OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

About the OpenShift SDN default CNI network provider

OpenShift Container Platform uses a software-defined networking (SDN) approach to provide a unified cluster network that enables communication between pods across the OpenShift Container Platform cluster. This pod network is established and maintained by the OpenShift SDN, which configures an overlay network using Open vSwitch (OVS).

OpenShift SDN provides three SDN modes for configuring the pod network:

  • The network policy mode allows project administrators to configure their own isolation policies using NetworkPolicy objects. Network policy is the default mode in OpenShift Container Platform 4.4.

  • The multitenant mode provides project-level isolation for pods and services. pods from different projects cannot send packets to or receive packets from pods and services of a different project. You can disable isolation for a project, allowing it to send network traffic to all pods and services in the entire cluster and receive network traffic from those pods and services.

  • The subnet mode provides a flat pod network where every pod can communicate with every other pod and service. The network policy mode provides the same functionality as the subnet mode.

Supported default CNI network provider feature matrix

OpenShift Container Platform offers two supported choices, OpenShift SDN and OVN-Kubernetes, for the default Container Network Interface (CNI) network provider. The following table summarizes the current feature support for both network providers:

Table 1. Default CNI network provider feature comparison
Feature OpenShift SDN OVN-Kubernetes [1]

Egress IPs

Supported

Not supported

Egress firewall [2]

Supported

Not supported

Egress router

Supported

Not supported

Kubernetes network policy

Partially supported [3]

Supported

Multicast

Supported

Supported

  1. Available only as a Technology Preview feature in OpenShift Container Platform 4.4.

  2. Egress firewall is also known as egress network policy in OpenShift SDN. This is not the same as network policy egress.

  3. Does not support egress rules and some ipBlock rules.