Support L3 connectivity on vlan sub-interfaces by rrajendran17 · Pull Request #229 · harvester/network-controller-harvester

rrajendran17 · 2026-01-14T22:23:28Z

Problem:
harvester/harvester#8101
harvester/harvester#7834

Solution:
HEP : harvester/harvester#9335
https://github.com/rrajendran17/harvester-harvester/blob/HEP-ipconfig/enhancements/20251015-support-ipconfig-on-clusternetworks.md
https://github.com/rrajendran17/harvester-harvester/blob/HEP-ipconfig/enhancements/20251020-support-user-underlay-selection.md

Related Issue:
harvester/harvester#8101
harvester/harvester#7834

Test plan:
1.https://github.com/rrajendran17/harvester-harvester/blob/HEP-ipconfig/enhancements/20251015-support-ipconfig-on-clusternetworks.md#test-plan
2.https://github.com/rrajendran17/harvester-harvester/blob/HEP-ipconfig/enhancements/20251020-support-user-underlay-selection.md#test-plan

Copilot

Pull request overview

This pull request adds support for L3 connectivity on VLAN sub-interfaces by introducing a new HostNetworkConfig resource and related validation logic.

Changes:

Introduces new HostNetworkConfig validator for managing L3 connectivity on VLAN sub-interfaces
Adds validation checks to prevent deletion/updates when overlay VMs are using the cluster network
Updates existing validators (VlanConfig, NAD) to include new HostNetworkConfig and VirtualMachine cache dependencies
Adds utility functions for managing VLAN sub-interfaces and NAD getters
Extensive generated code updates for client/controller integration

Reviewed changes

Copilot reviewed 25 out of 102 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/webhook/hostnetworkconfig/validator.go	New validator for HostNetworkConfig resource with create/update/delete validation
pkg/webhook/vlanconfig/validator.go	Added overlay VM checks and new cache dependencies
pkg/webhook/nad/validator.go	Added overlay VM checks and new cache dependencies
pkg/utils/nad.go	Added GetVlanID() and ListAllNads() utility functions
pkg/utils/bridge.go	Added functions for VLAN device management
pkg/network/iface/vlan.go	New VLAN sub-interface management functions
pkg/network/vlan/vlan.go	Added GetBridgelink() method
pkg/utils/fakeclients/hostnetworkconfig.go	Fake client for testing HostNetworkConfig
pkg/generated/**	Generated client and controller code for HostNetworkConfig

Comments suppressed due to low confidence (1)

pkg/webhook/hostnetworkconfig/validator.go:1

The logic appears inverted. The check should verify if overlay VMs exist when the hostnetworkconfig has Underlay enabled, but the condition on line 362 checks if Underlay is true, then checks for overlay NADs. This seems backwards - if underlay is true, we should be checking for overlay dependencies. The condition should likely be !hostnetworkconfig.Spec.Underlay or the comment on line 242 should be updated to clarify the intended logic.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/webhook/vlanconfig/validator.go

pkg/utils/bridge.go

pkg/network/iface/link.go

rrajendran17 · 2026-01-19T18:56:46Z

pkg/generated/clientset/versioned/typed/v1/client.go

+		return nil
+	}
+	return c.restClient
+}


pkg/generated/clientset/versioned/typed/v1/client.go - This was file was generated as _client.go due to which the defintions were not recognized outside this file, so I had to rename this file from _client.go to client.go.

Ideally for all other existing generated files, pkg/generated/clientset/versioned/typed//v1/<compponent-name_client.go" is the format, but for some reasons, the latest path generated for Node with recent k8s.io is pkg/generated/clientset/versioned/typed/v1 due to which the client file started with _client.go (empty component name). Not sure if this is a bug from a k8s.io client-go.

mergify · 2026-01-22T12:55:36Z

This pull request is now in conflict. Could you fix it @rrajendran17? 🙏

w13915984028

Some questions, review is still ongoing, thanks.

pkg/controller/agent/hostnetworkconfig/controller.go

pkg/network/iface/vlan.go

pkg/webhook/hostnetworkconfig/validator.go

pkg/webhook/vlanconfig/validator.go

pkg/webhook/hostnetworkconfig/validator.go

w13915984028

thanks.

pkg/controller/agent/hostnetworkconfig/controller.go

pkg/controller/agent/hostnetworkconfig/leasemanager.go

pkg/webhook/hostnetworkconfig/validator.go

pkg/controller/agent/hostnetworkconfig/controller.go

mergify · 2026-01-28T23:41:56Z

This pull request is now in conflict. Could you fix it @rrajendran17? 🙏

rrajendran17 · 2026-01-29T00:34:20Z

Thanks @w13915984028 for the review. I have updated the PR addressing review comments.

w13915984028 · 2026-01-30T07:50:26Z

Another topic which could be tracked on a new issue/pr: The handling of MTU change

Currently, if user plans to change MTU, all VMs must be stopped, and then the new MTU will be propagated to VMs when VM start again.

