OVN-Kubernetes
ovn-kubernetes.io
What it is
OVN-Kubernetes is a free, open-source networking solution and CNI-conformant plugin for Kubernetes, built on OVN and Open vSwitch. It handles pod IP allocation and interfaces, GENEVE overlays, Kubernetes Services, EndpointSlices, network policies, and IPv4/IPv6 dual-stack clusters. OVN ACLs enforce NetworkPolicy, AdminNetworkPolicy, and EgressFirewall rules; EgressIP, EgressService, and EgressQoS govern outbound traffic. Pods can join multiple networks, and the project also supports multicast, traffic shaping, BGP route advertisements, and SmartNIC or DPU offload. For KubeVirt, it provides persistent IPs during live migration; Hybrid Overlay enables mixed Windows and Linux networking. Deployment documentation covers Kind, Helm, DPU acceleration, kubeadm, and source builds. Requirements depend on OVN, nft, Multus, CNI, and Kubernetes versions; the master branch lists Kubernetes 1.33 or newer. Secondary User Defined Networks currently lack north-south traffic and core Kubernetes Services support. AdminNetworkPolicy APIs remain alpha and may change before stable v1.
Spec sheet
- What it does
- OVN-Kubernetes is an open-source Kubernetes networking solution and CNI-conformant plugin built on OVN and Open vSwitch.Read 1 Oct 2026 · ovn-kubernetes.io
- Purpose
- OVN-Kubernetes is an open-source Kubernetes networking solution and CNI-conformant plugin built on OVN and Open vSwitch.Read 30 Sep 2026 · ovn-kubernetes.io
- Audience
- The project says its features are critical to enterprise and telco users and aims to provide a scalable, performant Kubernetes networking platform.Read 1 Oct 2026 · ovn-kubernetes.io
- Deployment
- It can be deployed on Kubernetes with Helm or kubeadm, run in Kind for development and testing, and installed with DPU acceleration.Read 1 Oct 2026 · ovn-kubernetes.io
- Support
- The project holds open community meetings on alternate Mondays at 5:00 PM CET/CEST using CNCF Zoom.Read 1 Oct 2026 · ovn-kubernetes.io
- Founded
- 2014Read 28 Sep 2026 · ovn-kubernetes.io
- Advanced networking
- It supports hybrid Windows/Linux networking, IP multicast, OVS hardware offload, and secondary or local networks.Read 1 Oct 2026 · ovn-kubernetes.io
- API surface
- OVN-Kubernetes documents Custom Resource Definitions for EgressIP, EgressService, EgressQoS, EgressFirewall, UserDefinedNetwork, RouteAdvertisements, ClusterNetworkConnect, and VTEP.Read 1 Oct 2026 · ovn-kubernetes.io
- BGP dependency
- The Route Advertisements feature requires FRR-k8s.Read 1 Oct 2026 · ovn-kubernetes.io
- BGP integration
- Route Advertisements integrates BGP to import provider-network routes into OVN pod networks and export pod and egress-IP routes to BGP peers.Read 1 Oct 2026 · ovn-kubernetes.io
- Container platforms
- Ubuntu- and Fedora-based container images are available in GitHub's Registry.Read 1 Oct 2026 · ovn-kubernetes.io
- Core networking
- It provides pod IPAM and veth interfaces, GENEVE overlay networking, Kubernetes Services and EndpointSlices, NetworkPolicies, AdminNetworkPolicies, and IPv4/IPv6 dual-stack support.Read 30 Sep 2026 · ovn-kubernetes.io
- Dependencies
- The requirements matrix lists OVN, nft, Multus, CNI, and Kubernetes versions; the master branch lists Kubernetes 1.33 or newer.Read 30 Sep 2026 · ovn-kubernetes.io
- Egress controls
- It supports Multiple External Gateways, DSCP QoS, EgressIP, EgressService, and Egress Firewall controls.Read 1 Oct 2026 · ovn-kubernetes.io
- Hardware acceleration
- OVN-Kubernetes can offload OVS datapath processing to SmartNICs and DPUs.Read 30 Sep 2026 · ovn-kubernetes.io
- Kubernetes networking
