-
Story
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
Strategic Portfolio Work
-
False
-
None
-
False
-
OCPSTRAT-1248 - Native Network Isolation for Namespaces
-
---
-
-
-
SDN Sprint 256
-
0
-
0
Add logic to derive user defined primary network zone, mark and vrfid from network-id.
These values do not need to be unique per cluster but per node, also we already an annotation per node with the network-id we can store there if needed the values per node for this IDs, this way they don't have to be like network-id but we can easily map them.
Take into account that we make max number of user defined network configurable
Mark:
- Configure a base for user defined networks
- Egress IP pkt mark will configure different base
- Calculation will be "base + network-id" so range will be [base+1, base+max-user-defined-networks]
Zone:
- option1: Don't set the snat-ct-zone so ovn choose it for us and create an utility to introspect what was choose to log it or access it if needed.
- option2: OVN RFE to implement a white list of conntrack zone they will use so they don't collide with the ones ovn-k will use, this way it's possible to set snat-ct-zone, this will take time.
VRFID:
- device name:
- [network management port]-vrf
- table id
- option1:
- We reserve and document a range for user defined networks (have to be different for egress IP)
- Calculation will be "base + network-id" so range will be [base+1, base+max-user-defined-networks]
- option2: Introspect the system to free table IDs
- Use netlink VRF interfaces to discover already used table IDs and reserve them (ip -d link show type vrf)
- option1:
Masquerade IP:
- How many types of masquerade are needed ?
- Derivate from default network masquerade + network-id.
- links to