L3 subinterface & controller, need to consider:

(1) It inherites the current MTU from it's parent cluster-network

(2) It detects this change and updates the new MTU to the managed subinterfaces

(3) When MTU is changed, should L3 workloads be stopped or not? esp. the underlay case, when e.g. cn2-br.2026 MTU is changed from 1500 to 9000, could the OVN detect this automatically and adapt to it?
(The VMs on top of OVN, will still be forced to stop due to the NAD checks).
This depends on some real tests, the worst case is to disable ovn and enable again. For third-party usage, we need to mention this on document.

thanks.

rrajendran17 · 2026-02-05T02:37:15Z

Another topic which could be tracked on a new issue/pr: The handling of MTU change

Currently, if user plans to change MTU, all VMs must be stopped, and then the new MTU will be propagated to VMs when VM start again.

L3 subinterface & controller, need to consider:

(1) It inherites the current MTU from it's parent cluster-network

(2) It detects this change and updates the new MTU to the managed subinterfaces

(3) When MTU is changed, should L3 workloads be stopped or not? esp. the underlay case, when e.g. cn2-br.2026 MTU is changed from 1500 to 9000, could the OVN detect this automatically and adapt to it? (The VMs on top of OVN, will still be forced to stop due to the NAD checks). This depends on some real tests, the worst case is to disable ovn and enable again. For third-party usage, we need to mention this on document.

thanks.

Thanks for bringing this out.
Yes the hostnetworkconfig controller should handle the MTU changes and update the vlan sub interface.
In non-overlay networks, the mtu update on the NAD from associated cluster network propagates the new MTU to vm guest os interface and the veth interface on the host.
But In case of overlay networks, there is no associated cluster network and all logical ports of vm connect to the ovs bridge.
The underlay with the new MTU should continue to handle the traffic with new MTU like any other physical interface handling the packets.I do not see any challenges there.
But the challenge is on the vm side, how the new MTU will be populated to the overlay vm inside guest os.
I will create a separate task to test this feasibility and add changes accordingly.

w13915984028

Some questions, thanks.

w13915984028 · 2026-02-24T09:46:43Z

pkg/webhook/nad/validator.go

+// check if any overlay vm exists for the cluster network used by the nad as underlay
+func (v *Validator) checkOverlayVMsUsingClusterNetwork(nad *cniv1.NetworkAttachmentDefinition, vlanID int) error {
+	clusterNetwork := utils.GetNadLabel(nad, utils.KeyClusterNetworkLabel)
+


from below context, it looks:

this input nad (being deleted) must be a IsVlanAccessMode NAD first? if it is true, please check it/or check vid == 0 first and return early, the check does not care overlay type nad

func (nc *NetConf) GetVlanID() int { if nc.IsVlanAccessMode() { return nc.Vlan } return 0 }

w13915984028 · 2026-02-24T09:55:11Z

pkg/webhook/nad/validator.go

+
+		if hostnetworkconfig.Spec.Underlay && int(hostnetworkconfig.Spec.VlanID) == vlanID {
+			if err := v.checkifVMExistsForOverlayNADs(); err != nil {
+				return fmt.Errorf("hostnetworkconfig %s uses overlay nads on cluster network %s, %w", hostnetworkconfig.Name, clusterNetwork, err)


hostnetworkconfig %s is underlay and is being used by overlay nad ...

