A NodeNetworkConfigurationPolicy (NNCP) is a Kubernetes resource that tells the NMState Operator how the node network should be configured — persistently, including after reboot. On this (Hetzner) server, variant A is used: three pure software bridges without a physical uplink. eno2 is controlled by OVN-K/OVS and must not be used directly as a bridge port.
1✅ Current variant: A — software bridges (
br-net1, br-net2, br-net3)2What do the three bridges do? → Three isolated virtual switches on the node
br-net1 = network 1 (e.g. application VMs)br-net2 = network 2 (e.g. database VMs)br-net3 = network 3 (e.g. storage/backup VMs)3VMs on the same bridge can communicate — VMs on different bridges are isolated
4No traffic leaves the node — external access only via MetalLB/masquerade on
eno2/br-ex5Apply NNCP:
oc apply -f sno-software-bridges.yaml6Track status:
watch oc get nnce (wait until Available)7Verify bridges on the node using the commands in the Commands / YAML tab
8Critical:
br-ex / eno2 node IP must be unchanged after apply!