In Kubernetes, container networking is delegated to networking plug-ins that implement the Container Network Interface (CNI).
OpenShift Container Platform uses the Multus CNI plug-in to allow chaining of CNI plug-ins. During cluster installation, you configure your default Pod network. The default network handles all ordinary network traffic for the cluster. You can define an additional network based on the available CNI plug-ins and attach one or more of these networks to your Pods. You can define more than one additional network for your cluster, depending on your needs. This gives you flexibility when you configure Pods that deliver network functionality, such as switching or routing.
You can use an additional network in situations where network isolation is needed, including data plane and control plane separation. Isolating network traffic is useful for the following performance and security reasons:
You can send traffic on two different planes in order to manage how much traffic is along each plane.
You can send sensitive traffic onto a network plane that is managed specifically for security considerations, and you can separate private data that must not be shared between tenants or customers.
All of the Pods in the cluster still use the cluster-wide default network
to maintain connectivity across the cluster. Every Pod has an
that is attached to the cluster-wide Pod network. You can view the interfaces
for a Pod by using the
oc exec -it <pod_name> -- ip a command. If you
add additional network interfaces that use Multus CNI, they are named
To attach additional network interfaces to a Pod, you must create configurations
that define how the interfaces are attached. You specify each interface by using
a Custom Resource (CR) that has a
NetworkAttachmentDefinition type. A CNI
configuration inside each of these CRs defines how that interface is created.
OpenShift Container Platform provides the following CNI plug-ins for creating additional networks in your cluster:
bridge: Creating a bridge-based additional network allows Pods on the same host to communicate with each other and the host.
host-device: Configuring a host-device additional network allows Pods access to a physical Ethernet network device on the host system.
ipvlan: Configuring an ipvlan-based additional network allows Pods on a host to communicate with other hosts and Pods on those hosts, similar to a macvlan-based additional network. Unlike a macvlan-based additional network, each Pod shares the same MAC address as the parent physical network interface.
macvlan: Creating a macvlan-based additional network allows Pods on a host to communicate with other hosts and Pods on those hosts by using a physical network interface. Each Pod that is attached to a macvlan-based additional network is provided a unique MAC address.
A macvlan additional network can be configured in two ways:
SR-IOV: Configuring an SR-IOV based additional network allows Pods to attach to a virtual function (VF) interface on SR-IOV capable hardware on the host system.