Virtual Networking

Cockpit provides tools to configure and manage network connectivity for virtualized workloads. It supports two main networking models: host-level standard networks and cluster-level distributed networks.

---

1. Host Virtual Networks (Standard Networks)

Host virtual networks are defined at the individual hypervisor host scope. They configure host-level virtual bridges and control how VMs communicate with the outside network or other local workloads.

Configuration Parameters

• Name: The identifier of the virtual network.
• Type/Driver: Standard libvirt networking.
• Mode:
  • NAT (Network Address Translation): VMs share the host's physical IP address. Inbound traffic is blocked by default, while outbound traffic is routed through the host.
  • Routed: Outbound traffic is routed directly onto the physical network without address translation, requiring upstream routing configuration.
  • Host-Only (Isolated): VMs can only communicate with other VMs on the same virtual switch and the hypervisor host itself. No external network access is permitted.
• IP Address & Netmask: Defines the private subnet gateway for the virtual switch (e.g., 192.168.222.1 with netmask 255.255.255.0).
• DHCP Configuration: Defines the pool of dynamic IP addresses allocated to guest VMs (e.g., IP start 192.168.222.10 to end 192.168.222.50).
• Autostart: Toggles whether the virtual network starts automatically when the hypervisor host boots.

Operational Actions

• Start: Activates the virtual network bridge and enabling packet forwarding.
• Stop: Tears down the virtual switch, disconnecting all attached VM network interfaces.
• Edit: Modify autostart status or configuration parameters.
• Delete: Permanently removes the network configuration from the host (network must be stopped first).

Runtime Monitoring

• DHCP Leases: Queries the host to list active IP allocations, showing MAC addresses, hostname, IP address, and lease expiration times.
• Active Ports: Lists all active virtual interface connections mapped to running VMs.

---

2. Distributed Networks

Distributed networks are defined at the cluster scope. They ensure network configuration consistency across all hypervisor hosts in a cluster, enabling virtual machines to undergo compute live migration without network disconnection.

Key Characteristics

• Open vSwitch (OVS) Integration: Utilizes an OVS backend (with standard Linux bridges as a fallback) to manage high-performance software-defined switches across hypervisors.
• Host Interface Mappings: Translates the logical distributed network to host-specific physical network interfaces (upstream NICs or OVS bridges) on each hypervisor.
• Synchronization Lifecycle: When created or updated, Cockpit pushes the network configuration down to all member hosts in the cluster. It monitors host-mapping synchronization status:
  • synced: The host has successfully created and bound the virtual switch.
  • active: The distributed network is successfully provisioned and operational across all hosts.
  • partial: The configuration was successfully applied on some hosts, but failed on others, requiring administrator intervention.
  • error: The provisioning failed to apply across the cluster.

---

3. Network Deletion Guard

To prevent accidental packet loss and VM isolation, Cockpit implements a deletion guard policy on distributed networks.

• Usage Checks: Before executing a delete command on a distributed network, Cockpit queries the cluster configuration to verify if any VM is configured to use it.
• API Guard (HTTP 409): If any VM is mapped to the distributed network, the DELETE request (DELETE /api/v1/distributed-networks/:id) is blocked. The API returns an HTTP 409 Conflict status code containing:

  {
    "code": "NETWORK_IN_USE",
    "error": "Cannot delete distributed network: in use by virtual machines [vm-name]"
  }

• Remediation: To delete a distributed network, administrators must first edit the settings of any utilizing VMs (detaching or mapping their NICs to a different switch) or delete the VMs entirely.