Network Interface Isolation

Network interface isolation gives Industrial Edge applications direct access to a network interface inside the application container. When an application claims an isolatable network interface, the Resource Manager moves that interface from the host system into the network namespace of the application container. After that, no other application or host-side process can access the interface or send traffic through it. The interface is no longer visible on the host until the application stops and the system moves the interface back. The Industrial Edge user interface also removes the corresponding interface temporarily from the network settings. Applications can use network interface isolation to implement real-time-capable network stacks such as Profinet or to access a PTP clock that is associated with a network interface. This feature is not limited to real-time applications. You do not need full system tuning or CPU isolation to use it.

To support these scenarios, install the packages in resource-enablement-network.tar.gz. You do not need these packages if applications access general-purpose I/O only. Network interface isolation consists of two parts:

• the network resource plug-in (ie-network-resource-plugin*.deb) for Resource Manager integration and operator-side configuration
• the Docker network plug-in (ie-docker-network-plugin*.deb) so that network claims can be defined in the networks section of Compose manifests

Configuring network interface isolation

Define the device-builder default configuration in /usr/lib/ie-network-resource-plugin/ie-network-resource-plugin.yaml. During operation, changes are written only to /etc/ie-resource-plugins/ie-network-resource-plugin.yaml.

The network isolation plug-in reads the static parameters from the device-builder configuration and the non-static parameters from the user configuration. Users can change only the non-static parameters. The plug-in merges both sets into the effective configuration. After a firmware update, the system keeps the user configuration and merges it with the updated device-builder configuration.

NOTICE

Make sure that /etc/ie-resource-plugins/ is empty before shipping the image.

The following example shows the structure of the configuration files:

networks_isolatable:
  - name: eno2
    annotations:
      - label: mylabel
  - name: eno3
    annotations:
      - label: foo
        vlan: 42
      - label: bar
        vlan: 100
networks_ignore_static:
  - eno1

The networks_isolatable field defines the network interfaces that Industrial Edge applications can claim exclusively. Identify each interface by the network interface name that the host operating system assigns, for example eno2 or eno3. Applications can claim only the interfaces that are listed here. Leave the array empty unless you want to provide default values. Operators can add isolatable interfaces in the Resource Manager user interface. For more information about annotations, see the Get Started & Operate section.

The device-builder-specific network setting is networks_ignore_static. Use it to prevent operators from configuring selected network interfaces as isolatable. Users and operators cannot override this setting. If an interface appears in both networks_isolatable and networks_ignore_static, the system filters it out.

NOTICE

If networks_ignore_static is left empty, users may accidentally isolate all available network interfaces, thus making the device inaccessible. For this reason, it is strongly recommended to define one or more interfaces as non-isolatable, at least on physical (non-virtual) devices. For example, if eno1 is the main interface used for communicating with Industrial Edge Management, specify it in the plug-in's configuration file as shown above. In case of virtual edge devices, naming the main interface upfront without doubt might not be possible, however. When leaving networks_ignore_static empty, there should be a low-effort solution to recover from accidental misconfigurations. For virtual edge devices, make sure that a new virtual network interface can be added temporarily allowing the device administrator to revert a misconfiguration.

Supporting PTP devices

The Precision Time Protocol (PTP) synchronizes clocks between devices. Some network interface cards provide hardware support for PTP. This hardware support is exposed through a PTP device. If an isolated network interface has a PTP device, the system mounts this device into the requesting Docker container as a read-write device.

Setting the Docker root directory

By default, Docker stores most of its data under /var/lib/docker. If you move the Docker root directory, pass the new path to both plug-ins through an environment variable. Set DOCKER_ROOT_DIRECTORY in the following systemd service files:

• /lib/systemd/system/ie-docker-network-plugin.service
• /lib/systemd/system/ie-network-resource-plugin.service