For Calico’s documented KubeVirt live-migration pattern, the VM must use bridge binding so its IP matches the pod’s IP; Calico IPAM must preserve that address; destination policy must be ready before the VM becomes active there; and BGP route priorities must steer traffic to the destination. These conditions can support a short network interruption, but the CNCF session’s “near zero” downtime description is not an independently measured result or a guarantee for every cluster.
Why does live migration put VM networking at risk?
During live migration, a VM’s execution moves to another Kubernetes node. Its network identity and the route directing traffic to it must move coherently too. If the destination VM pod receives a different address, if policy is missing when traffic arrives, or if the network continues preferring the source host, applications can lose connectivity even when the VM’s memory and device state have migrated successfully.
As an Amazon Associate I earn from qualifying purchases.
The CNCF session presented by Tigera on August 6, 2026, describes a Calico-and-KubeVirt approach to those network handoff problems. The event page names Veronika Smolik, Technical Marketing Manager at Tigera, as the speaker. Its stated topics include KubeVirt networking modes, bridge mode, persistent addressing through Calico IPAM, TCP session continuity and route convergence, with demonstrations on a multi-node Calico cluster. Those are the session’s stated scope, not independently reproduced test results.
Which KubeVirt networking mode supports this pattern?
Calico’s KubeVirt networking documentation says it supports live migration using bridge binding. In this arrangement, the VM uses the same IP address assigned to its pod. Keeping that identity is central to handing traffic from the source node to the destination.
#1 Best Overall
- GIGABIT ETHERNET PORTS: Features 5 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
- PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
- FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
- SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
- REGIONAL COMPATIBILITY: Made for use in U.S. & CA only
| Networking choice | What the documented guidance establishes |
|---|---|
| Bridge binding | Supported for the documented Calico live-migration pattern; the VM uses the pod’s IP address. |
| Masquerade or another binding that separates VM and pod IPs | Not supported for this documented live-migration pattern. |
Bridge-mode VMs need the annotation kubevirt.io/allow-pod-bridge-network-live-migration under the VM template’s metadata. Consult the guidance for the Calico and KubeVirt versions actually installed: networking behavior and instructions are version-sensitive.
How does Calico keep the VM’s IP address?
Calico IPAM can use the VM’s identity as the allocation handle for its address. That lets a recreated VM pod reuse the VM’s IP rather than acquiring a new one. In the Calico Open Source 3.32 IPAM reference, the kubeVirtVMAddressPersistence option has Enabled and Disabled values, with Enabled as the default.
Rank #2
- 𝗢𝗻𝗲 𝗦𝘄𝗶𝘁𝗰𝗵 𝗠𝗮𝗱𝗲 𝘁𝗼 𝗘𝘅𝗽𝗮𝗻𝗱 𝗡𝗲𝘁𝘄𝗼𝗿𝗸: 5× 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX.
- 𝗚𝗶𝗴𝗮𝗯𝗶𝘁 𝘁𝗵𝗮𝘁 𝗦𝗮𝘃𝗲𝘀 𝗘𝗻𝗲𝗿𝗴𝘆: Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money.
- 𝗥𝗲𝗹𝗶𝗮𝗯𝗹𝗲 𝗮𝗻𝗱 𝗤𝘂𝗶𝗲𝘁: IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation.
- 𝗣𝗹𝘂𝗴 𝗮𝗻𝗱 𝗣𝗹𝗮𝘆: Easy setup with no software installation or configuration needed.
- 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀: Prioritize your traffic and guarantee high quality of video or voice data transmission with Port-based 802.1p/DSCP QoS and IGMP Snooping.
Operators should verify the setting in their installation rather than assume the default is still in effect. If it was disabled, the current KubeVirt networking guidance instructs operators to re-enable address persistence. The IPAM reference is version-specific; use documentation that matches the deployed Calico release.
What must be ready on the destination before traffic moves?
Policy must be programmed first
Calico’s guidance calls for programming policy on the destination before the VM becomes active there. Policy applied only after traffic arrives can interrupt connectivity during the handoff. The guide also describes CNI policy-setup timeout configuration as a way to coordinate readiness. Treat that as a readiness requirement to configure for the environment, not as a universal timeout value: no specific value is established here.
Rank #3
- GIGABIT ETHERNET PORTS: Features 8 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
- PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
- FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
- SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
- REGIONAL COMPATIBILITY: Made for use in U.S. & CA only
Check installation order and pool behavior
If Calico was installed before KubeVirt CRDs were available, Typha may need a restart to discover KubeVirt migration resources. The guide also identifies IP pool NAT behavior as relevant to uninterrupted connectivity; check the version-matched documentation and the cluster’s pool configuration rather than assuming every pool behaves alike.
Allow migration traffic when host endpoint policy applies
If host endpoint policies are in use, the guide says to allow TCP ports 49152 and 49153 between hosts for KubeVirt migration traffic. This is a conditional requirement for clusters using those policies, not a general instruction to open the ports everywhere.
Rank #4
- 【One Switch Made to Expand Network】Features 5 RJ45 ports with 10/100/1000Mbps speeds, supporting Auto-Negotiation and Auto MDI/MDIX for hassle-free setup. Ideal for expanding your network, with 1 uplink (input) port and 4 output ports to split your Ethernet connection to multiple devices.
