Postinstallation network configuration

In the web console, click Networking → NetworkAttachmentDefinitions.

Click Create Network Attachment Definition.

Enter a unique Name and optional Description.

Select CNV Linux bridge from the Network Type list.

Enter the name of the bridge in the Bridge Name field.

Optional: If the resource has VLAN IDs configured, enter the ID numbers in the VLAN Tag Number field.

Optional: Select MAC Spoof Check to enable MAC spoof filtering. This feature provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.

Click Create.

Create a NetworkAttachmentDefinition manifest according to the following example:

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: my-secondary-network (1)
  namespace: kubevirt-hyperconverged
spec:
  config: '{
    "cniVersion": "0.3.1",
    "name": "migration-bridge",
    "type": "macvlan",
    "master": "eth1", (2)
    "mode": "bridge",
    "ipam": {
      "type": "whereabouts", (3)
      "range": "10.200.5.0/24" (4)
    }
  }'

Open the HyperConverged CR in your default editor by running the following command:

oc edit hyperconverged kubevirt-hyperconverged -n kubevirt-hyperconverged

Add the name of the NetworkAttachmentDefinition object to the spec.liveMigrationConfig stanza of the HyperConverged CR:

apiVersion: hco.kubevirt.io/v1beta1
kind: HyperConverged
metadata:
  name: kubevirt-hyperconverged
spec:
  liveMigrationConfig:
    completionTimeoutPerGiB: 800
    network: <network> (1)
    parallelMigrationsPerCluster: 5
    parallelOutboundMigrationsPerNode: 2
    progressTimeout: 150
# ...

Save your changes and exit the editor. The virt-handler pods restart and connect to the secondary network.

Navigate to Virtualization > Overview in the OKD web console.

Click the Settings tab and then click Live migration.

Select the network from the Live migration network list.

Create an SriovNetworkNodePolicy object, and then save the YAML in the <name>-sriov-node-network.yaml file. Replace <name> with the name for this configuration.

apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetworkNodePolicy
metadata:
  name: <name> (1)
  namespace: openshift-sriov-network-operator (2)
spec:
  resourceName: <sriov_resource_name> (3)
  nodeSelector:
    feature.node.kubernetes.io/network-sriov.capable: "true" (4)
  priority: <priority> (5)
  mtu: <mtu> (6)
  numVfs: <num> (7)
  nicSelector: (8)
    vendor: "<vendor_code>" (9)
    deviceID: "<device_id>" (10)
    pfNames: ["<pf_name>", ...] (11)
    rootDevices: ["<pci_bus_id>", "..."] (12)
  deviceType: vfio-pci (13)
  isRdma: false (14)

Optional: Label the SR-IOV capable cluster nodes with SriovNetworkNodePolicy.Spec.NodeSelector if they are not already labeled. For more information about labeling nodes, see "Understanding how to update labels on nodes".

Create the SriovNetworkNodePolicy object:

$ oc create -f <name>-sriov-node-network.yaml

To verify that the SR-IOV network device is configured, enter the following command. Replace <node_name> with the name of a node with the SR-IOV network device that you just configured.

$ oc get sriovnetworknodestates -n openshift-sriov-network-operator <node_name> -o jsonpath='{.status.syncStatus}'