-
Feature Request
-
Resolution: Duplicate
-
Critical
-
None
-
None
-
None
-
None
-
Product / Portfolio Work
-
None
-
False
-
-
None
-
None
-
None
-
-
None
-
None
-
None
-
None
-
None
1. Proposed title of this feature request
ICMP support in MultiNetworkPolicy
2. What is the problem that your customer is facing?
Customer needs to segment VMs using MultiNetworkPolicies. Today, MultiNetworkPolicies does not support ICMP, only TCP, UDP, and SCTP. Without ICMP, customers cannot use their monitoring systems or troubleshoot. This would be a dealbreaker.
3. What is the nature and description of the request?
Expose ICMP protocol for MultiNetworkPolicy
4. What are your expectations for this feature //Please add any requirements you may have so that we are able to deliver what you need
Customers need to be able to turn on ICMP filtering in MultiNetworkPolicies for localnet NADs. Just need to set ICMP ON or OFF, no further configuration.
This shall benefit customers who are planning to use "localnet NAD". Most probably on a single ovs-bridge created on a separate interface.
{{ - name: br-ovs-{{ .Values.interface }}
description: |-
A dedicated OVS bridge with {{ .Values.interface }} as a port
allowing VLANs 300-999
type: ovs-bridge
state: up
bridge:
options:
stp: true
port:
- name: {{ .Values.interface }} # Dedicated VM Bond interface, not br-ex
vlan:
mode: trunk
trunk-tags:
- id-range:
min: 300
max: 999
ovn:
bridge-mappings:
- localnet: br-ovn-k-{{ .Values.interface }}
bridge: br-ovs-{{ .Values.interface }}
state: present
—
{{- range .Values.vlans }}
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
name: vlan{{ . }}
namespace: default
spec:
config: |
{
"cniVersion": "1.0.0",
"name": "vlan{{ . }}",
"type": "ovn-k8s-cni-overlay",
"topology": "localnet",
"vlanID": {{ . }},
"netAttachDefName": "default/vlan{{ . }}",
"physicalNetworkName": "br-ovn-k-{{ $.Values.interface }}"
}
5. Why does the customer need this? (List the business requirements here)
Customers are moving all their VMs from VMware into OpenShift Virtualization with a short timeline.
If ICMP is not supported, they lose observability and the ability to troubleshoot, which is unacceptable and would be a dealbreaker.
A lot of customers are moving in this direction. Kubernetes did not have VM workloads from the beginning, and ICMP was not needed.
Now there is a big movement from not only a single customer, but many others will need this as well.
6. What is the business impact, if any, if this request is not made available?
They will not be able to use OpenShift virtualization
7. List any affected packages or components.
Unsure about this, letting the engineering take the call now.