// Module included in the following assemblies:
//
//networking/hardware_networks/configuring-sriov-device.adoc

:_mod-docs-content-type: PROCEDURE
[id="enabling-all-multicast-sriov-network_{context}"]
= Enabling the all-multicast mode on an SR-IOV network

[role="_abstract"]
You can enable the all-multicast mode on an SR-IOV interface by:

* Adding the tuning configuration to the `metaPlugins` parameter of the `SriovNetwork` resource
* Setting the `allmulti` field to `true` in the tuning configuration
+
[NOTE]
====
Ensure that you create the virtual function (VF) with trust enabled.
====

The SR-IOV Network Operator manages additional network definitions. When you specify an additional SR-IOV network to create, the SR-IOV Network Operator creates the `NetworkAttachmentDefinition` custom resource (CR) automatically.

[NOTE]
====
Do not edit `NetworkAttachmentDefinition` custom resources that the SR-IOV Network Operator manages. Doing so might disrupt network traffic on your additional network.
====

Enable the all-multicast mode on a SR-IOV network by following this guidance.

.Prerequisites

* You have installed the {product-title} CLI (oc).
* You are logged in to the {product-title} cluster as a user with `cluster-admin` privileges.
* You have installed the SR-IOV Network Operator.
* You have configured an appropriate `SriovNetworkNodePolicy` object.

.Procedure

.  Create a YAML file with the following settings that defines a `SriovNetworkNodePolicy` object for a Mellanox ConnectX-5 device. Save the YAML file as `sriovnetpolicy-mlx.yaml`.
+
[source,yaml]
----
apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetworkNodePolicy
metadata:
  name: sriovnetpolicy-mlx
  namespace: openshift-sriov-network-operator
spec:
  deviceType: netdevice
  nicSelector:
    deviceID: "1017"
    pfNames:
      - ens8f0np0#0-9
    rootDevices:
      - 0000:d8:00.0
    vendor: "15b3"
  nodeSelector:
    feature.node.kubernetes.io/network-sriov.capable: "true"
  numVfs: 10
  priority: 99
  resourceName: resourcemlx
----

. Optional: If the SR-IOV capable cluster nodes are not already labeled, add the `SriovNetworkNodePolicy.Spec.NodeSelector` label. For more information about labeling nodes, see "Understanding how to update labels on nodes".

. Create the `SriovNetworkNodePolicy` object by running the following command:
+
[source,terminal]
----
$ oc create -f sriovnetpolicy-mlx.yaml
----
+
After applying the configuration update, all the pods in the `sriov-network-operator` namespace automatically move to a `Running` status.

. Create the `enable-allmulti-test` namespace by running the following command:
+
[source,terminal]
----
$ oc create namespace enable-allmulti-test
----

. Create the `SriovNetwork` custom resource (CR) for the additional SR-IOV network attachment and insert the `metaPlugins` configuration, as in the following example CR YAML, and save the file as `sriov-enable-all-multicast.yaml`.
+
[source,yaml]
----
apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetwork
metadata:
  name: enableallmulti
  namespace: openshift-sriov-network-operator
spec:
  resourceName: enableallmulti
  networkNamespace: enable-allmulti-test
  ipam: '{ "type": "static" }'
  capabilities: '{ "mac": true, "ips": true }'
  trust: "on"
  metaPlugins : |
    {
      "type": "tuning",
      "capabilities":{
        "mac":true
      },
      "allmulti": true
      }
    }
----
+
--
* Replace `<name>` with a name for the object. The SR-IOV Network Operator creates a `NetworkAttachmentDefinition` object with the same name.
* Replace `<namespace>` with the namespace where the SR-IOV Network Operator is installed.
* Replace `<resourceName>` with a value for the `spec.resourceName` parameter from the `SriovNetworkNodePolicy` object that defines the SR-IOV hardware for this additional network.
* Replace `<networkNamespace>` with the target namespace for the `SriovNetwork` object. Only pods in the target namespace can attach to the additional network.
* Replace `<ipam>` with a configuration object for the IPAM CNI plugin as a YAML block scalar. The plugin manages IP address assignment for the attachment definition.
* Optional: Set capabilities for the additional network. You can specify `"{ "ips": true }"` to enable IP address support or `"{ "mac": true }"` to enable MAC address support.
* Specify the trust mode of the virtual function. This must be set to "on".
* Add more capabilities to the device by using the `metaPlugins` parameter. In this use case, set the `type` field to `tuning`, and add the `allmulti` field and set it to `true`.
--