w13915984028 · 2026-02-24T10:36:27Z

pkg/webhook/hostnetworkconfig/validator.go

+		}
+
+		//no more than one underlay exists for overlay networks. If user has to change underlay setting, old underlay has to be disabled first.
+		if hostnetworkconfig.Spec.Underlay && newhnc.Spec.Underlay {


seems need to add below to L251, avoid check upon self in update case

if hostnetworkconfig.Name == newhnc.Name { continue }

w13915984028 · 2026-02-24T10:40:00Z

pkg/webhook/hostnetworkconfig/validator.go

+
+	//check if vlanconfig contains all the nodes in the cluster
+	for _, node := range nodes {
+		if !matchedNodes.Contains(node.Name) {


skip if node.DeletionTimestamp != nil ?

mergify · 2026-02-27T00:29:27Z

This pull request is now in conflict. Could you fix it @rrajendran17? 🙏

rrajendran17 · 2026-03-02T16:56:24Z

@ibrokethecloud I have the addressed the following comments from our last discussion.Please have a look.Thanks

1.Use status as subresource
2.Use Patch command to update the status of each node in the hostnetworkconfig to avoid conflicts
3.Include a node selector in the hostnetworkconfig api for users to selectively configure the vlan sub interface on nodes.

Regarding 3,
case 1: Update node selector on hostnetworkconfig, so network controller agent adds or removes an interface based on its node selector labels.
case 2: Label a node and when a hostnetworkconfig exists with matching label, network controller agent adds/removes vlan interfaces on the node.

charts changes: harvester/charts#456

Note: I will create a separate task to handle node label updates which causes removal of vlan sub interfaces on a node which is being used as underlay.We need node webhook validations to restrict this and must be handled in harvester repo.

w13915984028

Some last questions, thanks.

w13915984028 · 2026-03-02T21:22:28Z

pkg/controller/agent/hostnetworkconfig/controller.go

+		if intfExists {
+			return h.removeHostNetworkInterface(hnc, true)
+		} else {
+			return hnc, nil


the removeHostNetworkInterface can fail on last step removeHostNetworkPerNodeStatus, and when reconciller runs again, due to vlan.GetVlan(hnc.Spec.ClusterNetwork) returns non-existing, it has no chance to call removeHostNetworkPerNodeStatus again

removeHostNetworkInterface v, err := vlan.GetVlan(hnc.Spec.ClusterNetwork) ... h.removeHostNetworkPerNodeStatus

could consider to optimize it as:

if !matchNodeSet { if intfExists { return h.removeHostNetworkInterface(hnc, true) } // always ensure the status is cleaned err := h.removeHostNetworkPerNodeStatus(hnc) if err != nil { return nil, err } return hnc, nil }

w13915984028 · 2026-03-02T21:28:25Z

pkg/controller/agent/hostnetworkconfig/controller.go

+	return "", fmt.Errorf("no matching IP found for node %s", nodeName)
+}
+func (h *Handler) removeHostNetworkPerNodeStatus(hnc *networkv1.HostNetworkConfig) error {
+	hnCopy := hnc.DeepCopy()


add below before L286,

if hnc.Status.NodeStatus == nil || hnc.Status.NodeStatus[nodeName] == nil { return nil }

it will make removeHostNetworkPerNodeStatus be idempotency

and can be freely called on OnChange

w13915984028 · 2026-03-02T21:29:41Z

pkg/controller/agent/hostnetworkconfig/controller.go

+
+	//update nodestatus when interface deleted due to node selector changes.
+	if onChange {
+		return nil, h.removeHostNetworkPerNodeStatus(hnc)


should return nil, h.removeHostNetworkPerNodeStatus(hnc) be?

err := h.removeHostNetworkPerNodeStatus(hnc) if err != nil { return nil, err } return hnc, nil

w13915984028 · 2026-03-02T21:34:12Z

pkg/webhook/hostnetworkconfig/validator.go

+	}
+
+	//vlan interface chosen as underlay must have vlanconfig spanning all nodes
+	if err := v.checkVCSpansAllNodes(newhnc.Spec.ClusterNetwork); err != nil {


recalled one scenario:

besides mgmt, all other cluster-network can skip the witness node (the witness node normally only has mgmt related nic)

pkg/controller/manager/clusternetwork/controller.go

ibrokethecloud · 2026-03-03T04:54:40Z

pkg/controller/agent/vlanconfig/controller.go

+	cnClient                    ctlnetworkv1.ClusterNetworkClient
+	cnCache                     ctlnetworkv1.ClusterNetworkCache
+	cnController                ctlnetworkv1.ClusterNetworkController
+	hostNetworkConfigClient     ctlnetworkv1.HostNetworkConfigClient


client does not seem to be used anywhere

ibrokethecloud · 2026-03-03T05:08:16Z

pkg/controller/agent/vlanconfig/controller.go

 	}

+	//reconcile hostnetworkconfig to stop DHCP lease managers associated with the removed uplink
+	if err := h.reconcileHostNetwork(vs.Status.ClusterNetwork); err != nil {


the only aim of reconcileHostNetwork seems to be to trigger requeue of HostNetworkConfig when vlan config changes.

