Skip to content

docs(networking): update kubeovn SNAT/DNAT diagrams and include merma… #1073

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
coulof wants to merge 4 commits into
base: main
Choose a base branch
from
Open

docs(networking): update kubeovn SNAT/DNAT diagrams and include merma… #1073

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
37c48ea
docs(networking): update kubeovn SNAT/DNAT diagrams and include merma…
coulof Jul 8, 2026
a268ae6
docs(networking): refine kubeovn DNAT mermaid diagram and update flow…
coulof Jul 9, 2026
5f32f6c
Merge branch 'harvester:main' into main
coulof Jul 16, 2026
3486323
Use the VLAN 2017 for consistency with the documentation
coulof Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 74 additions & 0 deletions static/img/kubeovnDNATFlow.mermaid
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
---
title: DNAT flow — external to VM (inbound)
config:
theme: base
securityLevel: loose
themeVariables:
fontFamily: 'SUSE, Verdana, sans-serif'
fontSize: '14px'
primaryColor: '#0ca678'
primaryTextColor: '#092a1d'
primaryBorderColor: '#0ca678'
lineColor: '#212529'
secondaryColor: '#1c7ed6'
tertiaryColor: '#e6fcf5'
mainBkg: '#ffffff'
nodeBorder: '#212529'
clusterBkg: '#f8f9fa'
clusterBorder: '#adb5bd'
titleColor: '#092a1d'
edgeLabelBackground: '#ffffff'
themeCSS: |
* { font-family: 'SUSE', Verdana, sans-serif; }
code, code * { font-family: 'SUSE Mono', 'Roboto Mono', monospace; font-weight: 500; font-size: 0.92em; }
flowchart:
rankSpacing: 70
nodeSpacing: 50
subGraphTitleMargin:
top: 6
bottom: 14
---
flowchart TD
classDef default fill:#ffffff,stroke:#212529,stroke-width:1px,color:#212529;
classDef overlay fill:#e6fcf5,stroke:#0ca678,stroke-width:2.5px,color:#092a1d;
classDef nat fill:#f3f0ff,stroke:#7048e8,stroke-width:2.5px,color:#3b0764;
classDef ext fill:#e7f5ff,stroke:#1c7ed6,stroke-width:2.5px,color:#0b2e5c;
classDef inet fill:#f8f9fa,stroke:#868e96,stroke-width:2px,color:#212529;
classDef annot fill:#f8f9fa,stroke:#adb5bd,stroke-width:1.5px,stroke-dasharray: 4 3,color:#495057;
classDef netVpc fill:#ffffff,stroke:#0ca678,stroke-width:2px,stroke-dasharray: 6 4,color:#092a1d;
classDef netExt fill:#ffffff,stroke:#1c7ed6,stroke-width:2px,stroke-dasharray: 6 4,color:#0b2e5c;

INET["<b>External client</b><br/>curl <code>10.115.8.7:8888</code>"]:::inet

subgraph EXT ["External subnet / provider network (eno50 — VLAN 2012)"]
direction LR
UGW["<b>Upstream gateway</b><br/><code>10.115.15.254</code>"]:::ext
ESUB["<b>External subnet</b><br/><code>subnetexternal 10.115.8.0/21</code><br/>EIP <code>10.115.8.7</code> on net2"]:::ext
UGW -->|"② routed in"| ESUB
end

subgraph VPC ["Custom VPC: commonvpc"]
direction TB
NATGW["<b>VPC NAT gateway pod<br/>(vpc-nat-gw-gw1-0)</b><br/><code>net2: 10.115.8.3 (external)</code><br/><code>PREROUTING → DNAT_FILTER</code>"]:::nat
LS["<b>OVN logical switch</b><br/><code>subnetinternal 172.20.10.0/24</code>"]:::overlay
VM["<b>VM (nginx)</b><br/><code>172.20.10.8:80</code>"]:::overlay
NATGW ==>|"④ DNAT: dst 10.115.8.7:8888 → 172.20.10.8:80"| LS
LS -->|"⑤ forwarded via net1<br/>172.20.10.254"| VM
end

IPT["iptables DNAT rule (inside nat gw pod):<br/><code>-A DNAT_FILTER -d 10.115.8.7 -p tcp --dport 8888</code><br/><code>-j DNAT --to-destination 172.20.10.8:80</code>"]:::annot

INET -->|"① dst 10.115.8.7:8888"| UGW
ESUB -->|"③ arrives on net2 (10.115.8.3)"| NATGW
NATGW -.->|"implements"| IPT

class VPC netVpc;
class EXT netExt;

