Skip to content

Subnets

A subnet is an isolated pod network together with the project that owns it. Creating one gives you three things at once: a new project named after the subnet, admin access to that project, and a network attached to it.

Workloads deployed into that project attach to the network automatically.

For the same steps in the console, see the console walkthrough.

Public or private

Private Public
Objects A network A network, plus a route advertisement
Reachable from Workloads on this cluster Outside the cluster too
Address range Yours to choose From the platform's public pool

A public subnet advertises its range to the network fabric, so workloads on it are reachable from outside. A private subnet - the default - stays inside the cluster.

Create

You create one object: a project carrying the range you want. The platform builds the network from it, and the route advertisement too when the subnet is public.

cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: <subnet>
  annotations:
    hoolia.eu/subnet-cidr: <cidr>
    hoolia.eu/subnet-type: Public
EOF

Omit hoolia.eu/subnet-type, or set it to Private, and no advertisement is created, so nothing leaves the cluster. The value is case-sensitive: anything other than Public or Private is refused rather than quietly treated as private.

Watch the network appear:

oc get clusteruserdefinednetworks.k8s.ovn.org <subnet> -w

Why a project and not the objects themselves

The network and the advertisement are cluster-scoped and have to agree with the project that selects them. Creating a project is also the only one of the three you have the rights to do - so you describe what you want, and the platform writes the rest.

Choosing a range

Public subnets are carved out of the platform's public pool, with a prefix of /28 or /29. The pool is small and shared, so pick a range nobody else is using - the subnet list shows every range already claimed.

The platform takes the first two usable addresses: the first becomes the gateway workloads route through, the second the node management port. OVN reserves both itself, so a /29 gives four usable addresses, not six.

An out-of-pool or overlapping range is rejected at admission

A cluster policy checks the range when you submit. The rejection message names the problem, and costs you one attempt rather than leaving a broken subnet behind.

Private subnets take any private range that does not overlap an existing one.

List

oc get clusteruserdefinednetworks.k8s.ovn.org
oc get routeadvertisements.k8s.ovn.org

A subnet with a matching route advertisement is public; one without is private.

To see which ranges are taken:

oc get clusteruserdefinednetworks.k8s.ovn.org -o custom-columns=\
NAME:.metadata.name,SUBNETS:.spec.network.layer2.subnets,\
RESERVED:.spec.network.layer2.reservedSubnets

Change

A subnet's address range cannot be changed. The network is created with it, and workloads get addresses from it.

Making a private subnet public means adding a route advertisement for it; making a public one private means deleting that advertisement. The network itself is unchanged either way.

Delete

Delete the network. The project and the advertisement belong to it and go with it.

oc delete clusteruserdefinednetworks.k8s.ovn.org <subnet>

Delete the network, not the project

oc delete project <subnet> on its own never finishes. The project holds a network attachment whose finalizer is only released when the network is deleted, and the network is not removed while the project is still terminating - so the two wait on each other. If you have already started one, deleting the network releases it.

Deleting the network deletes the project and every workload in it. Move anything you want to keep to another project first.