We can move all this directly toe hostnetworkconfig controller in the agent, and leverage the relatedresource handler from wrangler

https://github.com/harvester/harvester/blob/master/pkg/controller/master/addon/addon.go#L61

This will ensure all changes for hostnetworkconfig exist in that controller only.

The problem is, we should make sure that the vlanconfig has removed the cluster network uplink successfully before calling hostnetworkconfig to cleanup associated resources during remove and during update/add of vlanconfig we should make sure that the cluster network uplink is available before calling hostnetworkconfig controller to create sub interfaces on top of it.
Would it be better if we enqueue hostnetworkconfig controller from vlanconfig in that case ?

ibrokethecloud · 2026-03-03T06:49:30Z

pkg/controller/agent/hostnetworkconfig/controller.go

+	}
+
+	// node selector matches and host network interface already exists, skip processing
+	if intfExists {


Is it possible to have a scenario the link is setup but the HostNetworkConfig status update fails, the object will be requeued, and interface will be found and contorller will exit without actually updating the HostNetworkConfig status

yes, that scenario is possible.I will add code to update the hostnetworkconfig status even if the interface exists.

w13915984028

LGTM, thanks for your big efforts.

mergify · 2026-03-04T01:43:31Z

This pull request is now in conflict. Could you fix it @rrajendran17? 🙏

ibrokethecloud · 2026-03-04T02:12:43Z

pkg/webhook/hostnetworkconfig/validator.go

+	oldhnc := oldObj.(*networkv1.HostNetworkConfig)
+	newhnc := newObj.(*networkv1.HostNetworkConfig)
+
+	// ignore the update if the resource is being deleted


nit: not needed as the Delete handler will get the deletion requests

ibrokethecloud · 2026-03-04T02:20:35Z

pkg/webhook/vlanconfig/validator.go

 	vmiCache ctlkubevirtv1.VirtualMachineInstanceCache,
-	cnCache ctlnetworkv1.ClusterNetworkCache) *Validator {
+	cnCache ctlnetworkv1.ClusterNetworkCache,
+	hncCache ctlnetworkv1.HostNetworkConfigCache,


hncCache and vmCache seem unused

ibrokethecloud

lgtm. thanks for the PR.

w13915984028

LGTM, thanks.

Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

Copilot AI review requested due to automatic review settings January 14, 2026 22:23

Copilot started reviewing on behalf of rrajendran17 January 14, 2026 22:24 View session

rrajendran17 requested a review from a team January 14, 2026 22:30

Copilot AI reviewed Jan 14, 2026

View reviewed changes

pkg/webhook/vlanconfig/validator.go Outdated Show resolved Hide resolved

pkg/utils/bridge.go Show resolved Hide resolved

pkg/network/iface/link.go Outdated Show resolved Hide resolved

rrajendran17 force-pushed the ipconnectivity branch from 3940728 to eb65a3d Compare January 14, 2026 22:40

rrajendran17 changed the title ~~HEP:#9335 support L3 connectivity on vlan sub-interfaces~~ Support L3 connectivity on vlan sub-interfaces Jan 15, 2026

rrajendran17 force-pushed the ipconnectivity branch from 0485ac0 to eb0a62c Compare January 15, 2026 19:08

This was referenced Jan 16, 2026

[FEATURE] Possibility to assign IP addresses to the Hosts in the Virtual Machine Networks harvester/harvester#8101

Open

[FEATURE] Support Layer 3 connectivity on user defined cluster network to act as underlay harvester/harvester#7834

