Connecting a virtual machine to a Linux bridge network

In the web console, click Networking → NetworkAttachmentDefinitions.

Click Create Network Attachment Definition.

Enter a unique Name and optional Description.

Select CNV Linux bridge from the Network Type list.

Enter the name of the bridge in the Bridge Name field.

Optional: If the resource has VLAN IDs configured, enter the ID numbers in the VLAN Tag Number field.

Optional: Select MAC Spoof Check to enable MAC spoof filtering. This feature provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.

Click Create.

Add the VM to the NetworkAttachmentDefinition configuration, as in the following example:

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network (1)
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1 (2)
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "bridge-network", (3)
      "type": "bridge", (4)
      "bridge": "br1", (5)
      "macspoofchk": false, (6)
      "vlan": 100, (7)
      "disableContainerInterface": true,
      "preserveDefaultVlan": false (8)
    }

Optional: If you want to connect a VM to the native network, configure the Linux bridge NetworkAttachmentDefinition manifest without specifying any VLAN:

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "bridge-network",
      "type": "bridge",
      "bridge": "br1",
      "macspoofchk": false,
      "disableContainerInterface": true
    }

Create the network attachment definition:

$ oc create -f network-attachment-definition.yaml (1)

Edit the Linux bridge NAD by setting portIsolation to true:

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "bridge-network", (1)
      "type": "bridge", (2)
      "bridge": "br1", (3)
      "preserveDefaultVlan": false,
      "vlan": 100,
      "disableContainerInterface": false,
      "portIsolation": true (4)
    }
# ...

Apply the configuration:

$ oc apply -f example-vm.yaml

Optional: If you edited a running virtual machine, you must restart it for the changes to take effect.

Navigate to Virtualization → VirtualMachines.

Click a VM to view the VirtualMachine details page.

On the Configuration tab, click the Network interfaces tab.

Click Add network interface.

Enter the interface name and select the network attachment definition from the Network list.

Click Save.

Restart or live migrate the VM to apply the changes.

Add the bridge interface and the network attachment definition to the VM configuration as in the following example:

apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: example-vm
spec:
  template:
    spec:
      domain:
        devices:
          interfaces:
            - bridge: {}
              name: bridge-net (1)
# ...
      networks:
        - name: bridge-net (2)
          multus:
            networkName: bridge-network (3)

Apply the configuration:

$ oc apply -f example-vm.yaml

Optional: If you edited a running virtual machine, you must restart it for the changes to take effect.