Pure Underlay using KubeOVN Provider Networks by rrajendran17 · Pull Request #1069 · harvester/docs

rrajendran17 · 2026-06-29T20:23:00Z

Problem:

Document user document for kubeovn underlay installation

Solution:

Document user document for kubeovn underlay installation

Related Issue(s):

harvester/harvester#10154

Test plan:

Additional documentation or context

github-actions · 2026-06-29T21:59:19Z

Name	Link
🔨 Latest commit	`2a79fbd`
😎 Deploy Preview	https://6a4c19341753e060d62be0af--harvester-preview.netlify.app

Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

ibrokethecloud · 2026-07-03T00:57:56Z

PR LGTM. @jillian-maroket should our documentation refer to product as Harvester or SUSE Virtualization? The PR currently refers to Harvester as SUSE Virtualization and we need to keep naming consistent.

mergify · 2026-07-03T00:58:47Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

jillian-maroket · 2026-07-03T03:37:35Z

PR LGTM. @jillian-maroket should our documentation refer to product as Harvester or SUSE Virtualization? The PR currently refers to Harvester as SUSE Virtualization and we need to keep naming consistent.

This PR is for the Harvester doc, so we should use the project name.

harvester/docs - Harvester
rancher/harvester-product-docs - SUSE Virtualization

I'll fix the naming issue when I review the content.

jillian-maroket

Please see my questions and comments. I'll continue my review after I get more information about the config steps.

jillian-maroket · 2026-07-06T07:02:12Z

+#### Create a Subnet in custom or default VPC
+
+1. Go to **Overlay Networks** > **Virtual Private Cloud**.
+
+1. Select **Create Subnet** under `ovn-cluster`


The section title says custom or default VPC, but step 2 tells the user to create the subnet in ovn-cluster. Is that required or just an example?

that is just an example

jillian-maroket · 2026-07-06T07:22:44Z

+1. On the **Basics** tab, configure the following settings:
+
+    - **CIDR Block**.
+    - **Provider Network**.
+    - **Gateway IP**
+    - **Protocol**
+    - **VPC**
+    - **VLAN**


What about the other three settings on the Basic tab? The doc should be clear about whether users can safely keep the defaults or select different values.

https://docs.harvesterhci.io/v1.8/networking/kubeovn-vpc/#subnet-settings - We can link to this.

Other settings (like private subnet,allowed subnets) are optional and there is a new field vlan added in v1.9 which is not available in older v1.18 subnet creation document

jillian-maroket · 2026-07-06T07:25:24Z

+### Underlay Networking Explained
+
+![](/img/pureunderlay.png)


The diagram belongs to the intro section and doesn't need its own heading.

ok, I will move the diagram to the intro section

jillian-maroket · 2026-07-06T07:26:58Z

+### Micro segmentation
+
+Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.


Since micro-segmentation was already mentioned in the intro section, we can add the link there and remove this section altogether.

ok, I will change this

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

jillian-maroket

I've rewritten the text based on the new information.

jillian-maroket · 2026-07-08T07:31:43Z

+
+Furthermore, integrating Kube-OVN’s underlay capabilities into Harvester ensures that virtual machines connected to the physical network do not lose their cloud-native security features. Workloads can still benefit from advanced micro-segmentation capabilities, including subnet ACLs and granular network policies, allowing you to maintain strict traffic control across both virtual and physical network boundaries.Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.
+
+### Underlay Installation


Suggested change

### Underlay Installation

## Underlay Installation

jillian-maroket · 2026-07-08T07:33:02Z

+#### Create a Provider Network
+
+1. Go to > **Underlay Networks**.
+
+1. Select **Create**.
+
+1. Configure the following settings:
+
+    - Name
+    - Description (optional)


Suggested change

#### Create a Provider Network

1. Go to > **Underlay Networks**.

1. Select **Create**.

1. Configure the following settings:

- Name

- Description (optional)

