Choosing Between OpenShift SDN and OVN‑Kubernetes CNI in Red Hat OpenShift

Decision and constraints

When deploying or upgrading a Red Hat OpenShift Container Platform (OCP) cluster you must select a Container Network Interface (CNI) plugin. The decision is constrained by:

• Supported CNI for the target OCP version.
• Requirement to enforce Kubernetes NetworkPolicy objects.
• Need for egress IP or egress router functionality.
• Compatibility with existing SDN/IPAM solutions or third‑party security tools.

Supported options comparison

Feature	OpenShift SDN	OVN‑Kubernetes
Default in OCP 4.x	Yes up to 4.11	Yes from 4.12 onward
NetworkPolicy support	Full	Full
Egress IP / Egress Router	Supported	Supported
Multitenancy isolation	Project‑based	Project‑based with richer logging
Performance	Good for most workloads	Lower latency, higher scale
Maturity	Mature, widely used	Newer, rapidly improving
Migration complexity	N/A (incumbent)	Requires cluster reinstall or migration tool

Trade‑offs

OpenShift SDN offers proven stability and seamless upgrades in existing clusters, making it the safe choice for production workloads that do not need advanced networking features. OVN‑Kubernetes provides more flexible network policy implementation, better observability, and is the default for newer OpenShift releases, but may require additional validation for legacy SDN‑dependent tools and involves a migration path if switching from SDN.

Implementation

During new cluster installation

Set the desired CNI in the install-config.yaml before creating the cluster. You need cluster-admin privileges to apply the manifest.

# install-config.yaml snippet
networking:
  networkType: OVNKubernetes   # or OpenShiftSDN

After saving the file, run the installer as usual:

openshift-install create cluster --dir=<installation-dir>

Migrating an existing cluster

OCP provides a migration tool that recreates the node network pods. This operation is not in‑place; it will cause temporary network disruption and should be scheduled during a maintenance window.

# Switch to OVN‑Kubernetes (requires cluster-admin)
oc adm network migration --to-type OVNKubernetes

# To revert to OpenShift SDN
oc adm network migration --to-type OpenShiftSDN

The tool drains nodes, updates the Network operator, and rolls out the new daemon set. Monitor progress with oc get pods -n openshift-network-operator.

Validation

After the migration completes, verify the active CNI:

oc get network.operator cluster -o yaml

Check that spec.defaultNetwork.type matches the selected plugin (OpenShiftSDN or OVNKubernetes).
Confirm that the corresponding daemon set is healthy:
# For OpenShift SDN
oc get daemonset -n openshift-sdn
# For OVN‑Kubernetes
oc get daemonset -n openshift-ovn-kubernetes

All pods should be in the Running state and oc get nodes should show no NetworkUnavailable conditions.
Limitations and practical checks

Changing the CNI after cluster creation is not an in‑place switch; it requires the migration tool or a reinstall and may cause temporary packet loss.
Validate that any third‑party CNI plugins, firewalls, or security appliances are compatible with the chosen CNI’s MTU and flow rules before cutting over.
After migration, run a simple connectivity test between two pods in different namespaces to ensure NetworkPolicy enforcement works as expected:

# Create test pods
oc run test‑a --image=busybox --restart=Never --namespace=proj-a -- sleep 3600
oc run test‑b --image=busybox --restart=Never --namespace=proj-b -- sleep 3600

# From test‑a, try to reach test‑b (should be denied if a deny‑all policy exists)
oc exec test‑a -n proj-a -- nc -z test‑b.proj-b.svc.cluster.local 80

If the connection is blocked as expected, the CNI and NetworkPolicy integration are functioning.