Skip to content

A Switch, a Load Balancer, and an ACL Walk into a Pipeline…. And Conntrack Ruins Everything#

Open vSwitch and OVN 2026 Fall Conference digest Program Core pick 2–4 November 2026

Abstract

Surya Seetharaman, Red Hat, LLC.; Nadia Pinaeva, NVIDIA

  • Why: UDN isolation is not the end state — address-space exhaustion and inter-team service access require controlled connectivity between tenant islands. This is the API (ClusterNetworkConnect in ovn-k v1.3) doing that, plus a genuinely instructive conntrack/ACL evaluation-order puzzle.
  • What: ClusterNetworkConnect, a declarative admin API connecting isolated UDNs with full pod-to-pod, service-only, or both; symmetric but non-transitive connectivity. Plus the war story of how load balancers on switches interact with conntrack and ACL evaluation order to break the "allow service, drop pod-to-pod" intent, the shipped workaround, and why the long-term fix is hard. (from abstract only)
  • How: A distributed transit router peers with each connected network's router via point-to-point subnets carved deterministically from a user-configured CIDR; load balancers are placed on connected networks' switches so cross-network DNAT works with existing routing.
  • Where applicable: OVN-Kubernetes v1.3+ with UDNs; the conntrack/ACL ordering lesson applies to anyone designing stateful policy over OVN load balancers generally.