OVN-Kubernetes is an open-source networking solution and CNI plugin for Kubernetes, built on OVN and Open vSwitch. It provides pod networking, IP address management, GENEVE overlays, Kubernetes Services and EndpointSlices, network policies, and IPv4/IPv6 dual-stack support. OVN ACLs enforce network policies and egress firewalls, while EgressIP, EgressService, and EgressQoS help manage outbound traffic. Pods can connect to multiple networks, and the project also supports multicast, traffic shaping, BGP route advertisements, and SmartNIC or DPU offload. For KubeVirt, it supports persistent IPs during live virtual-machine migration; Hybrid Overlay enables mixed Windows and Linux clusters. Deployment documentation covers Kind, Helm, kubeadm, DPU acceleration, and source builds. Requirements vary by OVN, nft, Multus, CNI, and Kubernetes versions; the master branch lists Kubernetes 1.33 or newer. Secondary User Defined Networks currently lack north-south traffic and core Kubernetes Services support. The software is free and focuses on networking needs relevant to enterprise and telco users.
Who it is for
It suits teams building Kubernetes networks, particularly enterprise and telco users needing policy controls, egress management, or multi-network capabilities. Users should account for the stated limits on Secondary User Defined Networks and the version requirements.
What is good
- Free and open source.
- Supports IPv4/IPv6 dual-stack networking.
- Provides network policies and egress controls.
- Supports mixed Windows and Linux clusters.
- Offers BGP integration and hardware offload.
What to know first
- Secondary User Defined Networks lack north-south traffic.
- Secondary User Defined Networks lack core Kubernetes Services support.
- AdminNetworkPolicy APIs are v1alpha1 and subject to change.
- Route Advertisements requires FRR-k8s.
Verdict
OVN-Kubernetes covers core Kubernetes networking alongside policy enforcement, egress controls, multi-networking, and specialized capabilities such as BGP and hardware offload. Check its version requirements and secondary-network limitations against your cluster needs.
Compared on microsegmentation software
- Free plan
- Yes
- CNI plugin
- Yes
- Network policies
- Yes
- Egress control
- Yes
- Encryption in transit
- Yes
- Supported platforms
- Kubernetes, Linux, Windows, bare metal, VMware vSphere, IBM Power, IBM Z, and Red Hat OpenStack Platform
