Subscribe to the feed

Until recently, the existing vlan/macvlan/ipvlan CNI plugins only allowed users to create a VLAN subinterface based on a master interface in the host network namespace, and place the VLAN subinterface inside the container namespace.

Vlan based on node namespaced master

This approach had several drawbacks, the main being issues connected to configuration:

  • A preconfigured master interface had to be present on the nodes.
  • The vlan/macvlan/ipvlan configuration required knowledge about the node network configuration.
  • Multiple network-attachment-definitions needed to be configured to use with different master/vlan combinations. Effectively a single network-attachment-definition could only be used on only one pod.
  • The network-attachment-definitions had to be bound to nodes, since the available masters on different nodes could differ.
  • The user had to keep track of which master/vlan combinations were already in use.

A recent feature coming in OpenShift 4.13 (Developer Preview)  allows the vlan/macvlan/ipvlan interfaces to be configured using container namespace master interfaces.

Vlan based on container namespaced master.

This allows to create the master interfaces as part of the pod network configuration in a separate network-attachment-definition, and base the vlan/macvlan/ipvlan on this interface without requiring the knowledge of the network configuration of the node.


The feature will be available in OpenShift 4.13 as Developer Preview. No further installation is required.

Configuring a vlan/macvlan/ipvlan with container namespace master

To request the use of a container namespace master interface a new parameter “linkInContainer” has been added to the vlan/macvlan/ipvlan plugin configuration:

       "name": "mynet",
       "cniVersion": "0.4.0",
       "type": "vlan",
       "master": "eth0",
       "mtu": 1500,
       "vlanId": 73,
       "linkInContainer": true


A sample use case for the use of the new feature is to create VLANs based on SR-IOV Virtual Functions. For this a SR-IOV network must be created, followed by the network-attachment definitions for the VLAN interface:

kind: SriovNetwork
name: sriov-network
namespace: openshift-sriov-network-operator
networkNamespace: mynamespace
resourceName: sriovnic
spoofChk: "off"
trust: "on"
kind: SriovNetworkNodePolicy
name: sriovnic
namespace: openshift-sriov-network-operator
deviceType: netdevice
isRdma: false
needVhostNet: true
  - ens3f0#0-4
numVfs: 10
priority: 99
resourceName: sriovnic

Followed by a VLAN network-attachment definition:

kind: NetworkAttachmentDefinition
name: vlan-73
namespace: mynamespace
config: '{
  "cniVersion": "0.4.0",
  "name": "vlan-73",
  "plugins": [
      "type": "vlan",
      "master": "ext0", 
      "mtu": 1500,
      "vlanId": 73,
      "linkInContainer": true, ❶
      "ipam": {...}


Note : the vlan configuration needs to specify the master name. This can be configured in the pod networks annotation, as shown below.

Note ❶: the linkInContainer parameter must be specified

The pod definition using the above specified networks must use the following networks annotation:

apiVersion: v1
kind: Pod
annotations: '[
     "name": "sriov-network",
     "namespace": "mmirecki",
     "interface": "ext0"      
     "name": "vlan-73",
     "namespace": "mmirecki",
     "interface": "ext0.73"


Note : The name to be used as the master for the vlan interface.

Use case example

A example use case for this feature is the use of the vlan/macvlan/ipvlan based on SR-IOV virtual functions.

Multiple VLANs can be used with a single virtual function as the master interface. To allow additional configuration the tuning plugin can be used to further tune the created VLAN interfaces. The entire process can be performed in an automated manner, with no knowledge about the node interfaces other than that required to configure the SRIOV plugin.


The TAP device feature will be available in OpenShift 4.13 as Developer Preview.

The use cases for the feature and available options are based on limited customer feedback. Additional feedback on possible use cases and missing functionality are welcome. Please contact your Red Hat account manager for further details.

About the author


Browse by channel

automation icon


The latest on IT automation for tech, teams, and environments

AI icon

Artificial intelligence

Updates on the platforms that free customers to run AI workloads anywhere

open hybrid cloud icon

Open hybrid cloud

Explore how we build a more flexible future with hybrid cloud

security icon


The latest on how we reduce risks across environments and technologies

edge icon

Edge computing

Updates on the platforms that simplify operations at the edge

Infrastructure icon


The latest on the world’s leading enterprise Linux platform

application development icon


Inside our solutions to the toughest application challenges

Original series icon

Original shows

Entertaining stories from the makers and leaders in enterprise tech