Skip to content

add docs for u2oInterconnection subnet isolate#573

Open
changluyi wants to merge 2 commits intoalauda:masterfrom
changluyi:docs/u2o-interconnection-subnet-isolation
Open

add docs for u2oInterconnection subnet isolate#573
changluyi wants to merge 2 commits intoalauda:masterfrom
changluyi:docs/u2o-interconnection-subnet-isolation

Conversation

@changluyi
Copy link
Collaborator

@changluyi changluyi commented Feb 25, 2026

Summary by CodeRabbit

  • Documentation
    • Added a new guide: "Isolation Between Underlay Subnets with u2oInterconnection Enabled." Describes a two-step configuration workflow (controller/network settings and subnet policies), explains that the node network CIDR must be included in allowed subnets, clarifies that private mode restricts inbound but not outbound traffic, and details conntrack/ACL considerations and expected traffic routing/behavior.

Signed-off-by: clyi <clyi@alauda.io>
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 25, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e24b4e3 and f58e32d.

📒 Files selected for processing (1)
  • docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx

Walkthrough

Adds documentation describing how to isolate traffic between Underlay subnets when u2oInterconnection: true, including a two-step workflow: adjust kube-ovn-controller conntrack behavior, then configure subnet spec (private, allowSubnets) with cautions about node CIDR and traffic direction.

Changes

Cohort / File(s) Summary
Kube-OVN Subnet Isolation Documentation
docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx
Adds a new section "Isolation Between Underlay Subnets with u2oInterconnection Enabled" describing routing via internal OVN, two-step configuration (controller arg --ls-ct-skip-dst-lport-ips=false, and subnet spec.u2oInterconnection, spec.private, allowSubnets), and notes/cautions about conntrack/ACLs, including requirement to include node network CIDR and inbound vs outbound behavior.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

  • fanzy618

Poem

🐰 I nibble docs and hop through lines so neat,
Two steps to bind subnets where underlays meet.
Include the node CIDR, mind conntrack's gate,
Private keeps inbound tidy — outbound's your fate.
A rabbit's small guide, hopped in rhyme and sprite. 🌿

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding documentation for the u2oInterconnection subnet isolation feature.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx`:
- Around line 59-70: Add explicit application instructions before the presented
spec YAML: tell the user to run a kubectl edit subnet <subnet-name> (or kubectl
patch subnet <subnet-name> --type=merge -p ...) to add/modify the spec fields
u2oInterconnection, private and allowSubnets, and also mention the alternative
of applying the same changes via the Kube-OVN UI subnet edit workflow; ensure
the text says "Add or modify the following fields under spec:" immediately
before the YAML so users know how to apply the config.

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9cba494 and e24b4e3.

📒 Files selected for processing (1)
  • docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx

Comment on lines +59 to +70
### Step 2: Configure Subnet Isolation

Configure the subnet with the following parameters:

```yaml
spec:
u2oInterconnection: true
private: true
allowSubnets:
- 10.0.0.0/24 # CIDR of the subnet allowed for inbound access
- 172.16.0.0/16 # Node network CIDR (REQUIRED)
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Step 2 is missing instructions on how to apply the subnet configuration.

Step 1 provides an explicit kubectl edit command, but Step 2 only presents a bare spec: YAML fragment with no guidance on how to apply it — no kubectl edit subnet <name>, no kubectl patch, and no reference to the existing UI workflow from the Procedure section above. Users unfamiliar with Kube-OVN will not know how to apply this config.

✏️ Suggested addition before the YAML block
 Configure the subnet with the following parameters:
 
+```bash
+kubectl edit subnet <subnet-name>
+```
+
+Add or modify the following fields under `spec`:
+
 ```yaml
 spec:
   u2oInterconnection: true
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx` around
lines 59 - 70, Add explicit application instructions before the presented spec
YAML: tell the user to run a kubectl edit subnet <subnet-name> (or kubectl patch
subnet <subnet-name> --type=merge -p ...) to add/modify the spec fields
u2oInterconnection, private and allowSubnets, and also mention the alternative
of applying the same changes via the Kube-OVN UI subnet edit workflow; ensure
the text says "Add or modify the following fields under spec:" immediately
before the YAML so users know how to apply the config.

Signed-off-by: clyi <clyi@alauda.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant