OVN (Open Virtual Network)

OVN (Open Virtual Network)
Name	OVN (Open Virtual Network)
Developer	Open vSwitch, Linux Foundation, Intel Corporation
Latest release	2024
License	Apache License
Repository	GitHub

OVN (Open Virtual Network) is an open-source virtual networking project that provides network virtualization for OpenStack, Kubernetes, and Docker environments, integrating with Linux kernel networking and Open vSwitch to deliver overlay networks, logical routers, and distributed services. OVN is used in production by organizations such as Red Hat, Canonical (company), Cisco Systems, and Huawei and is referenced in standards and projects including IETF drafts, Cloud Native Computing Foundation, and Linux Foundation initiatives. The project interfaces with orchestration platforms like Jenkins, Ansible, and Terraform in cloud and edge deployments across data centers such as those run by Amazon Web Services, Google Cloud Platform, and Microsoft Azure.

Overview

OVN emerged to extend Open vSwitch with a northbound database and control plane consistent with the designs used by VMware NSX, Cisco ACI, and Juniper Contrail. It implements logical networking primitives similar to those described in IETF work on VXLAN and Geneve while aligning with networking models used by Cloud Foundry and Eucalyptus (software). Major contributors include developers from Red Hat, IBM, Intel Corporation, and Citrix Systems, and the project integrates with orchestration tools such as OpenStack Neutron and Kubernetes CNI.

Architecture

OVN's architecture separates northbound and southbound control planes with components inspired by distributed systems research at institutions like MIT, Stanford University, and UC Berkeley. The northbound database stores desired state similar to models used by Ansible and Chef (software), while the southbound database distributes state to hypervisors running Open vSwitch and Linux networking stacks. OVN employs encapsulation protocols such as VXLAN, Geneve, and GRE compatible with designs from IETF and appliances from Arista Networks and Mellanox Technologies. Control plane interaction patterns echo those in etcd and Consul consensus systems.

Components

Key components include OVN Northbound and Southbound databases, the OVN controller daemon, and integrations with Open vSwitch and Linux Kernel modules. The northbound DB models logical switches, routers, ACLs, and DHCP akin to schemas found in OpenStack Neutron and Kubernetes API, while the southbound DB maps logical constructs to physical ports on compute nodes like those in Dell EMC and HPE platforms. OVN controllers run on hypervisors alongside QEMU or KVM instances and coordinate with orchestration systems such as MAAS (software) and CloudStack.

Features and Capabilities

OVN provides distributed logical switching and routing, NAT, load balancing, ACLs, and DHCP services comparable to capabilities offered by F5 Networks, HAProxy, and NGINX. It supports multi-tenant isolation similar to VMware vSphere and Microsoft Hyper-V, and implements service chaining concepts found in OpenStack Neutron plugins and Service Function Chaining standards. Integration with OpenTelemetry and logging systems like Elasticsearch and Grafana enables observability, while compatibility with Prometheus supports metrics collection.

Deployment and Integration

OVN can be deployed on bare-metal clusters, virtualized environments using KVM, Xen (software), or container platforms such as Kubernetes with CNI plugins and on cloud infrastructures including Amazon EC2 and Google Compute Engine. System automation often leverages Ansible, SaltStack, or Terraform for reproducible setups while CI/CD pipelines driven by Jenkins or GitLab CI validate changes. Integrations exist with OpenStack Neutron, Kubernetes kube-proxy alternatives, and vendor solutions from Red Hat OpenShift and Canonical MAAS.

Performance and Scalability

OVN is designed for horizontal scale across thousands of hosts, leveraging data-plane offloads available in NICs from Intel Corporation and Mellanox Technologies and kernel features in Linux such as XDP and eBPF. Benchmarks often reference comparative studies involving Cisco and Arista platforms, and tuning uses telemetry pipelines with Prometheus and Grafana dashboards. High-availability patterns borrow from Raft and Paxos research and operational practices deployed by cloud providers like Netflix and Dropbox.

Security and Networking Models

OVN supports role-based access patterns compatible with Keystone (OpenStack), network policy models analogous to Kubernetes NetworkPolicy, and ACL implementations similar to those in Cisco IOS and Juniper Junos. It integrates with certificate management from Let's Encrypt and Vault (HashiCorp), and aligns with threat models discussed by NIST and standards bodies like IETF regarding encapsulation security for VXLAN and Geneve. Encryption and segmentation strategies may involve hardware offload features from vendors such as Intel and Broadcom.

Category:Open source software