Add CUDN Localnet fabric integration guide

[danmanor]

Summary

• Guide for connecting KubeVirt VMs to a physical fabric using CUDN Localnet topology with VLAN tagging on br-ex
• Covers single-NIC trunk mode: node management (untagged) + VM tenant traffic (tagged VLANs) on the same switch port
• Step-by-step setup: NMState, NNCP bridge-mappings, CUDN with Localnet topology, VM creation, jump pod SSH access
• Multi-cluster IP partitioning via excludeSubnets
• Verified test results across all connectivity combinations:
  • Same virtual network, same cluster (L2, TTL=64)
  • Same virtual network, cross-cluster (L2, TTL=64)
  • Different virtual networks, same VPC/VRF (L3, TTL=63, requires manual routes)
  • Different virtual networks, different VPCs/VRFs (isolated)
  • SNAT via fabric vs pod network (different public IPs)
• Mermaid diagrams for all networking flows and OVN internal architecture
• Troubleshooting section including masquerade subnet collision (10.0.2.0/24) and virtctl ssh breakage

Test plan

All tests were run on 2 SNO clusters (OCP 4.21 and 4.22) on a managed fabric with 2 virtual networks (VLAN 3 and VLAN 5). Results documented in the guide.

[coderabbitai]

Warning

Review limit reached

@danmanor, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 59 minutes and 37 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 44bb26a3-04b9-4dd3-b469-143f324952ef

📥 Commits

Reviewing files that changed from the base of the PR and between 010cba4 and 8c427bc.

📒 Files selected for processing (2)

• networking/cudn-localnet-fabric-integration/README.md
• networking/cudn-localnet-fabric-integration/diagrams.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cudn-localnet-fabric-integration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ori-amizur]

1. What is the reason for preferring the VLAN/Localnet approach over tunneling? With tunneling, nodes don't need L2 adjacency, no switch port configuration is required, and the cluster controls the full networking stack. What does Localnet achieve for OSAC that tunneling cannot?

2. VLANs require configuration on switch ports (VLANs, trunks, VRFs, gateways). This must be done by network administrators, or by a fabric controller. Are we OK requiring this from our customers, especially when automatic configuration is not available (e.g., bare metal switches)?

3. Localnet CUDN is always a secondary network, so VMs will always have two interfaces: one for the pod network and another for localnet traffic. This is a constraint that will be hard to explain to VM users. It also means that cross-subnet routing requires manual static routes on VMs, since the default route points to the pod network.

4. The document itself mentions EVPN and VRF-Lite as alternative CUDN topologies that support role: Primary (avoiding the dual-interface constraint) and automatic cross-subnet routing (no manual routes). Have these alternatives been considered?

[danmanor]

Closing in favor of the enhancement proposal: osac-project/enhancement-proposals#80

The content from this guide has been converted into a proper EP in the enhancement-proposals repo, linked to OSAC-1511 / OSAC-1830.