Skip to content

One Shared Gateway, a Thousand Routers: Scaling ARP/NDP in OVN-Kubernetes#

Open vSwitch and OVN 2026 Fall Conference digest Program Core pick 2–4 November 2026

Abstract

Jaime Caamano, Red Hat, LLC.; Matteo Dallaglio, Red Hat, LLC.; Tim Rozet, NVIDIA

  • Why: A beautiful datapath pathology: with hundreds/thousands of UDNs sharing one uplink/IP/MAC, ARP replies can't be mapped back to their originating router (conntrack can't track them), so OVN-Kubernetes fans them out to every patch port — duplicating neighbor state, ballooning the OpenFlow footprint, and eventually exceeding OVS recirculation limits. This is exactly the "K8s networking meets datapath internals" intersection.
  • What: The full arc of an ARP storm at UDN scale: how fan-out surfaced, the constraints any fix must preserve, a short-term flow fix constraining fan-out on the shared gateway bridge, a mid-term prototype steering discovery through the default gateway router, and the resulting upstream OVN feature — Shared MAC-binding scopes, letting related logical router ports share one set of learned neighbor bindings instead of per-router duplication. (from abstract only)
  • How: Learn through a single gateway router and steer ARP/NDP to it, propagating learned bindings to the UDNs, rather than fanning discovery traffic to every gateway router.
  • Where applicable: OVN-Kubernetes shared-gateway deployments at high UDN count; the Shared MAC-binding scope is a general OVN feature usable beyond ovn-k. Red Hat/NVIDIA collaboration shaping the fix at the right layer.