OVN-Kubernetes Meets DPUs: Enabling Service Function Chaining and Shared OVN#

Tim Rozet (NVIDIA)

• Why: Shows concretely how DPU adoption is driving new OVN features — SFC and "Shared OVN" — i.e., where the OVN architecture is heading for offloaded security/auditing pipelines, with an explicit call for contributors.
• What: An SFC design for OVN (RFC 7665 semantics): initially SFC-unaware service functions (no NSH), using Geneve to carry chain metadata between nodes; a new Service_Function_Chain NB table with two modes — local (no conntrack, allows packet modification, all SFs on one chassis, symmetry requires an explicit reverse chain) and immutable-global (conntrack-implied symmetry, chain can cross nodes, no packet modification); Network_Function_Group gains a load-balance mode for multiple SF instances. Shared OVN: one OVN instance serving multiple CMSs — one per DPU plus one for the host cluster — with RBAC separation.
• How: A two-cluster DPU model (Kubernetes running on the DPU) lets DPU admins enforce security at the edge by injecting SFC classifiers as ACLs into the host cluster's traffic; open questions stated plainly — is OVN RBAC secure enough for this, and does shared OVN actually reduce resource consumption?
• Where applicable: OVN-Kubernetes on BlueField-class DPUs; enhancement proposal under active discussion (June 2025 ovs-dev thread); single-cluster SFC targeted first, shared two-cluster second.