Skip to content

Upgrading network control plane and ovs-vswitchd with kernel datapath without impacting users#

Open vSwitch and OVN 2026 Fall Conference digest Program Core pick 2–4 November 2026

Abstract

Aleksandr Ankudinov, Nebius

  • Why: Live-upgrading the network data plane of a large public cloud without user-visible impact is one of the hardest ops problems in the field. Nebius shares the actual tricks — including running two ovs-vswitchd in parallel, "doing the forbidden" — which is gold for anyone operating OVS-based infrastructure in Kubernetes.
  • What: Techniques for restarting/replacing the three components (vpc-agent, ovs-vswitchd, OVS kernel module) while existing flows keep traffic flowing: flow cookies as version tags for cleanup, OpenFlow note actions as cross-restart storage, disciplined group-ID allocation, and the parallel-vswitchd upgrade dance with flow-restore-wait — including how to make two daemons fight and how to make them stop. Plus the Kubernetes-specific oddities, and a theoretical scheme for loading two OVS kernel modules at once. (from abstract only)
  • How: Desired-state reconciliation over versioned flows, plus dual-daemon handover during upgrade; kernel module itself is not hot-upgraded today.
  • Where applicable: Nebius public-cloud specifics (kernel datapath, agent-based control), but the versioning/reconciliation patterns apply to any OVS/OpenFlow deployment. The parallel-daemon scheme carries real risk — treat as inspiration, not recipe.