Skip to content

A Nightmare on Kube Street: Slicing Kubernetes Networks like Freddy Krueger#

OVS + OVN 2025 Fall Conference (Prague) digest Program Core pick Prague · 19–20 November 2025

Abstract Slides Recording

Dave Tucker (Red Hat), Surya Seetharaman (Red Hat)

Play the recording: A Nightmare on Kube Street: Slicing Kubernetes Networks like Freddy Krueger

  • Why: Kubernetes multi-tenant isolation is still flat; this talk brings cloud-provider VPC semantics to OVN-Kubernetes on top of User-Defined Networks — policy at the network-topology level rather than per-pod NetworkPolicy.
  • What: A concept mapping of VPC constructs across AWS/Azure/GCP/VMware/OpenStack onto OVN-K8s (UDN = subnet, NetworkPolicy = security groups, OVN routers = route tables/T0-T1 gateways), then a new ClusterNetworkConnect CR: a group of label-selected UDNs/cluster networks connected via shared supernet CIDRs (connectSubnets per address family with networkPrefix), with explicit connectivity grants (PodNetwork, ClusterIPServiceNetwork). Working prototype demonstrated.
  • How: Label-based networkSelectors match UDNs/CUDNs; east-west traffic runs over Geneve, north-south SNATs pod IPs to node IPs; OVN logical switches/routers/policies provide the segmentation.
  • Where applicable: OVN-Kubernetes clusters needing self-service team networks with platform-team-controlled inter-network communication. Prototype-stage, but with clear forward hooks already named: RouteAdvertisements (BGP), EVPN to provider networks, and cloud-construct integration.