%% edge colours: 0 UGW-ESUB, 1 NATGW-LS(DNAT), 2 LS-VM, 3 INET-UGW, 4 ESUB-NATGW, 5 NATGW-IPT
linkStyle 0 stroke:#1c7ed6,stroke-width:2px;
linkStyle 1 stroke:#7048e8,stroke-width:3px;
linkStyle 2 stroke:#0ca678,stroke-width:2px;
linkStyle 3 stroke:#1c7ed6,stroke-width:2px;
linkStyle 4 stroke:#1c7ed6,stroke-width:2px;
linkStyle 5 stroke:#adb5bd,stroke-width:1.5px;
Binary file modified static/img/kubeovnDNATFlow.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
73 changes: 73 additions & 0 deletions static/img/kubeovnSNATFlow.mermaid
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
---
title: SNAT flow — VM to internet (outbound)
config:
theme: base
securityLevel: loose
themeVariables:
fontFamily: 'SUSE, Verdana, sans-serif'
fontSize: '14px'
primaryColor: '#0ca678'
primaryTextColor: '#092a1d'
primaryBorderColor: '#0ca678'
lineColor: '#212529'
secondaryColor: '#1c7ed6'
tertiaryColor: '#e6fcf5'
mainBkg: '#ffffff'
nodeBorder: '#212529'
clusterBkg: '#f8f9fa'
clusterBorder: '#adb5bd'
titleColor: '#092a1d'
edgeLabelBackground: '#ffffff'
themeCSS: |
* { font-family: 'SUSE', Verdana, sans-serif; }
code, code * { font-family: 'SUSE Mono', 'Roboto Mono', monospace; font-weight: 500; font-size: 0.92em; }
flowchart:
rankSpacing: 70
nodeSpacing: 50
subGraphTitleMargin:
top: 6
bottom: 14
---
flowchart TD
classDef default fill:#ffffff,stroke:#212529,stroke-width:1px,color:#212529;
classDef overlay fill:#e6fcf5,stroke:#0ca678,stroke-width:2.5px,color:#092a1d;
classDef nat fill:#f3f0ff,stroke:#7048e8,stroke-width:2.5px,color:#3b0764;
classDef ext fill:#e7f5ff,stroke:#1c7ed6,stroke-width:2.5px,color:#0b2e5c;
classDef inet fill:#f8f9fa,stroke:#868e96,stroke-width:2px,color:#212529;
classDef annot fill:#f8f9fa,stroke:#adb5bd,stroke-width:1.5px,stroke-dasharray: 4 3,color:#495057;
classDef netVpc fill:#ffffff,stroke:#0ca678,stroke-width:2px,stroke-dasharray: 6 4,color:#092a1d;
classDef netExt fill:#ffffff,stroke:#1c7ed6,stroke-width:2px,stroke-dasharray: 6 4,color:#0b2e5c;

subgraph VPC ["Custom VPC: commonvpc"]
direction TB
VM["<b>VM (guest OS)</b><br/><code>172.20.10.x/24</code>"]:::overlay
LS["<b>OVN logical switch</b><br/><code>subnetinternal 172.20.10.0/24</code>"]:::overlay
NATGW["<b>VPC NAT gateway pod<br/>(vpc-nat-gw-gw1-0)</b><br/><code>net1: 172.20.10.254 (internal)</code><br/><code>net2: 10.115.8.3 / 10.115.8.7 (external)</code>"]:::nat
VM ---|"① default GW<br/>172.20.10.254"| LS
LS -->|"② → net1 (172.20.10.254)"| NATGW
end

subgraph EXT ["External subnet / provider network (eno50 — VLAN 2017)"]
direction LR
ESUB["<b>External subnet</b><br/><code>subnetexternal 10.115.8.0/21</code>"]:::ext
UGW["<b>Upstream gateway</b><br/><code>10.115.15.254</code>"]:::ext
ESUB -->|"④ src IP: 10.115.8.7"| UGW
end

INET["<b>Internet / external host</b><br/>e.g. <code>8.8.8.8</code>"]:::inet
IPT["iptables SNAT rule (inside nat gw pod):<br/><code>-A SHARED_SNAT -s 172.20.10.0/24 -o net2</code><br/><code>-j SNAT --to-source 10.115.8.7</code>"]:::annot

NATGW ==>|"③ SNAT: src 172.20.10.x → 10.115.8.7"| ESUB
UGW -->|"⑤ routed out"| INET
NATGW -.->|"implements"| IPT

class VPC netVpc;
class EXT netExt;

%% edge colours: 0 VM-LS, 1 LS-NATGW, 2 ESUB-UGW, 3 NATGW-ESUB(SNAT), 4 UGW-INET, 5 NATGW-IPT
linkStyle 0 stroke:#0ca678,stroke-width:2px;
linkStyle 1 stroke:#0ca678,stroke-width:2px;
linkStyle 2 stroke:#1c7ed6,stroke-width:2px;
linkStyle 3 stroke:#7048e8,stroke-width:3px;
linkStyle 4 stroke:#1c7ed6,stroke-width:2px;
linkStyle 5 stroke:#adb5bd,stroke-width:1.5px;
Binary file modified static/img/kubeovnSNATFlow.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.