Networking

DNS configuration details

General DNS setup

The OpenShift Container Platform cluster managed by CRC uses 2 DNS domain names, crc.testing and apps-crc.testing. The crc.testing domain is for core OpenShift Container Platform services. The apps-crc.testing domain is for accessing OpenShift applications deployed on the cluster.

For example, the OpenShift Container Platform API server is exposed as api.crc.testing while the OpenShift Container Platform console is accessed as console-openshift-console.apps-crc.testing. These DNS domains are served by a dnsmasq DNS container running inside the CRC instance.

The crc setup command detects and adjusts your system DNS configuration so that it can resolve these domains. Additional checks are done to verify DNS is properly configured when running crc start.

CRC uses gvisor-tap-vsock to provide user-mode networking on all platforms by default.

Reserved IP subnets

The OpenShift Container Platform cluster managed by CRC reserves IP subnets for internal use, which should not collide with your host network. Ensure that the following IP subnets are available for use:

Reserved IP subnets

10.217.0.0/22
10.217.4.0/23
192.168.126.0/24

Starting CRC behind a proxy

You can start CRC behind a defined proxy using environment variables or configurable properties.

SOCKS proxies are not supported by OpenShift Container Platform.

Prerequisites

If you are not using crc oc-env, when interacting with the cluster, export the .testing domain as part of the no_proxy environment variable. The embedded oc executable does not require manual settings. For more information about using the embedded oc executable, see Accessing the OpenShift cluster with the OpenShift CLI.

Procedure

Define a proxy using the http_proxy and https_proxy environment variables or using the crc config set command as follows:

$ crc config set http-proxy http://proxy.example.com:<port>
$ crc config set https-proxy http://proxy.example.com:<port>
$ crc config set no-proxy <comma-separated-no-proxy-entries>

If the proxy uses a custom CA certificate file, set it as follows:
```
$ crc config set proxy-ca-file <path-to-custom-ca-file>
```

Proxy-related values set in the configuration for CRC have priority over values set with environment variables.

Accessing services running on your host from CRC

When you run services on your host, you can configure CRC to access these services.

Prerequisites

You have a service which is running on your host and want to consume it with CRC.

Procedure

Enable accessing services from host to CRC:
```
$ crc config set host-network-access true
```
Verify that the CRC configuration uses user network mode and enables host network access:
```
$ crc config view
[...]
- host-network-access                   : true
[...]
```
If CRC instance is already running then restart it (stop ⇒ start), otherwise just start it.
```
$ crc stop && crc start
```

Verification

Assuming your service is running on the host on port 8080, to access it from the CRC instance, use host.crc.testing:8080.

Setting up CRC on a remote server

Configure a remote server to run an OpenShift Container Platform cluster provided by CRC.

This procedure assumes the use of a Red Hat Enterprise Linux, Fedora, or CentOS server. Run every command in this procedure on the remote server.

Perform this procedure only on a local network. Exposing an insecure server on the internet has many security implications.

Prerequisites

CRC is installed and set up on the remote server. For more information, see Installing CRC and Setting up CRC.
CRC is configured to use the OpenShift preset on the remote server. For more information, see Changing the selected preset.
Your user account has sudo permissions on the remote server.

Procedure

Start the cluster:
```
$ crc start
```
Ensure that the cluster remains running during this procedure.

Modify the firewall to allow communication with the cluster:

$ sudo systemctl enable --now firewalld
$ sudo firewall-cmd --add-service=http --permanent
$ sudo firewall-cmd --add-service=https --permanent
$ sudo firewall-cmd --add-service=kube-apiserver --permanent
$ sudo firewall-cmd --reload

CRC exposes ports 80 and 443 on all interfaces, but the API server (6443) only listens on localhost. Install socat and create a systemd service to forward the API port to the LAN:

$ sudo dnf install -y socat

Replace REMOTE_IP with the IP address of the server (for example, 192.168.1.6):

$ cat <<'EOF' | sudo tee /etc/systemd/system/crc-api-forward.service
[Unit]
Description=Forward CRC API port (6443) to LAN
After=network.target

[Service]
ExecStart=/usr/bin/socat TCP-LISTEN:6443,bind=REMOTE_IP,fork,reuseaddr TCP:127.0.0.1:6443
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

$ sudo systemctl daemon-reload
$ sudo systemctl enable --now crc-api-forward

Connecting to a remote CRC instance

Use dnsmasq to connect a client machine to a remote server running an OpenShift Container Platform cluster managed by CRC.

This procedure assumes the use of a Red Hat Enterprise Linux, Fedora, or CentOS client. Run every command in this procedure on the client.

Connect to a server that is only exposed on your local network.

Prerequisites

A remote server is set up for the client to connect to. For more information, see Setting up CRC on a remote server.
You know the external IP address of the server.
You have the latest OpenShift CLI (oc) in your $PATH on the client.

Procedure

Install the dnsmasq package:
```
$ sudo dnf install dnsmasq
```

Enable the use of dnsmasq for DNS resolution in NetworkManager:

$ sudo tee /etc/NetworkManager/conf.d/use-dnsmasq.conf &>/dev/null <<EOF
[main]
dns=dnsmasq
EOF

Add DNS entries for CRC to the dnsmasq configuration:

$ sudo tee /etc/NetworkManager/dnsmasq.d/external-crc.conf &>/dev/null <<EOF
address=/apps-crc.testing/SERVER_IP_ADDRESS
address=/api.crc.testing/SERVER_IP_ADDRESS
EOF

Comment out any existing entries in /etc/NetworkManager/dnsmasq.d/crc.conf. These entries are created by running a local instance of CRC and will conflict with the entries for the remote cluster.

Reload the NetworkManager service:
```
$ sudo systemctl reload NetworkManager
```
Log in to the remote cluster as the developer user with oc:
```
$ oc login -u developer -p developer https://api.crc.testing:6443
```
The remote OpenShift Container Platform web console is available at https://console-openshift-console.apps-crc.testing.