Skip to content

Commit 688f3c0

Browse files
sjhala-ccssjhala-ccs
authored
Merge pull request #86295 from sjhala-ccs/cnv-50607
CNV-46630: Connecting VMs to primary UDNs (GA)
2 parents 139a41c + 26f220b commit 688f3c0

File tree

5 files changed

+196
-0
lines changed

5 files changed

+196
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4662,6 +4662,8 @@ Topics:
46624662
File: virt-networking-overview
46634663
- Name: Connecting a VM to the default pod network
46644664
File: virt-connecting-vm-to-default-pod-network
4665+
- Name: Connecting a VM to a primary user-defined network
4666+
File: virt-connecting-vm-to-primary-udn
46654667
- Name: Exposing a VM by using a service
46664668
File: virt-exposing-vm-with-service
46674669
- Name: Accessing a VM by using its internal FQDN

‎modules/virt-attaching-vm-to-primary-udn.adoc

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/vm_networking/virt-connecting-vm-to-primary-udn.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-attaching-vm-to-primary-udn_{context}"]
7+
= Attaching a virtual machine to the primary user-defined network
8+
9+
You can connect a virtual machine (VM) to the primary user-defined network (UDN) by requesting the pod network attachment, and configuring the interface binding.
10+
11+
.Prerequisites
12+
* You have installed the OpenShift CLI (`oc`).
13+
14+
.Procedure
15+
. Edit the `VirtualMachine` manifest to add the UDN interface details, as in the following example:
16+
+
17+
.Example `VirtualMachine` manifest
18+
[source,yaml]
19+
----
20+
apiVersion: kubevirt.io/v1
21+
kind: VirtualMachine
22+
metadata:
23+
name: example-vm
24+
namespace: my-namespace # <1>
25+
spec:
26+
template:
27+
spec:
28+
domain:
29+
devices:
30+
interfaces:
31+
- name: udn-l2-net # <2>
32+
binding:
33+
name: l2bridge # <3>
34+
# ...
35+
networks:
36+
- name: udn-l2-net # <4>
37+
pod: {}
38+
# ...
39+
----
40+
<1> The namespace in which the VM is located. This value must match the namespace in which the UDN is defined.
41+
<2> The name of the user-defined network interface.
42+
<3> The name of the binding plugin that is used to connect the interface to the VM. The required value is `l2bridge`.
43+
<4> The name of the network. This must match the value of the `spec.template.spec.domain.devices.interfaces.name` field.
44+
45+
. Apply the `VirtualMachine` manifest by running the following command:
46+
+
47+
[source,terminal]
48+
----
49+
$ oc apply -f <filename>.yaml
50+
----

‎modules/virt-creating-a-primary-cluster-udn.adoc

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/vm_networking/virt-connecting-vm-to-primary-udn.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-creating-a-primary-cluster-udn_{context}"]
7+
= Creating a primary cluster-scoped user-defined network
8+
9+
You can connect multiple namespaces to the same primary user-defined network (UDN) to achieve native tenant isolation.
10+
11+
.Prerequisites
12+
. You have access to the cluster as a user with `cluster-admin` privileges.
13+
. You have installed the OpenShift CLI (`oc`).
14+
. You have created multiple namespaces with the `k8s.ovn.org/primary-user-defined-network` label.
15+
16+
.Procedure
17+
. Create a `ClusterUserDefinedNetwork` object to specify the custom network configuration:
18+
+
19+
.Example `ClusterUserDefinedNetwork` manifest
20+
[source,yaml]
21+
----
22+
kind: ClusterUserDefinedNetwork
23+
metadata:
24+
name: cudn-l2-net # <1>
25+
spec:
26+
namespaceSelector: # <2>
27+
matchExpressions: # <3>
28+
- key: kubernetes.io/metadata.name
29+
operator: In # <4>
30+
values: ["red-namespace", "blue-namespace"]
31+
network:
32+
topology: Layer2 # <5>
33+
layer2:
34+
role: Primary # <6>
35+
ipam:
36+
lifecycle: Persistent
37+
subnets:
38+
- 203.203.0.0/16
39+
----
40+
<1> Specifies the name of the `ClusterUserDefinedNetwork` custom resource.
41+
<2> Specifies the set of namespaces that the cluster UDN applies to. The namespace selector must not point to `default`, an `openshift-*` namespace, or any global namespaces that are defined by the Cluster Network Operator (CNO).
42+
<3> Specifies the type of selector. In this example, the `matchExpressions` selector selects objects that have the label `kubernetes.io/metadata.name` with the value `red-namespace` or `blue-namespace`.
43+
<4> Specifies the type of operator. Possible values are `In`, `NotIn`, and `Exists`.
44+
<5> Specifies the topological configuration of the network. The required value is `Layer2`. A `Layer2` topology creates a logical switch that is shared by all nodes.
45+
<6> Specifies if the UDN is primary or secondary. {VirtProductName} only supports the `Primary` role. This means that the UDN acts as the primary network for the VM and all default traffic passes through this network.
46+
47+
. Apply the `ClusterUserDefinedNetwork` manifest by running the following command:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc apply -f --validate=true <filename>.yaml
52+
----

