Skip to content

Route scope delimitation as a control plane scalability mechanism for OVN Interconnect using route tags#

Open vSwitch and OVN 2026 Fall Conference digest Program Core pick 2–4 November 2026

Abstract

Lucas Vargas Dias, Magalu Cloud; Julio Cesar Vanti, Magalu Cloud

  • Why: One of the few talks with a hard quantified result: topological isolation (per-peering transit switch) costs 2.56x the Southbound logical flows of tag-based route scoping for identical connectivity. That's a real, transferable design trade-off for anyone building multi-AZ VPC peering on OVN-IC.
  • What: A comparison of two ways to bound route exchange between peered VPCs in OVN Interconnect: a transit switch per peering (data-plane isolation, expensive) vs. one shared transit switch with declarative scoping via ic-route-tag / ic-route-learn-tag-rules / ic-route-filter-tag (control-plane isolation, substantially cheaper in memory, in northd full-recompute latency, in flow installation after reconnect, and in every unrelated NB write). The trade-off is stated plainly: tag scoping constrains route learning only; a manual static route can still cross the shared L2 domain, so per-pair topology remains necessary where data-plane isolation must hold. (from abstract only)
  • How: Measurement-driven comparison of lflow-node recomputes, flow counts, and operation latency between the two topologies on identical connectivity.
  • Where applicable: Any OVN-IC VPC-peering deployment; the technique is upstream OVN configuration (general), the numbers come from Magalu Cloud's production-derived testing. Isolation requirements (control-plane-only vs. data-plane) decide which option is valid.