Attaching a virtual machine to multiple networks

You can attach virtual machines to multiple networks by using Linux bridges. You can also import virtual machines with existing workloads that depend on access to multiple interfaces.

To attach a virtual machine to an additional network:

  1. Configure a bridge network attachment definition for a namespace in the web console or CLI.

  2. Attach the virtual machine to the network attachment definition by using either the web console or the CLI:

    • In the web console, create a NIC for a new or existing virtual machine.

    • In the CLI, include the network information in the virtual machine configuration.

OKD Virtualization networking glossary

OKD Virtualization provides advanced networking functionality by using custom resources and plug-ins.

The following terms are used throughout OKD Virtualization documentation:

Container Network Interface (CNI)

a Cloud Native Computing Foundation project, focused on container network connectivity. OKD Virtualization uses CNI plug-ins to build upon the basic Kubernetes networking functionality.

Multus

a “meta” CNI plug-in that allows multiple CNIs to exist so that a pod or virtual machine can use the interfaces it needs.

Custom resource definition (CRD)

a Kubernetes API resource that allows you to define custom resources, or an object defined by using the CRD API resource.

Network attachment definition

a CRD introduced by the Multus project that allows you to attach pods, virtual machines, and virtual machine instances to one or more networks.

Preboot eXecution Environment (PXE)

an interface that enables an administrator to boot a client machine from a server over the network. Network booting allows you to remotely load operating systems and other software onto the client.

Creating a network attachment definition

Prerequisites

  • A Linux bridge must be configured and attached on every node. See the node networking section for more information.

Configuring ipam in a network attachment definition for virtual machines is not supported.

Creating a Linux bridge network attachment definition in the web console

The network attachment definition is a custom resource that exposes layer-2 devices to a specific namespace in your OKD Virtualization cluster.

Network administrators can create network attachment definitions to provide existing layer-2 networking to pods and virtual machines.

Procedure

  1. In the web console, click Networking → Network Attachment Definitions.

  2. Click Create Network Attachment Definition .

  3. Enter a unique Name and optional Description.

  4. Click the Network Type list and select CNV Linux bridge.

  5. Enter the name of the bridge in the Bridge Name field.

  6. Optional: If the resource has VLAN IDs configured, enter the ID numbers in the VLAN Tag Number field.

  7. Click Create.

Creating a Linux bridge network attachment definition in the CLI

As a network administrator, you can configure a network attachment definition of type cnv-bridge to provide Layer-2 networking to pods and virtual machines.

Prerequisites

  • The network attachment definition must be in the same namespace as the pod or virtual machine.

  • The node must support nftables and the nft binary must be deployed to enable MAC spoof check.

Procedure

  1. Create a network attachment definition manifest. The manifest must have the following contents, modified to match your configuration:

    1. apiVersion: "k8s.cni.cncf.io/v1"
    2. kind: NetworkAttachmentDefinition
    3. metadata:
    4.   name: <a-bridge-network> (1)
    5.   annotations:
    6.     k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/<bridge-interface> (2)
    7. spec:
    8.   config: '{
    9.     "cniVersion": "0.3.1",
    10.     "name": "<a-bridge-network>", (3)
    11.     "type": "cnv-bridge", (4)
    12.     "bridge": "<bridge-interface>", (5)
    13.     "macspoofchk": true, (6)
    14.     "vlan": 1 (7)
    15.   }'
    1The name for the NetworkAttachmentDefinition object.
    2Optional: Annotation key-value pair for node selection, where bridge-interface is the name of a bridge configured on some nodes. If you add this annotation to your network attachment definition, your virtual machine instances will only run on the nodes that have the bridge-interface bridge connected.
    3The name for the configuration. It is recommended to match the configuration name to the name value of the network attachment definition.
    4The actual name of the Container Network Interface (CNI) plug-in that provides the network for this network attachment definition. Do not change this field unless you want to use a different CNI.
    5The name of the Linux bridge configured on the node.
    6Optional: Flag to enable MAC spoof check. When set to true, you cannot change the MAC address of the pod or guest interface. This attribute provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.
    7Optional: The VLAN tag.

  2. Create the network attachment definition:

    1. $ oc create -f <network-attachment-definition.yaml> (1)
    1Where <network-attachment-definition.yaml> is the file name of the network attachment definition manifest.

Verification

  • Verify that the network attachment definition is created by running either oc get network-attachment-definition <name> or oc get net-attach-def <name>. For example:

    1. $ oc get network-attachment-definition <a-bridge-network> (1)
    1Where <a-bridge-network> is the name specified in the network attachment definition config.

Attaching the virtual machine to the additional network

Creating a NIC for a virtual machine in the web console

Create and attach additional NICs to a virtual machine from the web console.

Procedure

  1. In the correct project in the OKD Virtualization console, click Workloads → Virtualization from the side menu.

  2. Click the Virtual Machines tab.

  3. Select a virtual machine to open the Virtual Machine Overview screen.

  4. Click Network Interfaces to display the NICs already attached to the virtual machine.

  5. Click Add Network Interface to create a new slot in the list.

  6. Use the Network drop-down list to select the network attachment definition for the additional network.

  7. Fill in the Name, Model, Type, and MAC Address for the new NIC.

  8. Click Add to save and attach the NIC to the virtual machine.

Networking fields

NameDescription

Name

Name for the network interface controller.

Model

Indicates the model of the network interface controller. Supported values are e1000e and virtio.

Network

List of available network attachment definitions.

Type

List of available binding methods. For the default pod network, masquerade is the only recommended binding method. For secondary networks, use the bridge binding method. The masquerade method is not supported for non-default networks. Select SR-IOV if you configured an SR-IOV network device and defined that network in the namespace.

MAC Address

MAC address for the network interface controller. If a MAC address is not specified, one is assigned automatically.

Attaching a virtual machine to a secondary network in the CLI

Attach a virtual machine to a secondary network by adding a bridge interface and specifying a network attachment definition in the virtual machine configuration.

This procedure uses a YAML file to demonstrate editing the configuration and applying the updated file to the cluster. You can alternatively use the oc edit <object> <name> command to edit an existing virtual machine.

Prerequisites

  • Shut down the virtual machine before editing the configuration. If you edit a running virtual machine, you must restart the virtual machine for the changes to take effect.

Procedure

  1. Create or edit a virtual machine configuration that you want to connect to the bridge network. Add the bridge interface to the spec.template.spec.domain.devices.interfaces list and the network attachment definition to the spec.template.spec.networks list. The name of the interfaces entry must be the same as the networks entry. The following example adds a bridge interface called bridge-net that connects to the a-bridge-network network attachment definition:

    1. apiVersion: v1
    2. kind: VirtualMachine
    3. metadata:
    4.     name: example-vm
    5. spec:
    6.   template:
    7.     spec:
    8.       domain:
    9.         devices:
    10.           interfaces:
    11.             - masquerade: {}
    12.               name: default
    13.             - bridge: {}
    14.               name: bridge-net (1)
    15. ...
    16.       networks:
    17.         - name: default
    18.           pod: {}
    19.         - name: bridge-net (2)
    20.           multus:
    21.             networkName: <network-namespace>/<a-bridge-network> (3)
    22. ...
    1The name of the bridge interface.
    2The name of the bridge interface. This value must match the name value of the corresponding spec.template.spec.networks entry.
    3The name of the network attachment definition, prefixed by the namespace where it exists. The namespace must be either the default namespace or the same namespace where the VM is to be created.

  2. Apply the configuration:

    1. $ oc apply -f <example-vm.yaml>

  3. Optional: If you edited a running virtual machine, you must restart it for the changes to take effect.

Additional resources