‎modules/virt-creating-a-primary-udn.adoc

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/vm_networking/virt-connecting-vm-to-primary-udn.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-creating-a-primary-udn_{context}"]
7+
= Creating a primary namespace-scoped user-defined network
8+
9+
You can create an isolated primary network in your project namespace. You must use the OVN-Kubernetes layer 2 topology and enable persistent IP address allocation in the user-defined network (UDN) configuration to ensure VM live migration support.
10+
11+
.Prerequisites
12+
. You have installed the OpenShift CLI (`oc`).
13+
. You have created a namespace and applied the `k8s.ovn.org/primary-user-defined-network` label.
14+
15+
.Procedure
16+
. Create a `UserDefinedNetwork` object to specify the custom network configuration:
17+
+
18+
.Example `UserDefinedNetwork` manifest
19+
[source,yaml]
20+
----
21+
apiVersion: k8s.ovn.org/v1
22+
kind: UserDefinedNetwork
23+
metadata:
24+
name: udn-l2-net # <1>
25+
namespace: my-namespace # <2>
26+
spec:
27+
topology: Layer2 # <3>
28+
layer2:
29+
role: Primary # <4>
30+
subnets:
31+
- "10.0.0.0/24"
32+
- "2001:db8::/60"
33+
ipam:
34+
lifecycle: Persistent # <5>
35+
----
36+
<1> Specifies the name of the `UserDefinedNetwork` custom resource.
37+
<2> Specifies the namespace in which the VM is located. The namespace must have the `k8s.ovn.org/primary-user-defined-network` label. The namespace must not be `default`, an `openshift-*` namespace, or match any global namespaces that are defined by the Cluster Network Operator (CNO).
38+
<3> Specifies the topological configuration of the network. The required value is `Layer2`. A `Layer2` topology creates a logical switch that is shared by all nodes.
39+
<4> Specifies if the UDN is primary or secondary. {VirtProductName} only supports the `Primary` role. This means that the UDN acts as the primary network for the VM and all default traffic passes through this network.
40+
<5> Specifies that virtual workloads have consistent IP addresses across reboots and migration. The `spec.layer2.subnets` field is required when `ipam.lifecycle: Persistent` is specified.
41+
42+
. Apply the `UserDefinedNetwork` manifest by running the following command:
43+
+
44+
[source,terminal]
45+
----
46+
$ oc apply -f --validate=true <filename>.yaml
47+
----

‎virt/vm_networking/virt-connecting-vm-to-primary-udn.adoc

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="virt-connecting-vm-to-primary-udn"]
3+
= Connecting a virtual machine to a primary user-defined network
4+
include::_attributes/common-attributes.adoc[]
5+
:context: virt-connecting-vm-to-primary-udn
6+
7+
toc::[]
8+
9+
You can connect a virtual machine (VM) to a user-defined network (UDN) on the VM's primary interface. The primary user-defined network replaces the default pod network in your specified namespace. Unlike the pod network, you can define the primary UDN per project, where each project can use its specific subnet and topology.
10+
11+
{VirtProductName} supports the namespace-scoped `UserDefinedNetwork` and the cluster-scoped `ClusterUserDefinedNetwork` custom resource definitions (CRD).
12+
13+
Tenant owners can configure a primary `UserDefinedNetwork` CRD to create a network that isolates their namespace from other namespaces without requiring network policies. Cluster administrators can use the `ClusterUserDefinedNetwork` CRD to create a shared OVN network across multiple namespaces.
14+
15+
[NOTE]
16+
====
17+
You must add the `k8s.ovn.org/primary-user-defined-network` label when you create a namespace that is to be used with user-defined networks.
18+
====
19+
20+
With the layer 2 topology, OVN-Kubernetes creates an overlay network between nodes. You can use this overlay network to connect VMs on different nodes without having to configure any additional physical networking infrastructure.
21+
22+
The layer 2 topology enables seamless migration of VMs without the need for Network Address Translation (NAT) because persistent IP addresses are preserved across cluster nodes during live migration.
23+
24+
You must consider the following limitations before implementing a primary UDN:
25+
26+
* You cannot use the `virtctl ssh` command to configure SSH access to a VM.
27+
* You cannot use the `oc port-forward` command to forward ports to a VM.
28+
* You cannot use headless services to access a VM.
29+
* You cannot define readiness and liveness probes to configure VM health checks.
30+
31+
[NOTE]
32+
====
33+
{VirtProductName} currently does not support secondary user-defined networks.
34+
====
35+
36+
include::modules/virt-creating-a-primary-udn.adoc[leveloffset=+1]
37+
38+
include::modules/virt-creating-a-primary-cluster-udn.adoc[leveloffset=+1]
39+
40+
include::modules/virt-attaching-vm-to-primary-udn.adoc[leveloffset=+1]
41+
42+
[role="_additional-resources"]
43+
[id="additional-resources_{context}"]
44+
== Additional resources
45+
* xref:../../networking/multiple_networks/primary_networks/about-user-defined-networks.adoc#about-user-defined-networks[About user-defined networks]

0 commit comments

Comments
 (0)