- 【Gigabit that Saves Energy】Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money
- 【Reliable and Quiet】IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation
- 【Plug and Play】Easy setup with no software installation or configuration needed
- 【Ethernet Splitter】Connect to your router or modem for additional wired connections (laptop, gaming console, printer, etc)
How do BGP routes hand traffic to the destination?
Preserving an address is not enough if the network still routes traffic toward the source host. Calico’s BGP live-migration guide describes using elevated-priority routes on the target host so that it becomes the preferred destination. It then describes a configurable convergence period before normal route priorities resume.
The documented default convergence period is 30 seconds. This is the default duration for route-priority convergence, not the duration of the VM migration or a measurement of application-visible downtime. The guide does not establish that all applications or networks converge within that time.
Best Value
- 𝗘𝗶𝗴𝗵𝘁 𝟮.𝟱 𝗚𝗯𝗽𝘀 𝗣𝗼𝗿𝘁𝘀 𝗳𝗼𝗿 𝗦𝘂𝗽𝗲𝗿-𝗙𝗮𝘀𝘁 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻𝘀: 8× 2.5-Gigabit ports unlock the highest performance of your Multi-Gig bandwidth and devices, and provide up to 40 Gbps of switching capacity.
- 𝗔𝘂𝘁𝗼-𝗡𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻: Auto-negotiation intelligently senses the link speeds and adjusts between 3-speeds (100Mb/1G/2.5G) for compatibility and optimal performance for all your devices, including 2.5G WiFi 6 AP, 2.5G NAS, 2.5G PCIe Adapter, 2.5G Server, gaming computer, 4K video, and more.
- 𝗜𝗱𝗲𝗮𝗹 𝗳𝗼𝗿 𝗩𝗮𝗿𝗶𝗼𝘂𝘀 𝗦𝗰𝗲𝗻𝗮𝗿𝗶𝗼𝘀: Built for LAN parties, home entertainment, small and home offices, and instant transfer for workstations.
- 𝗛𝗮𝘀𝘀𝗹𝗲-𝗙𝗿𝗲𝗲 𝗖𝗮𝗯𝗹𝗶𝗻𝗴: Instantly upgrade to 2.5 Gbps without the need to upgrade to Cat6 wiring, reducing wiring costs and hassle. *
- 𝗦𝗶𝗹𝗲𝗻𝘁 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻: Industry-leading fanless design ensures silent operation, ideal for any home or business.
Single-AS iBGP and eBGP boundaries require different attention
| Topology | Route-priority guidance | Operational consideration |
|---|---|---|
| iBGP within a single AS | Calico says priority mapping is automatic. | Confirm the actual routing topology and version-matched configuration. |
| eBGP across AS boundaries | Configure BGPFilter behavior so priority information propagates. | For cross-rack migration, top-of-rack switches must pass the elevated-priority /32 routes. |
In an eBGP or multi-rack environment, route propagation through each boundary is part of the handoff design. A destination host can be ready locally while upstream devices still fail to prefer its route.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does the documented approach work with overlays?
No: the Calico guide requires BGP without an overlay for this documented live-migration path and says WireGuard is not supported. That is a constraint on the support described in the guide, not a universal recommendation that every Kubernetes cluster should use the same network architecture.
| Network setup | What the cited guidance says |
|---|---|
| BGP without overlay | Required for the documented Calico live-migration path. |
| Overlay or WireGuard | The documented path does not apply; WireGuard is explicitly not supported. |
Will existing TCP connections survive migration?
The CNCF session description says it covers TCP session continuity, but the cited session and Calico documentation do not provide an independently measured success rate, downtime measurement, test methodology, or guarantee that every existing connection will survive. Continuity depends on the VM retaining its address, destination policy being ready, and routing converging correctly; application behavior and the surrounding network also matter. The session description characterizes its demo cutover downtime as “near zero,” but gives no measurement method or repeatable benchmark, so that phrase should not be read as a verified result for production workloads.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should operators verify before attempting a migration?
- Match the documentation to the installation. Check the Calico and KubeVirt versions and use their corresponding networking and IPAM instructions.
- Confirm bridge binding. Verify the VM uses bridge binding and has
kubevirt.io/allow-pod-bridge-network-live-migrationunder VM template metadata. - Verify persistent addressing. Check that
kubeVirtVMAddressPersistenceis enabled; the Calico Open Source 3.32 reference lists this as the default, but an installation may have changed it. - Make destination policy ready. Ensure policy is programmed before the VM becomes active on the destination, and configure CNI policy setup timing as needed.
- Check Calico discovery and pool behavior. If Calico predates KubeVirt CRDs, determine whether Typha needs restarting. Review IP pool NAT behavior against the version-matched guide.
- Validate BGP route propagation end to end. Account for whether the cluster uses single-AS iBGP or crosses eBGP boundaries; for cross-rack routes, verify the ToR devices pass elevated-priority
/32routes. - Check host endpoint rules if applicable. When host endpoint policies are used, allow the documented TCP migration ports between hosts.
- Plan for the supported network path. The documented method requires BGP without overlay and does not support WireGuard.
Sources: CNCF Online Programs session entry and event details; Tigera / Project Calico documentation for KubeVirt networking, BGP routing for KubeVirt live migration, and IPAM configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
