openshift-docs/modules/microshift-cni.adoc

// Module included in the following assemblies:
//
// * microshift_networking/microshift-understanding networking.adoc

:_content-type: CONCEPT
[id="microshift-cni_{context}"]
= About the OVN-Kubernetes network plugin

OVN-Kubernetes is the default networking solution for {product-title} deployments. OVN-Kubernetes is a virtualized network for pods and services that is based on Open Virtual Network (OVN). The OVN-Kubernetes Container Network Interface (CNI) plugin is the network plugin for the cluster. A cluster that uses the OVN-Kubernetes network plugin also runs Open vSwitch (OVS) on the node. OVN configures OVS on the node to implement the declared network configuration.

[id="microshift-network-topology_{context}"]
== Network topology
OVN-Kubernetes provides an overlay-based networking implementation. This overlay includes an OVS-based implementation of Service and NetworkPolicy. The overlay network uses the geneve tunnel, so the pod maximum transmission unit (MTU) is set to smaller than that of the physical interface on the host to remove the tunnel header.

OVS runs as a systemd service on the {product-title} node. The OVS RPM package is installed as a dependency to the `microshift-networking` RPM package. OVS is started immediately when the `microshift-networking` RPM is installed.

[id="microshift-ip-forward_{context}"]
=== IP forward
The host network `sysctl net.ipv4.ip_forward` kernel parameter is automatically enabled by the `ovnkube-master` container when started. This is required to forward incoming traffic to the CNI. For example, accessing the NodePort service from outside of a cluster fails if `ip_forward` is disabled.

[id="microshift-network-performance_{context}"]
== Network performance optimizations
By default, three performance optimizations are applied to OVS services to minimize resource consumption:

* CPU affinity to `ovs-vswitchd.service` and `ovsdb-server.service`
* `no-mlockall` to `openvswitch.service`
* Limit handler and `revalidator` threads to `ovs-vswitchd.service`

[id="microshift-network-features_{context}"]
== Network features
Networking features available with {product-title} {product-version} include:

* Kubernetes network policy
* Dynamic node IP
* Cluster network on specified host interface
* Secondary gateway interface
* Dual stack

Networking features not available with {product-title} {product-version}:

* Egress IP/firewall/qos: disabled
* Hybrid networking: not supported
* IPsec: not supported
* Hardware offload: not supported

//watch USHIFT-640 for updates to architectural docs that will clarify features

//Q: are there immutable network settings we should tell users about?
[id="microshift-network-comps-svcs_{context}"]
== {product-title} networking components and services overview
This brief overview describes networking components and their operation in {product-title}. The `microshift-networking` RPM is a package that automatically pulls in any networking-related dependencies and systemd services to initialize networking, for example, the `microshift-ovs-init` systemd service.

NetworkManager::
NetworkManager is required to set up the initial gateway bridge on the {product-title} node. The NetworkManager and `NetworkManager-ovs` RPM packages are installed as dependencies to the `microshift-networking` RPM package, which contains the necessary configuration files. NetworkManager in {product-title} uses the `keyfile` plugin and is restarted after installation of the `microshift-networking` RPM package.

microshift-ovs-init::
The `microshift-ovs-init.service` is installed by the `microshift-networking` RPM package as a dependent systemd service to microshift.service. It is responsible for setting up the OVS gateway bridge.

OVN containers::
Two OVN-Kubernetes daemon sets are rendered and applied by {product-title}.

* *ovnkube-master*
Includes the `northd`, `nbdb`, `sbdb` and `ovnkube-master` containers.

* *ovnkube-node*
The ovnkube-node includes the OVN-Controller container.
+
After {product-title} boots, the OVN-Kubernetes daemon sets are deployed in the `openshift-ovn-kubernetes` namespace.

Packaging::
OVN-Kubernetes manifests and startup logic are built into {product-title}. The systemd services and configurations included in `microshift-networking` RPM are:

* `/etc/NetworkManager/conf.d/microshift-nm.conf` for NetworkManager.service
* `/etc/systemd/system/ovs-vswitchd.service.d/microshift-cpuaffinity.conf` for ovs-vswitchd.service
* `/etc/systemd/system/ovsdb-server.service.d/microshift-cpuaffinity.conf`
* `/usr/bin/configure-ovs-microshift.sh` for microshift-ovs-init.service
* `/usr/bin/configure-ovs.sh` for microshift-ovs-init.service
* `/etc/crio/crio.conf.d/microshift-ovn.conf` for CRI-O service

[id="microshift-bridge-mapping_{context}"]
== Bridge mappings
Bridge mappings allow provider network traffic to reach the physical network. Traffic leaves the provider network and arrives at the `br-int` bridge. A patch port between `br-int` and `br-ex` then allows the traffic to traverse to and from the provider network and the edge network. Kubernetes pods are connected to the `br-int` bridge through virtual ethernet pair: one end of the virtual ethernet pair is attached to the pod namespace, and the other end is attached to the `br-int` bridge.

[id="microshift-primary-gateway-interface_{context}"]
=== Primary gateway interface
You can specify the desired host interface name in the `ovn.yaml` config file as `gatewayInterface`. The specified interface is added in OVS bridge br-ex which acts as gateway bridge for the CNI network.

[id="microshift-secondary-gateway-interface_{context}"]
=== Secondary gateway interface
You can set up one additional host interface for cluster ingress and egress in the `ovn.yaml` config file. The additional interface is added in a second OVS bridge `br-ex1`. Cluster pod traffic directed to the additional host subnet is routed automatically based on the destination IP through br-ex1.

Either two or three OVS bridges are created based on the CNI configuration:

Default deployment::
* The `externalGatewayInterface` in not specified in the `ovn.yaml` config file.
* Two OVS bridges, `br-ex` and `br-int`, are created.

Customized deployment::
* The `externalGatewayInterface` is user-specified in the `ovn.yaml` config file.
* Three OVS bridges are created: `br-ex`, `br-ex1` and `br-int`.

//Q: We need to include the third bridge if we want to include this level of detail.
The br-ex bridge is created by `microshift-ovs-init.service` or manually. The br-ex bridge contains statically programmed openflow rules which distinguish traffic to and from the host network (underlay) and the OVN network (overlay).

The `br-int` bridge is created by the `ovnkube-master` container. The `br-int` bridge contains dynamically programmed openflow rules which handle cluster network traffic.

//The `br-ex1` bridge is created by...
//Q: need details.