovnSNATFlow.mermaid new file mode 100644 index 0000000000..bb15dc5eaf --- /dev/null +++ b/static/img/kubeovnSNATFlow.mermaid @@ -0,0 +1,73 @@ +--- +title: SNAT flow — VM to internet (outbound) +config: + theme: base + securityLevel: loose + themeVariables: + fontFamily: 'SUSE, Verdana, sans-serif' + fontSize: '14px' + primaryColor: '#0ca678' + primaryTextColor: '#092a1d' + primaryBorderColor: '#0ca678' + lineColor: '#212529' + secondaryColor: '#1c7ed6' + tertiaryColor: '#e6fcf5' + mainBkg: '#ffffff' + nodeBorder: '#212529' + clusterBkg: '#f8f9fa' + clusterBorder: '#adb5bd' + titleColor: '#092a1d' + edgeLabelBackground: '#ffffff' + themeCSS: | + * { font-family: 'SUSE', Verdana, sans-serif; } + code, code * { font-family: 'SUSE Mono', 'Roboto Mono', monospace; font-weight: 500; font-size: 0.92em; } + flowchart: + rankSpacing: 70 + nodeSpacing: 50 + subGraphTitleMargin: + top: 6 + bottom: 14 +--- +flowchart TD + classDef default fill:#ffffff,stroke:#212529,stroke-width:1px,color:#212529; + classDef overlay fill:#e6fcf5,stroke:#0ca678,stroke-width:2.5px,color:#092a1d; + classDef nat fill:#f3f0ff,stroke:#7048e8,stroke-width:2.5px,color:#3b0764; + classDef ext fill:#e7f5ff,stroke:#1c7ed6,stroke-width:2.5px,color:#0b2e5c; + classDef inet fill:#f8f9fa,stroke:#868e96,stroke-width:2px,color:#212529; + classDef annot fill:#f8f9fa,stroke:#adb5bd,stroke-width:1.5px,stroke-dasharray: 4 3,color:#495057; + classDef netVpc fill:#ffffff,stroke:#0ca678,stroke-width:2px,stroke-dasharray: 6 4,color:#092a1d; + classDef netExt fill:#ffffff,stroke:#1c7ed6,stroke-width:2px,stroke-dasharray: 6 4,color:#0b2e5c; + + subgraph VPC ["Custom VPC: commonvpc"] + direction TB + VM["VM (guest OS)
172.20.10.x/24"]:::overlay + LS["OVN logical switch
subnetinternal 172.20.10.0/24"]:::overlay + NATGW["VPC NAT gateway pod
(vpc-nat-gw-gw1-0)
net1: 172.20.10.254 (internal)
net2: 10.115.8.3 / 10.115.8.7 (external)"]:::nat + VM ---|"① default GW
172.20.10.254"| LS + LS -->|"② → net1 (172.20.10.254)"| NATGW + end + + subgraph EXT ["External subnet / provider network (eno50 — VLAN 2017)"] + direction LR + ESUB["External subnet
subnetexternal 10.115.8.0/21"]:::ext + UGW["Upstream gateway
10.115.15.254"]:::ext + ESUB -->|"④ src IP: 10.115.8.7"| UGW + end + + INET["Internet / external host
e.g. 8.8.8.8"]:::inet + IPT["iptables SNAT rule (inside nat gw pod):
-A SHARED_SNAT -s 172.20.10.0/24 -o net2
-j SNAT --to-source 10.115.8.7"]:::annot + + NATGW ==>|"③ SNAT: src 172.20.10.x → 10.115.8.7"| ESUB + UGW -->|"⑤ routed out"| INET + NATGW -.->|"implements"| IPT + + class VPC netVpc; + class EXT netExt; + + %% edge colours: 0 VM-LS, 1 LS-NATGW, 2 ESUB-UGW, 3 NATGW-ESUB(SNAT), 4 UGW-INET, 5 NATGW-IPT + linkStyle 0 stroke:#0ca678,stroke-width:2px; + linkStyle 1 stroke:#0ca678,stroke-width:2px; + linkStyle 2 stroke:#1c7ed6,stroke-width:2px; + linkStyle 3 stroke:#7048e8,stroke-width:3px; + linkStyle 4 stroke:#1c7ed6,stroke-width:2px; + linkStyle 5 stroke:#adb5bd,stroke-width:1.5px; diff --git a/static/img/kubeovnSNATFlow.png b/static/img/kubeovnSNATFlow.png index 5b8f285669..b80400447b 100644 Binary files a/static/img/kubeovnSNATFlow.png and b/static/img/kubeovnSNATFlow.png differ