### Create a Provider Network

1. On the Harvester UI, go to **Underlay Networks > Provider Networks**.

1. Click **Create**.

![](/img/pn.png)

1. Specify a unique name for the network.

jillian-maroket · 2026-07-08T07:33:37Z

+1. On the **Interfaces** tab, configure the following settings:
+
+    - Select **Default Interface**. This is any physical or bond interface available on all the Harvester host.The provider network using this spans all nodes in the cluster.
+    - Select **Custom Interfaces**. (Optional). If the interface names are not same on all the nodes in the cluster, user provides specific interface name to nodename mapping.
+      - Interface Name
+      - Nodes
+    - Select **Excluded Nodes**. (Optional). These nodes are excluded from provider network configuration.
+      - Nodes


Suggested change

1. On the **Interfaces** tab, configure the following settings:

- Select **Default Interface**. This is any physical or bond interface available on all the Harvester host.The provider network using this spans all nodes in the cluster.

- Select **Custom Interfaces**. (Optional). If the interface names are not same on all the nodes in the cluster, user provides specific interface name to nodename mapping.

- Interface Name

- Nodes

- Select **Excluded Nodes**. (Optional). These nodes are excluded from provider network configuration.

- Nodes

1. On the **Interfaces** tab, configure the following settings:

- **Default Interface**: Select a physical or bonded interface that is present on every host in your cluster. This interface acts as the main uplink connecting all nodes to the provider network.

- **Custom Interfaces**: (Optional) Configure a custom interface if your hosts do not have identical network interface names. You can manually map specific interface names to their corresponding nodes to ensure consistent network connectivity.

1. (Optional) On the **Excluded Nodes** tab, select nodes that should not participate in this provider network (for example, nodes that are isolated for dedicated tasks).

jillian-maroket · 2026-07-08T07:33:51Z

+    - Select **Excluded Nodes**. (Optional). These nodes are excluded from provider network configuration.
+      - Nodes
+
+    ![](/img/pn.png)


Suggested change

![](/img/pn.png)

1. Click **Create**.

I moved the image to the first step and added this missing final step.

jillian-maroket · 2026-07-08T07:35:04Z

+
+    ![](/img/pn.png)
+
+Refer [Provider Network Configuration](https://kubeovn.github.io/docs/v1.16.x/en/start/underlay/#create-providernetwork)


Suggested change

Refer [Provider Network Configuration](https://kubeovn.github.io/docs/v1.16.x/en/start/underlay/#create-providernetwork)

For more information, see [Create Provider Network](https://kubeovn.github.io/docs/v1.16.x/en/start/underlay/#create-providernetwork) in the Kube-OVN documentation.

jillian-maroket · 2026-07-08T08:16:41Z

+#### Create an Overlay Network
+
+Follow [Create an Overlay Network](https://docs.harvesterhci.io/v1.9/networking/harvester-network#create-an-overlay-network) to create an Overlay Network.


Suggested change

#### Create an Overlay Network

Follow [Create an Overlay Network](https://docs.harvesterhci.io/v1.9/networking/harvester-network#create-an-overlay-network) to create an Overlay Network.

### Create an Overlay Network

Follow the instructions in [Create an Overlay Network](./harvester-network.md#create-an-overlay-network).

jillian-maroket · 2026-07-08T08:20:19Z

+1. Select `kube-system` namespace
+
+1. On the **Basics** tab, configure the following additional settings:
+
+    - Select **OverlayNetwork**.
+    - Select **Network Interface Card** (`The NIC selected here must match the interface provided in Provider Network`)
+
+     ![](/img/vswitchexternal.png)


Suggested change

1. Select `kube-system` namespace

1. On the **Basics** tab, configure the following additional settings:

- Select **OverlayNetwork**.

- Select **Network Interface Card** (`The NIC selected here must match the interface provided in Provider Network`)

![](/img/vswitchexternal.png)

![](/img/vswitchexternal.png)

:::info important

When setting up a pure underlay, the overlay network must use the following configuration:

- **Namespace**: Select `kube-system`.