. Create the `SriovNetwork` resource by running the following command:
+
[source,terminal]
----
$ oc create -f sriov-enable-all-multicast.yaml
----

.Verification

* Confirm that the SR-IOV Network Operator created the `NetworkAttachmentDefinition` CR by running the following command:
+
[source,terminal]
----
$ oc get network-attachment-definitions -n <namespace>
----
+
--
* Replace `<namespace>` with the value for `networkNamespace` that you specified in the `SriovNetwork` object. For this example, that is `enable-allmulti-test`. The expected output shows the name of the NAD CR and the creation age in minutes.
--
+
[NOTE]
====
There might be a delay before the SR-IOV Network Operator creates the CR.
====

* Display information about the SR-IOV network resources by running the following command:
+
[source,terminal]
----
$ oc get sriovnetwork -n openshift-sriov-network-operator
----

. To verify that the tuning CNI is correctly configured and that the additional SR-IOV network attachment is attached, create a `Pod` CR. Save the following sample YAML in a file named `examplepod.yaml`:
+
[source,yaml]
----
apiVersion: v1
kind: Pod
metadata:
  name: samplepod
  namespace: enable-allmulti-test
  annotations:
    k8s.v1.cni.cncf.io/networks: |-
      [
        {
          "name": "enableallmulti",
          "mac": "0a:56:0a:83:04:0c",
          "ips": ["10.100.100.200/24"]
       }
      ]
spec:
  containers:
  - name: podexample
    image: centos
    command: ["/bin/bash", "-c", "sleep INF"]
    securityContext:
      runAsUser: 2000
      runAsGroup: 3000
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
----
+
--
* Replace `<name>` with the name of the SR-IOV network attachment definition CR.
* Optional: Specify the MAC address for the SR-IOV device that is allocated from the resource type defined in the SR-IOV network attachment definition CR. To use this feature, you also must specify `{"mac": true}` in the SriovNetwork object.
* Optional: Specify the IP addresses for the SR-IOV device that are allocated from the resource type defined in the SR-IOV network attachment definition CR. Both IPv4 and IPv6 addresses are supported. To use this feature, you also must specify `{ "ips": true }` in the `SriovNetwork` object.
--

. Create the `Pod` CR by running the following command:
+
[source,terminal]
----
$ oc apply -f examplepod.yaml
----

. Verify that the pod is created by running the following command:
+
[source,terminal]
----
$ oc get pod -n enable-allmulti-test
----
+
The following is example output:
+
[source,terminal]
----
NAME       READY   STATUS    RESTARTS   AGE
samplepod  1/1     Running   0          47s
----

. Log in to the pod by running the following command:
+
[source,terminal]
----
$ oc rsh -n enable-allmulti-test samplepod
----

. List all the interfaces associated with the pod by running the following command:
+
[source,terminal]
----
sh-4.4# ip link
----
+
The following is example output:
+
[source,terminal]
----
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 8901 qdisc noqueue state UP mode DEFAULT group default
    link/ether 0a:58:0a:83:00:10 brd ff:ff:ff:ff:ff:ff link-netnsid 0
3: net1@if24: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
    link/ether ee:9b:66:a4:ec:1d brd ff:ff:ff:ff:ff:ff link-netnsid 0
----
+
--
* `eth0@if22` is the primary interface.
* `net1@if24` is the secondary interface configured with the network-attachment-definition that supports the all-multicast mode (`ALLMULTI` flag).
--
