Networking -- Quick Reference

Key Numbers

Decision Matrix

Essential Commands

Architecture at a Glance (OVE/OVN-Kubernetes)

+===============================================================================+
| VM Guest OS                                                                   |
|   eth0: 10.0.2.2/24 (masquerade, mgmt)    eth1: 192.168.100.5/24 (SR-IOV)   |
|         virtio-net                               VFIO passthrough             |
+===============================================================================+
| virt-launcher Pod                                                             |
|   tap0 ---> linux bridge ---> NAT (iptables DNAT/SNAT) ---> eth0 (pod iface) |
|   [no software path for SR-IOV -- direct hardware access via VFIO]            |
+===============================================================================+
| Node Network Stack                                                            |
|   veth pair: pod eth0 <---> br-int (Open vSwitch)                             |
|   OVS bridge br-int handles:                                                  |
|     - Pod-to-pod switching (local)                                            |
|     - GENEVE encap/decap (remote pods)                                        |
|     - Service DNAT (OVN load balancer, replaces kube-proxy)                   |
|     - NetworkPolicy ACLs                                                      |
+===============================================================================+
| OVN Control Plane                                                             |
|   Northbound DB (6641): logical switches, routers, ACLs, LBs                 |
|   Southbound DB (6642): compiled flows, chassis bindings                      |
|   ovn-controller (per node): translates SB DB -> OVS OpenFlow rules           |
+===============================================================================+
| Physical NIC                                                                  |
|   eno1: GENEVE overlay (pod traffic, UDP 6081)     MTU 9000 recommended       |
|   eno2: SR-IOV PF (VFs allocated to VMs)           VLAN trunk to ToR switch   |
|   Bond0: optional LACP bond for overlay NICs                                  |
+===============================================================================+
| Physical Network (Spine-Leaf)                                                 |
|   ToR Switch: VLAN trunks, GENEVE transport, BGP peering (MetalLB)            |
+===============================================================================+

Network Troubleshooting Quick Checks

1. VM has no network connectivity

# Check pod network interface inside the virt-launcher pod
oc exec virt-launcher-my-vm-xxxxx -- ip a
# Check if OVN port binding exists for this pod
oc exec -n openshift-ovn-kubernetes ovnkube-node-xxx -- ovn-nbctl list Logical_Switch_Port | grep my-vm
# Check CNI events on the pod
oc describe pod virt-launcher-my-vm-xxxxx | grep -A5 Events

2. Service not reachable (ClusterIP or LoadBalancer)

# Check service endpoints are populated (empty = selector mismatch or pods not ready)
oc get endpoints my-svc -n my-ns
# Check OVN load balancer for this service
oc exec -n openshift-ovn-kubernetes ovnkube-node-xxx -- ovn-nbctl list Load_Balancer | grep <cluster-ip>
# Test from inside cluster
oc run debug --rm -it --image=nicolaka/netshoot -- curl -v http://my-svc.my-ns:8080

3. MetalLB external IP not reachable

# Check IPAddressPool has available IPs
oc get ipaddresspool -n metallb-system -o yaml
# Check which speaker owns the IP (L2 mode: only one speaker answers ARP)
oc logs -n metallb-system -l component=speaker | grep "announcing"
# Check ARP on the physical network (from a host on the same L2 segment)
# arping -I eth0 <external-ip>

4. SR-IOV VF not available / VM stuck pending

# Check SriovNetworkNodeState for available VFs on the node
oc get sriovnetworknodestates -n openshift-sriov-network-operator <node> -o yaml
# Check SriovNetworkNodePolicy is applied and VFs are created
oc get sriovnetworknodepolicy -n openshift-sriov-network-operator
# Check node for VF allocation (device plugin)
oc describe node <node> | grep -A5 "openshift.io/sriov"

5. DNS resolution failing inside VM/Pod

# Check CoreDNS pods are running
oc get pods -n openshift-dns
# Test DNS from inside a debug pod
oc run dns-test --rm -it --image=busybox -- nslookup kubernetes.default.svc.cluster.local
# Check CoreDNS logs for errors
oc logs -n openshift-dns -l dns.operator.openshift.io/daemonset-dns=default --tail=30

NetworkAttachmentDefinition Examples

VLAN bridge (L2 access to physical VLAN):

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: vlan100-prod
  namespace: production
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "type": "bridge",
      "bridge": "br-vlan100",
      "vlan": 100,
      "ipam": { "type": "static" }
    }

SR-IOV network:

apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetwork
metadata:
  name: sriov-storage-net
  namespace: openshift-sriov-network-operator
spec:
  ipam: '{ "type": "static" }'
  networkNamespace: production
  resourceName: sriov_storage_vf
  vlan: 200

VM using both default + secondary network:

spec:
  template:
    spec:
      networks:
        - name: default
          pod: {}                        # Pod network (masquerade)
        - name: storage-net
          multus:
            networkName: sriov-storage-net  # SR-IOV secondary
      domain:
        devices:
          interfaces:
            - name: default
              masquerade: {}
            - name: storage-net
              sriov: {}