- **Network Interface Card**: Select the identical physical or bonded network interfaces that you assigned when configuring the provider network.

:::

jillian-maroket · 2026-07-08T08:42:51Z

+#### Create a Subnet in custom or default VPC
+
+Follow [Create a Subnet](https://docs.harvesterhci.io/v1.8/networking/kubeovn-vpc/#subnet-settings)
+
+1. On the **Basics** tab, configure the following additional settings:
+
+    - **VLAN**. Name of the vlan resource configured for the Provider Network.
+
+     ![](/img/subnetexternal.png)


Suggested change

#### Create a Subnet in custom or default VPC

Follow [Create a Subnet](https://docs.harvesterhci.io/v1.8/networking/kubeovn-vpc/#subnet-settings)

1. On the **Basics** tab, configure the following additional settings:

- **VLAN**. Name of the vlan resource configured for the Provider Network.

![](/img/subnetexternal.png)

### Create a Subnet in a VPC

For descriptions of settings that you must configure, see [Subnet Settings](./kubeovn-vpc.md#subnet-settings).

![](/img/subnetexternal.png)

:::info important

When setting up a pure underlay, you must specify the name of the VLAN network that is mapped to the provider network.

:::

jillian-maroket · 2026-07-08T08:44:41Z

+#### Create VMs attached to underlay network using `vswitchexternal`
+Refer [Create a VM](https://docs.harvesterhci.io/v1.9/vm/index#how-to-create-a-vm)


Is this section necessary? The title of the parent section is "Underlay Installation". VM creation seems external to the installation process.

jillian-maroket · 2026-07-08T08:47:37Z

+
+While traditional VLAN networking already enables virtual machines to communicate directly with the physical infrastructure, Kube-OVN's _Underlay_ mode extends this capability by embedding native Layer 2 connectivity directly into the OVN networking control plane. This deep integration allows workloads to leverage your existing physical underlay infrastructure while coexisting seamlessly with standard overlay networks inside the same Kubernetes cluster.
+
+Furthermore, integrating Kube-OVN’s underlay capabilities into Harvester ensures that virtual machines connected to the physical network do not lose their cloud-native security features. Workloads can still benefit from advanced micro-segmentation capabilities, including subnet ACLs and granular network policies, allowing you to maintain strict traffic control across both virtual and physical network boundaries.Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.


Suggested change

Furthermore, integrating Kube-OVN’s underlay capabilities into Harvester ensures that virtual machines connected to the physical network do not lose their cloud-native security features. Workloads can still benefit from advanced micro-segmentation capabilities, including subnet ACLs and granular network policies, allowing you to maintain strict traffic control across both virtual and physical network boundaries.Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.

Furthermore, integrating Kube-OVN’s underlay capabilities into Harvester ensures that virtual machines connected to the physical network do not lose their cloud-native security features. Workloads can still benefit from advanced micro-segmentation capabilities, including [subnet ACLs and granular network policies](./kubeovn-vm-isolation.md), allowing you to maintain strict traffic control across both virtual and physical network boundaries.

github-actions Bot assigned rrajendran17 Jun 29, 2026

rrajendran17 force-pushed the pure-underlay branch 3 times, most recently from d7c99d0 to 5e680af Compare June 29, 2026 21:54

rrajendran17 force-pushed the pure-underlay branch from 5e680af to 233dcc6 Compare June 29, 2026 22:12

Pure Underlay using KubeOVN Provider Networks

770e2e1

Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

rrajendran17 force-pushed the pure-underlay branch from 233dcc6 to 770e2e1 Compare June 29, 2026 23:01

rrajendran17 mentioned this pull request Jun 29, 2026

[FEATURE] Support directly routable VM IPs on the physical network vlan using KubeOVN harvester/harvester#10154

