Iscriviti al feed

Until recently, the existing vlan/macvlan/ipvlan CNI plugins only allowed users to create a VLAN subinterface based on a master interface in the host network namespace, and place the VLAN subinterface inside the container namespace.

Vlan based on node namespaced master

This approach had several drawbacks, the main being issues connected to configuration:

  • A preconfigured master interface had to be present on the nodes.
  • The vlan/macvlan/ipvlan configuration required knowledge about the node network configuration.
  • Multiple network-attachment-definitions needed to be configured to use with different master/vlan combinations. Effectively a single network-attachment-definition could only be used on only one pod.
  • The network-attachment-definitions had to be bound to nodes, since the available masters on different nodes could differ.
  • The user had to keep track of which master/vlan combinations were already in use.

A recent feature coming in OpenShift 4.13 (Developer Preview)  allows the vlan/macvlan/ipvlan interfaces to be configured using container namespace master interfaces.

Vlan based on container namespaced master.

This allows to create the master interfaces as part of the pod network configuration in a separate network-attachment-definition, and base the vlan/macvlan/ipvlan on this interface without requiring the knowledge of the network configuration of the node.


The feature will be available in OpenShift 4.13 as Developer Preview. No further installation is required.

Configuring a vlan/macvlan/ipvlan with container namespace master

To request the use of a container namespace master interface a new parameter “linkInContainer” has been added to the vlan/macvlan/ipvlan plugin configuration:

       "name": "mynet",
       "cniVersion": "0.4.0",
       "type": "vlan",
       "master": "eth0",
       "mtu": 1500,
       "vlanId": 73,
       "linkInContainer": true


A sample use case for the use of the new feature is to create VLANs based on SR-IOV Virtual Functions. For this a SR-IOV network must be created, followed by the network-attachment definitions for the VLAN interface:

kind: SriovNetwork
name: sriov-network
namespace: openshift-sriov-network-operator
networkNamespace: mynamespace
resourceName: sriovnic
spoofChk: "off"
trust: "on"
kind: SriovNetworkNodePolicy
name: sriovnic
namespace: openshift-sriov-network-operator
deviceType: netdevice
isRdma: false
needVhostNet: true
  - ens3f0#0-4
numVfs: 10
priority: 99
resourceName: sriovnic

Followed by a VLAN network-attachment definition:

kind: NetworkAttachmentDefinition
name: vlan-73
namespace: mynamespace
config: '{
  "cniVersion": "0.4.0",
  "name": "vlan-73",
  "plugins": [
      "type": "vlan",
      "master": "ext0", 
      "mtu": 1500,
      "vlanId": 73,
      "linkInContainer": true, ❶
      "ipam": {...}


Note : the vlan configuration needs to specify the master name. This can be configured in the pod networks annotation, as shown below.

Note ❶: the linkInContainer parameter must be specified

The pod definition using the above specified networks must use the following networks annotation:

apiVersion: v1
kind: Pod
annotations: '[
     "name": "sriov-network",
     "namespace": "mmirecki",
     "interface": "ext0"      
     "name": "vlan-73",
     "namespace": "mmirecki",
     "interface": "ext0.73"


Note : The name to be used as the master for the vlan interface.

Use case example

A example use case for this feature is the use of the vlan/macvlan/ipvlan based on SR-IOV virtual functions.

Multiple VLANs can be used with a single virtual function as the master interface. To allow additional configuration the tuning plugin can be used to further tune the created VLAN interfaces. The entire process can be performed in an automated manner, with no knowledge about the node interfaces other than that required to configure the SRIOV plugin.


The TAP device feature will be available in OpenShift 4.13 as Developer Preview.

The use cases for the feature and available options are based on limited customer feedback. Additional feedback on possible use cases and missing functionality are welcome. Please contact your Red Hat account manager for further details.



Ricerca per canale

automation icon


Novità sull'automazione IT di tecnologie, team e ambienti

AI icon

Intelligenza artificiale

Aggiornamenti sulle piattaforme che consentono alle aziende di eseguire carichi di lavoro IA ovunque

open hybrid cloud icon

Hybrid cloud open source

Scopri come affrontare il futuro in modo più agile grazie al cloud ibrido

security icon


Le ultime novità sulle nostre soluzioni per ridurre i rischi nelle tecnologie e negli ambienti

edge icon

Edge computing

Aggiornamenti sulle piattaforme che semplificano l'operatività edge

Infrastructure icon


Le ultime novità sulla piattaforma Linux aziendale leader a livello mondiale

application development icon


Approfondimenti sulle nostre soluzioni alle sfide applicative più difficili

Original series icon

Serie originali

Raccontiamo le interessanti storie di leader e creatori di tecnologie pensate per le aziende