OVN-Kubernetes Architecture - Red Hat OpenShift

Control Plane

OpenShift 4.14+ Cluster-Wide

Kubernetes API Server

Central control plane - manages all cluster resources

ovnkube-cluster-manager

Allocates pod subnet ranges to each node

Node 1

Per-Node Network Stack

ovnkube-controller

Watches Kubernetes API and programs network policy

OVN Northbound DB

Logical network topology (pods, networks, ACLs)

ovn-northd

Translates logical → physical network flows

OVN Southbound DB

Physical bindings and flow programming

ovn-controller

Programs OpenFlow rules into OVS

Open vSwitch (br-int)

Data plane - actual packet forwarding

Node 2

Per-Node Network Stack

ovnkube-controller

Watches Kubernetes API and programs network policy

OVN Northbound DB

Logical network topology (pods, networks, ACLs)

ovn-northd

Translates logical → physical network flows

OVN Southbound DB

Physical bindings and flow programming

ovn-controller

Programs OpenFlow rules into OVS

Open vSwitch (br-int)

Data plane - actual packet forwarding

📊 How It Works

1. Control Plane: Kubernetes API Server receives pod/service creation requests. The cluster-manager allocates subnet ranges to nodes.

2. Logical Layer (Amber): ovnkube-controller watches the API and writes logical network config to the Northbound DB (networks, routers, ACLs).

3. Translation Layer (Orange): ovn-northd translates logical configuration into physical flows and stores them in the Southbound DB.

4. Data Plane (Purple): ovn-controller reads the Southbound DB and programs OpenFlow rules into OVS, which forwards actual packets.

5. Cross-Node Traffic: OVS bridges on different nodes communicate via Geneve tunnels for pod-to-pod traffic across nodes.

Control Layer (Kubernetes API)

Logical Network (Intent)

Physical Translation

Data Plane (Packet Forwarding)