On this page
Source - OpenShift networking real routing and NAT-free path
Overview
Summary of the Red Hat Developers architecture guidance for OpenShift networking evolution toward routable workload IPs, reduced NAT dependence, and direct fabric integration.
Context
This source is used to align OpenShift network posture with datacenter EVPN/BGP practice, especially for production workloads that need identity-preserving routing and predictable east-west and north-south behavior.
Decisions
- Architecture usage in this vault: informs the routed workload default in openshift-evpn-production-target-baseline.
- Architecture usage in this vault: informs scoped
UDNexception usage and FRR/BGP import controls in openshift-evpn-production-target-baseline. - Policy adoption remains owned by ADR and architecture notes, not by this source summary.
Current State
- OpenShift introduces a routed attachment model where participating workloads can receive routable addresses from cluster user-defined network ranges.
- CUDN as
role: Primaryfor supported attached-workload paths removes node-level NAT for those paths and preserves workload source identity. - UDN remains a namespace-scoped isolation tool for strict tenant segmentation, overlapping IP requirements, and Layer 2 attachment use cases; routed exposure semantics stay release- and design-dependent.
- Service or LoadBalancer IPs remain the stable application identity, while routed workload IPs represent workload location.
- FRR with BGP is the control mechanism for dynamic prefix advertisement into the fabric.
- Migration posture is mixed-mode aware: MTU validation is required where Geneve, VXLAN, and routed paths coexist.
References
Future Work
- Re-validate behavior and API surfaces for each target OpenShift release before promoting profile changes to accepted ADRs.
- Keep route filtering and route-leak evidence requirements aligned with network-domain validation gates.