// Module included in the following assemblies:
//
// * networking/ovn_kubernetes_network_provider/configuring-secondary-external-gateway.adoc

:_mod-docs-content-type: PROCEDURE
[id="nw-secondary-ext-gw-configure_{context}"]
= Configure a secondary external gateway

[role="_abstract"]
You can configure an external gateway on the default network for a namespace in your cluster.

.Prerequisites

* You installed the {oc-first}.
* You are logged in to the cluster with a user with `cluster-admin` privileges.

.Procedure

. Create a YAML file that contains an `AdminPolicyBasedExternalRoute` object. For more information, see "AdminPolicyBasedExternalRoute object configuration".

. To create an admin policy based external route, enter the following command:
+
[source,terminal]
----
$ oc create -f <file>.yaml
----
+
** `<file>`: Specifies the name of the YAML file that you created in a previous step.
+
.Example output
[source,text]
----
adminpolicybasedexternalroute.k8s.ovn.org/default-route-policy created
----

. To confirm that the admin policy based external route was created, enter the following command:
+
[source,terminal]
----
$ oc describe apbexternalroute <name> | tail -n 6
----
+
** `<name>`: Specifies the name of the `AdminPolicyBasedExternalRoute` object.
+
.Example output
[source,text]
----
Status:
  Last Transition Time:  2023-04-24T15:09:01Z
  Messages:
  Configured external gateway IPs: 172.18.0.8
  Status:  Success
Events:  <none>
----

////
.Verification

If you created an `AdminPolicyBasedExternalRoute` object that selects a host-network pod IP address as the secondary external gateway, you can confirm that the next hop is correct for a pod with the following steps:

. To get the IP address of the pod, enter the following command:
+
[source,terminal]
----
oc get pods/<pod_name> -n <namespace> -o wide
----
+
--
where:

`<pod_name>`:: Specifies the name of the pod.
`<namespace>`:: Specifies the namespace of the pod.
--
+
.Example output
[source,text]
----
NAMESPACE  NAME   READY   STATUS      RESTARTS      AGE   IP            NODE      NOMINATED NODE   READINESS GATES
ns1        pod1   1/1     Running     1 (37m ago)   41m   10.130.0.8    node1     <none>           <none>
----

. Confirm that the IP address from the previous step is available as an external gateway.

.. To find the OVN-Kubernetes control plane pod that manages the next hop for the pod, enter the following command:
+
[source,terminal]
----
$ oc get pod -n openshift-ovn-kubernetes \
  --field-selector spec.nodeName=<node_name> \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | \
    grep ovnkube-node-
----
+
--
where:

`<node_name>`:: Specifies the name of the node from the `NODE` column that the pod from the previous step is running on.
--
+
.Example output
[source,text]
----
ovnkube-node-rpt55
----

.. To confirm that the OVN-Kubernetes node pod includes the correct next hop, enter the following command:
+
[source,terminal]
----
$ oc exec -t <pod_name> -n openshift-ovn-kubernetes  -c nbdb \
    -- ovn-nbctl lr-route-list GR_ovn-work | grep <pod_ip> -A 6 -B 4

oc exec -ti <pod_name> -n openshift-ovn-kubernetes -c nbdb -- ovn-nbctl lr-route-list GR_<node_name> | grep <pod_id> -A6 -B4
----
+
--
where:

`<pod_name>`:: Specifies the name of the OVN-Kubernetes node pod from the previous step.
`<node_name>`:: Specifies the name of the cluster node that the OVN-Kubernetes node pod is running on.
`<pod_ip>`:: Specifies the name of the pod IP address.
--
+
.Example output
[source,text]
----
IPv4 Routes
Route Table

:
10.128.2.206 172.18.0.10 src-ip rtoe-GR_worker-0-1 ecmp-symmetric-reply bfd
10.128.3.229 172.18.0.10 src-ip rtoe-GR_worker-0-1 ecmp-symmetric-reply bfd
169.254.169.0/29 169.254.169.4 dst-ip rtoe-GR_worker-0-1
10.128.0.0/14 100.64.0.1 dst-ip
0.0.0.0/0 192.168.123.1 dst-ip rtoe-GR_worker-0-1
----
////
