From: "Lukas Sichert" <l.sichert@proxmox.com>
To: "Lukas Sichert" <l.sichert@proxmox.com>,
"Hannes Laimer" <h.laimer@proxmox.com>,
<pve-devel@lists.proxmox.com>
Subject: Re: SPAM: [RFC cluster/docs/ifupdown2/manager/network/proxmox{-ve-rs,-ebpf,-perl-rs} v2 00/27] sdn: add microsegmentation support
Date: Mon, 17 Aug 2026 16:50:53 +0200 [thread overview]
Message-ID: <DKRAX8JGPAP2.19JLE3T7U6DS1@proxmox.com> (raw)
In-Reply-To: <DKR6DHMTC5WF.39KVZH6JN9BAJ@proxmox.com>
On 2026-08-17 13:17, Lukas Sichert <l.sichert@proxmox.com> wrote:
> On 2026-07-09 11:18, Hannes Laimer <h.laimer@proxmox.com> wrote:
>
>> This adds support for microsegmentation using eBPF programs attached to
>> interfaces. Mostly the tap/veth interfaces on the guests directly.
>>
>
> Overall, the microsegmentation setup worked for both VMs and containers
> across the three-node EVPN cluster.
>
On 2026-08-17 13:17, Lukas Sichert <l.sichert@proxmox.com> wrote:
> On 2026-07-09 11:18, Hannes Laimer <h.laimer@proxmox.com> wrote:
>
>> This adds support for microsegmentation using eBPF programs attached to
>> interfaces. Mostly the tap/veth interfaces on the guests directly.
>>
>
> Overall, the microsegmentation setup worked for both VMs and containers
> across the three-node EVPN cluster.
>
One thing I forgot to add in my last mail:
Hannes mentioned concerns that the 16-bit identity field used to carry
the eBPF-assigned identity might be too small.
A minimal theoretical exhaustion scenario requires 16 independently
distinguishable groups, 8 rules, and 65,536 NICs. Each rule can
distinguish group membership in both its source and destination
predicate. For example:
allow g1 -> g2
allow g3 -> g4
...
allow g15 -> g16
A NIC can belong to any subset of these groups, such as {g1}, {g1, g3},
or {g2, g5, g8}. With the predicates above, every subset produces a
different rule-matching signature and therefore forms a separate
policy-equivalence class.
With 16 groups, there are:
2^16 = 65,536
possible subsets.
Only equivalence classes actually realized by NICs receive identities.
Identity 0 is reserved for genuinely untagged traffic, leaving 65,535
identities for managed equivalence classes. Therefore, up to 65,535
NICs can always be assigned, even if every NIC has different policy
behavior. Configurations with more NICs remain possible as long as some
NICs share an equivalence class.
In practice, reaching the limit would require an automatically
generated configuration containing at least 65,536 distinct policy
behaviors. Real environments generally contain many NICs with
identical behavior and therefore sharing an identity. It seems highly
unlikely that the 16-bit limit will become a practical problem.
prev parent reply other threads:[~2026-08-17 14:50 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-09 9:18 SPAM: [RFC cluster/docs/ifupdown2/manager/network/proxmox{-ve-rs,-ebpf,-perl-rs} v2 00/27] sdn: add microsegmentation support Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ve-rs v2 01/27] ve-config: sdn: add microseg signature-identity engine Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ve-rs v2 02/27] ve-config: sdn: add microseg config types Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ve-rs v2 03/27] ve-config: sdn: microseg: add tag matcher Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ve-rs v2 04/27] ve-config: sdn: microseg: add name regex matcher Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ve-rs v2 05/27] ve-config: sdn: microseg: add carrier bridge section Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ebpf v2 06/27] agent: add userspace coordinator and stateless policy subsystem Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ebpf v2 07/27] bpf: add bridge subsystem Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-ebpf v2 08/27] debian: add packaging and boot-time oneshot unit Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-cluster v2 09/27] cfs: add 'sdn/microseg.cfg' to observed files Hannes Laimer
2026-07-09 9:18 ` [PATCH proxmox-perl-rs v2 10/27] pve-rs: sdn: add microseg config binding Hannes Laimer
2026-07-09 9:18 ` [PATCH ifupdown2 v2 11/27] d/patches: add support for VXLAN-GBP flag Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 12/27] sdn: microseg: add config, API and guest inventory Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 13/27] sdn: dry-run: surface pending microseg changes Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 14/27] sdn: zones: trigger microseg apply on tap_plug Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 15/27] sdn: zones: add vxlan-gbp option to vxlan and evpn zones Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 16/27] evpn: disable vxlan-learning on create if GBP is enabled Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 17/27] sdn: microseg: add tag matcher Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 18/27] sdn: microseg: add name regex matcher Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-network v2 19/27] sdn: microseg: add carrier bridge API Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-manager v2 20/27] ui: sdn: add microsegmentation panel Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-manager v2 21/27] ui: sdn: dry-run: show pending microseg diff Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-manager v2 22/27] network: apply microseg state on reload Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-manager v2 23/27] ui: sdn: zones: add vxlan-gbp checkbox to vxlan and evpn Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-manager v2 24/27] ui: sdn: microseg: add tag matcher Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-manager v2 25/27] ui: sdn: microseg: add name regex matcher Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-docs v2 26/27] sdn: add microsegmentation section Hannes Laimer
2026-07-09 9:18 ` [PATCH pve-docs v2 27/27] sdn: add VXLAN-GBP flag to evpn/vxlan zone sections Hannes Laimer
2026-08-12 10:33 ` SPAM: [RFC cluster/docs/ifupdown2/manager/network/proxmox{-ve-rs,-ebpf,-perl-rs} v2 00/27] sdn: add microsegmentation support Lukas Sichert
2026-08-17 11:17 ` Lukas Sichert
2026-08-17 14:50 ` Lukas Sichert [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DKRAX8JGPAP2.19JLE3T7U6DS1@proxmox.com \
--to=l.sichert@proxmox.com \
--cc=h.laimer@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.