OpenShift Networking Transformed: Fully Embracing DPDK Datapaths in OVN-K8s!#

Speakers: Jakob Meng, Maxime Coquelin, Red Hat, Inc.

Why: A complete userspace datapath from NIC to pod in OVN-Kubernetes — kernel bypass inside a managed Kubernetes distribution, with refreshingly honest benchmark results including where it loses.

What: Replaced veth-based pod connectivity with VDUSE (a purely software vDPA device: a kernel driver on the vDPA bus plus a userspace device implemented via the DPDK Vhost library). OVS reuses its dpdkvhostuserclient port type, so the datapath is the well-optimized Vhost-user one; OVN-K8s creates VDUSE devices instead of veth pairs when userspace bridges are detected. Motivations: partitioning (network infra isolated on dedicated CPUs), determinism, and uniformity across primary/secondary networks including KubeVirt.

How: Measured on Intel Xeon Gold 6438N, RHEL 9.6, isolated CPUs, 1 GB hugepages, OVS 3.4+: veth performs slightly better on small block sizes, VDUSE outperforms veth on medium sizes, and VDUSE plateaus on large blocks where ~40% of cycles on the Rx virtqueue IRQ CPU are spent in the bounce-buffer copy (100% busy). Stated cons: memory bandwidth cost from bounce buffers, operational complexity (kernel args, hugepages, NUMA tuning), higher CPU from PMDs (partially mitigated by PMD load-based sleeping at the cost of wakeup latency), and SELinux currently unsupported.

Where applicable: OpenShift/RHEL PoC today (activated by kernel args, prepare-ovs.sh, vfio-pci binding); the VDUSE technique itself is general for K8s clusters wanting partitioned, deterministic pod networking. Preliminary results, explicitly framed as a PoC with upstream productization as future work.