- It provides pod networking, IPAM, veth interfaces, GENEVE overlays, Kubernetes Services, EndpointSlices, NetworkPolicies, AdminNetworkPolicies, and IPv4/IPv6 dual-stack support.Read 1 Oct 2026 · ovn-kubernetes.io
- KubeVirt integration
- It provides persistent IPs and seamless networking for KubeVirt virtual-machine live migrations.Read 1 Oct 2026 · ovn-kubernetes.io
- Multi-networking
- Pods can attach to multiple networks using multi-homing and multi-network policies.Read 30 Sep 2026 · ovn-kubernetes.io
- Multicast
- OVN-Kubernetes supports IGMP snooping and multicast relay through OVN.Read 30 Sep 2026 · ovn-kubernetes.io
- Multinetworking
- Pods can attach to multiple networks using multi-homing and multi-network policies.Read 1 Oct 2026 · ovn-kubernetes.io
- Network security
- NetworkPolicy, AdminNetworkPolicy, and EgressFirewall are enforced through OVN ACLs.Read 30 Sep 2026 · ovn-kubernetes.io
- Network segmentation
- Its feature set includes user-defined networks, network segmentation, and cross-network connectivity.Read 1 Oct 2026 · ovn-kubernetes.io
- Node security
- Node Identity uses per-node client certificates and a validating admission webhook to enforce granular ovnkube-node permissions.Read 1 Oct 2026 · ovn-kubernetes.io
- Policy maturity
- AdminNetworkPolicy and BaselineAdminNetworkPolicy are v1alpha1 APIs subject to change before stable v1.Read 1 Oct 2026 · ovn-kubernetes.io
- Quality of service
- NetworkQoS provides DSCP marking and traffic shaping for pod network traffic.Read 30 Sep 2026 · ovn-kubernetes.io
- Secondary-network limit
- Secondary User Defined Networks currently lack north-south traffic and core Kubernetes Services support.Read 30 Sep 2026 · ovn-kubernetes.io
- Security response
- Dependabot scans the repository for security updates, and vulnerability reports use GitHub Private Vulnerability Reporting with an intended response within 48 hours.Read 30 Sep 2026 · ovn-kubernetes.io
- Target users
- The project focuses on Kubernetes networking capabilities important to enterprise and telco users.Read 30 Sep 2026 · ovn-kubernetes.io
- Virtual machine migration
- It supports persistent IPs and seamless networking for KubeVirt VM live migrations.Read 30 Sep 2026 · ovn-kubernetes.io
- Windows support
- Hybrid Overlay provides mixed Windows/Linux cluster networking using VXLAN tunnels.Read 30 Sep 2026 · ovn-kubernetes.io
Strong points and limits
Strong points
- Supports IPv4/IPv6 dual-stack networking
- Enforces network policies through OVN ACLs
- Offers egress controls and multi-network pod attachment
- Supports KubeVirt live migration with persistent IPs
- Free and documents several deployment paths
Limits
- Secondary User Defined Networks lack north-south traffic
- Secondary networks lack core Kubernetes Services support
- AdminNetworkPolicy APIs are still alpha
- Master branch lists Kubernetes 1.33 or newer
Who it suits
It suits enterprise and telco teams building Kubernetes networking, including clusters that need policy controls, multiple networks, or mixed Windows and Linux nodes. The documented version requirements and secondary-network limits matter when planning deployment.
Verdict
OVN-Kubernetes covers core cluster networking alongside egress, policy, multi-network, and hardware-offload capabilities. Check the version matrix and secondary-network gaps against the cluster design before adopting it.
Where Specifiction places it
- Microsegmentation Software#13 of 317.4
- Container Networking Software#15 of 287.4
Alternatives to OVN-KubernetesAll alternatives →
Akamai Guardicore Segmentation 8.5 Visit 
ColorTokens Xshield 8.1 Visit 
Calico Open Source Free plan 8.0 Visit 
Illumio Segmentation 8.0 Visit 
Cilium Free plan 7.9 Visit 
Elisity Microsegmentation 7.8 Visit