On this page
Summary
Production contract for OpenShift networking on the Location B EVPN/VXLAN lane. It defines defaults, exception boundaries, and minimum evidence gates for promotion.
Applicable Principles
- Automation First - contracts are enforced through pipeline gates.
- Reliability and Resilience - failover behavior is tested, not assumed.
- Security by Design - tenant boundaries and route policy are explicit.
Architecture
Baseline Matrix
| Area | Default target | Exception policy | Required evidence | Owner |
|---|---|---|---|---|
| OpenShift routed attachment | Internal architecture policy default for in-scope production lanes is CUDN on validated releases. | UDN is exception-only for strict isolation or overlap cases and requires release-pinned support profile validation. | Pod IP allocation and VRF route visibility checks. | Platform Architecture |
| Service identity and exposure | Service or LoadBalancer IP is stable north-south identity. | Direct pod exposure requires explicit exception approval. | Reachability and failover checks for service identity. | Platform Architecture |
| External/provider reachability | FRR plus BGP advertisements with filtered imports. | Static-route model must be time-bound and retired. | FRR state, BGP neighbor health, prefix-filter evidence. | Platform + Network |
| NAT posture | No unintended node-level NAT on routed defaults. | NAT only where overlap or edge policy requires it. | Source-identity and conntrack impact checks. | Platform + Network |
| Fabric multihoming | EVPN ESI is default for multi-homed attachment in Location B. | vPC profile only for scoped interoperability fallback. | ESI state, DF behavior, failover transition evidence. | Network Architecture |
| DC-to-backbone interconnect | L3 VRF handoff default (EVPN VRF -> border -> L3VPN VRF). | L2 cross-site extension requires ADR exception and rollback plan. | Route-leak negative tests and border policy hit evidence. | Network Architecture |
| MTU and encapsulation | MTU budget validated for active encapsulation mix. | Mixed-mode overlap windows must be time-bounded. | Fragmentation checks on east-west and north-south paths. | Platform + Network |
CUDNandUDNstatements in this note are internal architecture defaults for this vault, not generic OpenShift product defaults.UDNlimitations in this baseline: no implicit inter-UDN reachability, no automatic datacenter EVPN policy behavior, and explicit FRR or border policy required for external exposure.
Resilience and Evidence Controls
| Control | Requirement | Minimum evidence |
|---|---|---|
| ESI mode behavior | VIP next-hop with 2+ active peers; PIP with single active peer. | show nve ethernet-segment, show l2route evpn ethernet-segment all detail. |
| ESI convergence profile | L2FRR and recovery controls enabled for scoped ESI clusters. | Peer-failure and recovery test with expected PIP/VIP transition. |
| Route distribution | Type-2 re-origination baseline; EAD-EVI disabled unless explicitly required. | EVPN route-type checks and policy-delta review. |
| Interop boundary | A VTEP role uses either vPC-VTEP or ESI-VTEP, not both. | Role-profile compliance check in rendered intent and runtime evidence. |
| OpenShift route visibility | FRR-scoped route imports are visible only in intended VRFs. | FRR node state and tenant VRF route snapshots. |
Decisions
- OpenShift routed default is
CUDN, with scopedUDNexceptions, aligned to source-openshift-networking-real-routing-no-nat. - Location B multihoming default is EVPN ESI with evidence-backed failover behavior, aligned to source-cisco-nxos-evpn-esi-multihoming.
- Interconnect default and L2 exception path follow the working direction in adr-021-dc-evpn-to-backbone-l3vpn-interconnect while ADR-021 remains draft.
- Lane scope and rollout constraints remain governed by adr-019-hybrid-network-rollout-aci-a-ai-only-evpn-b-target.
Open Questions
- Which release profile is promoted first for accepted ADR status after ESI evidence closes?
- Which failover scenario set is mandatory for every production change window?