Stateless Load Balancing in OVN#
Open vSwitch and OVN 2026 Fall Conference digest Program Adjacent pick 2–4 November 2026
Alexandra Rukomoinikova, K2 Cloud
- Why: Horizontal gateway scaling is blocked by conntrack pinning every connection to one gateway chassis. Rather than sync conntrack (the usual answer), this moves the NAT to the backend's hypervisor — a different architectural point in the design space, in production at a cloud provider.
- What: The story of the new "deferred-nat" load balancer option: backend selected statelessly per packet on the router, packet delivered by MAC, DNAT and conntrack state created on the backend's own hypervisor; established sessions survive backend changes via incremental select-group updates instead of rebuilds. Includes why conntrack synchronization, extending
use_stateless_nat, and cross-AZ backends were rejected. (from abstract only) - How: NAT deferred to the backend hypervisor, eliminating per-gateway conntrack state as the horizontal-scaling bottleneck.
- Where applicable: OVN deployments needing horizontally scalable load-balancer gateways (public/private cloud). K2 Cloud runs it in production; work remains (per the speakers). Requires OVN support for the deferred-nat option.