OVN-Kubernetes
OVN-Kubernetes is a free, open-source Kubernetes networking solution and CNI-conformant plugin built on OVN and Open vSwitch.
What OVN-Kubernetes is
OVN-Kubernetes is a free, open-source Kubernetes networking solution and CNI-conformant plugin built on OVN and Open vSwitch. It provides pod IP address management, interfaces, GENEVE overlays, Kubernetes Services, EndpointSlices, network policies, and IPv4/IPv6 dual-stack networking. OVN ACLs enforce NetworkPolicy, AdminNetworkPolicy, and EgressFirewall rules; EgressIP, EgressService, and EgressQoS control outbound traffic. Pods can join multiple networks through multi-homing and multi-network policies. Additional capabilities include multicast, traffic shaping, BGP route advertisements, SmartNIC and DPU offload, and persistent IPs for KubeVirt live migrations. Hybrid Overlay supports mixed Windows and Linux clusters. The project documents deployment with Kind, Helm, DPU acceleration, and kubeadm, plus source builds. Requirements depend on OVN, nft, Multus, CNI, and Kubernetes versions; the master branch lists Kubernetes 1.33 or newer. Secondary User Defined Networks currently lack north-south traffic and core Kubernetes Services support. The project focuses on networking needs relevant to enterprise and telco users.
Good
- Provides Kubernetes Services, EndpointSlices, and network policies.
- Supports IPv4/IPv6 dual-stack networking.
- Controls outbound traffic with EgressIP, EgressService, and EgressQoS.
- Supports multiple networks and KubeVirt live migration.
- Free and open source.
Watch out
- Secondary User Defined Networks lack north-south traffic.
- Secondary User Defined Networks lack core Kubernetes Services support.
- Route Advertisements requires FRR-k8s.
- AdminNetworkPolicy APIs are v1alpha1 and subject to change.
Who it suits
OVN-Kubernetes suits teams building Kubernetes clusters that need configurable pod networking, policies, or egress controls. Its capabilities also address enterprise and telco networking needs, including mixed Windows and Linux clusters.
Verdict
OVN-Kubernetes covers core cluster networking as well as multi-networking, egress controls, and specialized capabilities such as BGP and hardware offload. Check its version requirements and the current limitations of secondary User Defined Networks when assessing fit.
The facts
Each one read from OVN-Kubernetes's own pages, with the date it was checked.
What it does
- Advanced networking
- It supports hybrid Windows/Linux networking, IP multicast, OVS hardware offload, and secondary or local networks.checked 1 Oct 2026
- API surface
- OVN-Kubernetes documents Custom Resource Definitions for EgressIP, EgressService, EgressQoS, EgressFirewall, UserDefinedNetwork, RouteAdvertisements, ClusterNetworkConnect, and VTEP.checked 1 Oct 2026
- Audience
- The project says its features are critical to enterprise and telco users and aims to provide a scalable, performant Kubernetes networking platform.checked 1 Oct 2026
- BGP dependency
- The Route Advertisements feature requires FRR-k8s.checked 1 Oct 2026
- BGP integration
- Route Advertisements integrates BGP to import provider-network routes into OVN pod networks and export pod and egress-IP routes to BGP peers.checked 1 Oct 2026
- Core networking
- It provides pod IPAM and veth interfaces, GENEVE overlay networking, Kubernetes Services and EndpointSlices, NetworkPolicies, AdminNetworkPolicies, and IPv4/IPv6 dual-stack support.checked 30 Sep 2026
- Dependencies
- The requirements matrix lists OVN, nft, Multus, CNI, and Kubernetes versions; the master branch lists Kubernetes 1.33 or newer.checked 30 Sep 2026
- Deployment
- It can be deployed on Kubernetes with Helm or kubeadm, run in Kind for development and testing, and installed with DPU acceleration.checked 1 Oct 2026
- Egress controls
- It supports Multiple External Gateways, DSCP QoS, EgressIP, EgressService, and Egress Firewall controls.checked 1 Oct 2026
- Hardware acceleration
- OVN-Kubernetes can offload OVS datapath processing to SmartNICs and DPUs.checked 30 Sep 2026
- Kubernetes networking
- It provides pod networking, IPAM, veth interfaces, GENEVE overlays, Kubernetes Services, EndpointSlices, NetworkPolicies, AdminNetworkPolicies, and IPv4/IPv6 dual-stack support.checked 1 Oct 2026
- KubeVirt integration
- It provides persistent IPs and seamless networking for KubeVirt virtual-machine live migrations.checked 1 Oct 2026
- Multicast
- OVN-Kubernetes supports IGMP snooping and multicast relay through OVN.checked 30 Sep 2026
- Multi-networking
- Pods can attach to multiple networks using multi-homing and multi-network policies.checked 30 Sep 2026
- Multinetworking
- Pods can attach to multiple networks using multi-homing and multi-network policies.checked 1 Oct 2026
- Network security
- NetworkPolicy, AdminNetworkPolicy, and EgressFirewall are enforced through OVN ACLs.checked 30 Sep 2026
- Network segmentation
- Its feature set includes user-defined networks, network segmentation, and cross-network connectivity.checked 1 Oct 2026
- Node security
- Node Identity uses per-node client certificates and a validating admission webhook to enforce granular ovnkube-node permissions.checked 1 Oct 2026
- Policy maturity
- AdminNetworkPolicy and BaselineAdminNetworkPolicy are v1alpha1 APIs subject to change before stable v1.checked 1 Oct 2026
- Purpose
- OVN-Kubernetes is an open-source Kubernetes networking solution and CNI-conformant plugin built on OVN and Open vSwitch.checked 30 Sep 2026
- Quality of service
- NetworkQoS provides DSCP marking and traffic shaping for pod network traffic.checked 30 Sep 2026
- Secondary-network limit
- Secondary User Defined Networks currently lack north-south traffic and core Kubernetes Services support.checked 30 Sep 2026
Where it runs
- Container platforms
- Ubuntu- and Fedora-based container images are available in GitHub's Registry.checked 1 Oct 2026
The company
- Founded
- 2014checked 28 Sep 2026
Alternatives to OVN-Kubernetes
- 1
Antrea
Free planOpen sourceAPILinuxSelf-hostedWindows7.2Free plan - 2
Akamai Guardicore Segmentation
WebAPILinuxSelf-hosted6.4 - 3
Hopr
Free planLinuxSelf-hosted6.4From $35 a month - 4
ColorTokens Xshield
WebAPILinuxmacOS6.3 - 5
Cisco Catalyst Center
WebAPILinuxmacOS6.2 - 6
Istio
Free planLinuxmacOSSelf-hosted6.2Free plan