Re: [pve-devel] [PATCH container 1/1] Signed-off-by: Maurice Klein <klein@aetherus.de>

[Maurice Klein <klein@aetherus.de>]

So i was looking into implementation today.

Unfortunately I found some points where I'm kinda stuck with the current 
way SDN is designed.

I'm hoping you have some ideas or advise how to continue.

Basicly the vnet and subnet part I see as in issue.
Since in this kind of setup there is no defined subsets required the 
current configuration doesn't fully make sense.
I guess you could still have a subnet configuration and configure all 
the host addresses inside that subnet, but it's not really necessary .

Every VM route would be a /32 route and also the configured address on 
that bridge (gateway field) would be a /32.
When the tap interface of a vm gets plugged a route needs to be created.
Routes per VM get created with the comand ip route add 192.168.1.5/32 
dev routedbridge.
The /32 gateway address needs to be configured on the bridge as well.

There needs to be some way to configure the guests IPs as well, but in 
ipam there is currently no way to set a ip for a vm, it's only ip mac 
bindings.

A potential security flaw is also devices on that bridge can steal a 
configured ip by just replying to arp.
That could be mitigated by disabling bridge learning and creating static 
atp entires as well for those configured IPs.

I don't know yet what's the best way to configure guest ip addresses.
My initial idea was to have that done on a per interface vm level, that 
is incompatible with sdn though.
I don't know how it could be integrated in IPAM though, especially 
considering that pve IPAM isn't the only one available to be used.




Mit freundlichen Grüßen,

Maurice Klein

Aetherus

TEL: 0212 7846460
Mail: Klein@aetherus.de


Am 29.01.26 um 13:20 schrieb Stefan Hanreich:
> On 1/27/26 11:36 AM, Maurice Klein wrote:
>> Hi,
>>
>> I didn't even think about mac address, since arp does recover quickly
>> but it would be a unwanted interruption.
>>
>> I like the idea with using a bridge with l2 isolation.
>> I'd like to implement the zone then, with the use of a l2 isolated bridge.
>>
>> I'd propose the first step would be to get the zone working, to get the
>> mechanism working to add host routes.
>> I would use one VRF then per zone.
> For a PoC we could just utilize the default routing table I think? VRF
> support for SDN entities is something that is on the mid-term roadmap,
> so if we want VRF support we'd need to be careful not to put any
> barriers in that make implementing that feature harder. We'd also have
> to make sure that VRFs stay unique across all entities that are using
> them (currently only EVPN zone). If we generate the names analogous to
> the EVPN zones we should be fine since all zones regardless of type
> share the same ID space.
>
> With multiple VRFs, you'd ideally want to have the option to announce
> the routes per-VRF. Utilizing transit VLANs for zones would make sense
> then and also being able to map each VNet in a zone to a VLAN. That'd
> require creating VLAN subinterfaces inside a VRF as well via our stack
> and adding them to a VNet (might be done automatically) / VRF. At that
> point we're building essentially what is VRF-lite though, so that's a
> bit more involved.
>
>> A proposed name would be "Routed".
>> Do you have better Ideas?
>>
>> A roadmap I'd have in my head then would look the following way:
>>
>> - implement zone "Routed"
>>     ensuring that all routing between guests and host works and that
>> default routes get put in the vrf as well
> I'd not necessarily put in the default route unconditionally, either as
> a config option, or - if we skip VRF support for now - we'd get this for
> free via implementing the VRF feature afterwards.
>
>> - implement possibility to export host routes of routed zones via BGP
> see below
>
>> - implement possibility to add static routes per Routed zone, like
>> different default routes or others
> we would get that via VRF support as well
>
>> - implement dynamic routing updates into routed zones vrf tables
>>
>> Where I'm still not sure is how to get routing in a cluster running
>> between the same zone.
>> It could be implemented via IBGP Sessions between the hosts, but i don't
>> know if that is the preffered way and it needs to be clear to the user
>> which path will be taken and how it works.
> One option would be to utilize e.g. the fabrics where we plan to add
> initial support for route redistribution soon. This should get
> integrated with a future VRF feature as well. That would decouple the
> zone from the redistribution / announcing itself and give users
> flexibility in choosing their routing protocol. Users can create
> fabrics, then select which VRFs to announce via them (and apply filters
> via route-maps).
>