Understanding Kube-OVN Security Groups and Pod Port Security
This article explains how Kube-OVN implements security groups and port security for Kubernetes pods by leveraging OVN port groups, address sets, and ACLs, detailing the CRD design, annotation usage, and the workflow that synchronizes pod network interfaces with security policies.
Kube-OVN is a Kubernetes networking project built on OVS/OVN that brings mature OpenStack networking capabilities to Kubernetes, enhancing security, operability, manageability, and performance.
The series will cover kube-ovn-controller, pod IP management, CNI plugin for pod NICs, pod security groups, and a unified Vagrant build and test environment.
Pod port security is controlled via the annotation "%s.kubernetes.io/port_security", which triggers OVN's lsp-set-port-security on the corresponding OVN logical switch port, assigning MAC and IP and enforcing source IP/MAC legitimacy.
Pod security groups are represented by a custom SecurityGroup CRD. When a SecurityGroup is created or updated, the kube-ovn-controller processes the event through handleAddOrUpdateSg , creates an OVN port_group , and associates an address_set for IPv4 and IPv6 addresses of all ports belonging to the group.
Security group rules are stored in the CRD; their MD5 hash is used to detect changes. Updated rules are applied by invoking OVN acl-add and acl-del commands, and the SecurityGroup status is refreshed.
The controller also synchronizes pod annotations "%s.kubernetes.io/security_groups" (a comma‑separated list of group names) during pod create, update, or delete, linking the pod's OVN ports to the appropriate port groups via pg-set-ports .
In summary, Kube-OVN introduces a SecurityGroup CRD that creates OVN port groups, generates ACLs from defined rules, and binds pod NICs to these groups, thereby providing a full security‑group functionality within a cloud‑native Kubernetes environment.
Cloud Native Technology Community
The Cloud Native Technology Community, part of the CNBPA Cloud Native Technology Practice Alliance, focuses on evangelizing cutting‑edge cloud‑native technologies and practical implementations. It shares in‑depth content, case studies, and event/meetup information on containers, Kubernetes, DevOps, Service Mesh, and other cloud‑native tech, along with updates from the CNBPA alliance.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.