Understanding Red Hat OpenShift networking options as a VMware admin

Feature VMware OpenShift

Host network configuration and management Per-host configuration via vSwitch or single point management via Distributed Virtual Switch (DvSwitch) NMstate Operator and Multus

Software-defined networking: protect/limit/control VM-to-VM communication Multiple capabilities here, e.g. QinQ, but this is most often referring to NSX’s microsegmentation, a.k.a. distributed firewall

OpenShift SDN provides a robust networking solution with OVN (Open Virtual Networking). Overlay based networking uses Generic Network Virtualization Encapsulation GENEVE which tunnels to enable VM-to-VM communication

• IP Address Management (IPAM) allocation
• Expose services through Load Balancers
• Network Policies through OVN Access Control Lists (ACLs)
• Supports IPv4/IPv6 Dual-Stack clusters
• Fine grained Cluster Egress Traffic Controls
• Advanced networking features such as hardware offload, micro segmentation, secondary networks, IP Multicast using OVN IGMP snooping and relays

User Define Networks (UDN) Isolate namespaces natively using networks - pods can only talk to other pods that are in the same namespace.

Can be configured as a primary network as layer2 or 3 network types.

Reduction network policy complexity.

Reuse of IP subnets access different namespaces and clusters.

Pod-to-VM and VM-to-Pod connectivity Traffic between Pods and VMs must traverse through the Kubernetes ingress or similar mechanism, e.g. NodePort VMs and Pods are native peers when connected to the SDN or the same UDN, with all of the features and capabilities equally available to both

Network observability vSwitch port mirroring to third party solutions and NSX traffic analysis for security purposes Network Observability Operator

OpenShift Virtualization menu item VMware comparable Explanation

NodeNetworkConfigurationPolicyosc

(NMState Operator needed)

vSwitch/DvSwitch Desired network configuration on cluster nodes

NodeNetworkState

(NMstate Operator needed)

Similar to v/DvSwitch view at ESX/vCenter Network status on nodes

Service N/A Layer4 load balancing configurations with self-discovery and automatic DNS internal to the SDN. Combined with ingress LB solutions such as MetalLB or Cloud provided load balancing it allows to expose services outside the cluster

Routes and Ingresses NSX Load Balancer

Routes: Application load balancing configurations to expose web services outside the cluster

Ingresses: Accessing application with unique hostname

NetworkPolicy NSX-T Firewall (Microsegmentation Rules) Manage application-centric network policies

NetworkAttachmentDefinitions Port Groups Virtual machine connectivity to networks, e.g. VLANs, private networks, etc.

UserDefinedNetwork NSX-T Overlay Segments Create and manage overlay network segments