Open

rrajendran17 requested review from a team and jillian-maroket June 29, 2026 23:20

ibrokethecloud previously approved these changes Jul 3, 2026

View reviewed changes

jillian-maroket reviewed Jul 6, 2026

View reviewed changes

Update docs/networking/kubeovn-pureunderlay.md

7ef4eb3

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

rrajendran17 dismissed ibrokethecloud’s stale review via 7ef4eb3 July 6, 2026 19:23

rrajendran17 and others added 6 commits July 6, 2026 12:24

Update docs/networking/kubeovn-pureunderlay.md

0a8d328

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

Update docs/networking/kubeovn-pureunderlay.md

c53e349

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

Update docs/networking/kubeovn-pureunderlay.md

f648538

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

Update docs/networking/kubeovn-pureunderlay.md

528412e

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

Update docs/networking/kubeovn-pureunderlay.md

c6cd4f5

Co-authored-by: Jillian Maroket <67180770+jillian-maroket@users.noreply.github.com> Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

additional details for configuration

8c1a57a

Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

rrajendran17 force-pushed the pure-underlay branch from 87c130a to 8c1a57a Compare July 6, 2026 21:03

Merge branch 'main' into pure-underlay

2a79fbd

rrajendran17 requested a review from jillian-maroket July 7, 2026 16:14

jillian-maroket requested changes Jul 8, 2026

View reviewed changes

		### Micro segmentation

		Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.


		Furthermore, integrating Kube-OVN’s underlay capabilities into Harvester ensures that virtual machines connected to the physical network do not lose their cloud-native security features. Workloads can still benefit from advanced micro-segmentation capabilities, including subnet ACLs and granular network policies, allowing you to maintain strict traffic control across both virtual and physical network boundaries.Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.

		### Underlay Installation


		![](/img/pn.png)

		Refer [Provider Network Configuration](https://kubeovn.github.io/docs/v1.16.x/en/start/underlay/#create-providernetwork)

	Refer [Provider Network Configuration](https://kubeovn.github.io/docs/v1.16.x/en/start/underlay/#create-providernetwork)
	For more information, see [Create Provider Network](https://kubeovn.github.io/docs/v1.16.x/en/start/underlay/#create-providernetwork) in the Kube-OVN documentation.

		#### Create an Overlay Network

		Follow [Create an Overlay Network](https://docs.harvesterhci.io/v1.9/networking/harvester-network#create-an-overlay-network) to create an Overlay Network.

		#### Create VMs attached to underlay network using `vswitchexternal`
		Refer [Create a VM](https://docs.harvesterhci.io/v1.9/vm/index#how-to-create-a-vm)


		While traditional VLAN networking already enables virtual machines to communicate directly with the physical infrastructure, Kube-OVN's _Underlay_ mode extends this capability by embedding native Layer 2 connectivity directly into the OVN networking control plane. This deep integration allows workloads to leverage your existing physical underlay infrastructure while coexisting seamlessly with standard overlay networks inside the same Kubernetes cluster.

		Furthermore, integrating Kube-OVN’s underlay capabilities into Harvester ensures that virtual machines connected to the physical network do not lose their cloud-native security features. Workloads can still benefit from advanced micro-segmentation capabilities, including subnet ACLs and granular network policies, allowing you to maintain strict traffic control across both virtual and physical network boundaries.Use [Network Isolation](https://docs.harvesterhci.io/v1.9/networking/kubeovn-vm-isolation) to achieve microsegmentation of VMs using underlay Network.

Uh oh!

Conversation

rrajendran17 commented Jun 29, 2026

Problem:

Solution:

Related Issue(s):

Test plan:

Additional documentation or context

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ibrokethecloud commented Jul 3, 2026

Uh oh!

mergify Bot commented Jul 3, 2026

Uh oh!

jillian-maroket commented Jul 3, 2026

Uh oh!

jillian-maroket left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jillian-maroket left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jun 29, 2026 •

edited

Loading