Open

rrajendran17 force-pushed the ipconnectivity branch from eb0a62c to b1a487b Compare January 16, 2026 22:41

rrajendran17 commented Jan 19, 2026

View reviewed changes

w13915984028 self-requested a review January 22, 2026 12:54

w13915984028 reviewed Jan 22, 2026

View reviewed changes

pkg/webhook/hostnetworkconfig/validator.go Outdated Show resolved Hide resolved

w13915984028 requested a review from a team January 23, 2026 08:46

w13915984028 reviewed Jan 23, 2026

View reviewed changes

pkg/controller/agent/hostnetworkconfig/controller.go Show resolved Hide resolved

rrajendran17 force-pushed the ipconnectivity branch from b1c0692 to 9209e3f Compare January 28, 2026 23:41

rrajendran17 requested review from mingshuoqiu and starbops January 29, 2026 19:19

rrajendran17 self-assigned this Jan 29, 2026

rrajendran17 force-pushed the ipconnectivity branch from 9209e3f to 28dd4c2 Compare January 29, 2026 23:51

w13915984028 mentioned this pull request Jan 30, 2026

add hostnetworkconfig crd and rbac permissions harvester/charts#456

Merged

rrajendran17 force-pushed the ipconnectivity branch from 28dd4c2 to 7c6f6b4 Compare February 5, 2026 02:06

rrajendran17 force-pushed the ipconnectivity branch from 7c6f6b4 to b612c37 Compare February 6, 2026 22:35

w13915984028 reviewed Feb 24, 2026

View reviewed changes

rrajendran17 force-pushed the ipconnectivity branch from 216cdc3 to 510fad6 Compare February 27, 2026 00:28

rrajendran17 force-pushed the ipconnectivity branch 3 times, most recently from d45f10a to 5741595 Compare March 2, 2026 03:17

rrajendran17 requested a review from a team March 2, 2026 16:48

rrajendran17 force-pushed the ipconnectivity branch from 5741595 to e6742a7 Compare March 2, 2026 19:48

w13915984028 reviewed Mar 2, 2026

View reviewed changes

w13915984028 requested a review from a team March 2, 2026 21:36

rrajendran17 force-pushed the ipconnectivity branch from b3206fb to 4fb3de9 Compare March 3, 2026 00:35

ibrokethecloud reviewed Mar 3, 2026

View reviewed changes

pkg/controller/manager/clusternetwork/controller.go Outdated Show resolved Hide resolved

ibrokethecloud reviewed Mar 3, 2026

View reviewed changes

pkg/controller/manager/clusternetwork/controller.go Show resolved Hide resolved

ibrokethecloud reviewed Mar 3, 2026

View reviewed changes

w13915984028 previously approved these changes Mar 3, 2026

View reviewed changes

rrajendran17 dismissed w13915984028’s stale review via 3bb30a1 March 4, 2026 01:42

rrajendran17 force-pushed the ipconnectivity branch from 3d2ff25 to 3bb30a1 Compare March 4, 2026 01:42

ibrokethecloud reviewed Mar 4, 2026

View reviewed changes

ibrokethecloud previously approved these changes Mar 4, 2026

View reviewed changes

rrajendran17 dismissed ibrokethecloud’s stale review via d1c3acb March 4, 2026 05:49

rrajendran17 force-pushed the ipconnectivity branch from 233bc6d to d1c3acb Compare March 4, 2026 05:49

w13915984028 approved these changes Mar 4, 2026

View reviewed changes

HEP:#9335 support L3 connectivity on vlan sub-interfaces

32cfb4f

Signed-off-by: Renuka Devi Rajendran <renuka.rajendran@suse.com>

rrajendran17 force-pushed the ipconnectivity branch from 245c278 to 32cfb4f Compare March 4, 2026 18:09

rrajendran17 merged commit eb271b2 into harvester:master Mar 4, 2026
5 checks passed

Conversation

rrajendran17 commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rrajendran17 Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Jan 22, 2026

Uh oh!

w13915984028 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

w13915984028 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mergify bot commented Jan 28, 2026

Uh oh!

rrajendran17 commented Jan 29, 2026

Uh oh!

w13915984028 commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rrajendran17 commented Feb 5, 2026

Uh oh!

w13915984028 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Feb 27, 2026

Uh oh!

rrajendran17 commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

w13915984028 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

w13915984028 Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

rrajendran17 commented Jan 14, 2026 •

edited

Loading

rrajendran17 Jan 19, 2026 •

edited

Loading

w13915984028 commented Jan 30, 2026 •

edited

Loading

rrajendran17 commented Mar 2, 2026 •

edited

Loading

w13915984028 Mar 2, 2026 •

edited

Loading