Chapter 4. Red Hat OpenShift components and architecture 65
When a node is added to the cluster, the OpenShift SDN registers the local host with the 
registry on master to allocate an open subnet to the node. 
Then, OpenShift SDN creates and configures the following network devices:
/SM590000br0: Open Virtual Switch (OVS) bridge device to which pod containers are attached. 
OpenShift SDN also configures a set of non-subnet-specific flow rules on this bridge.
/SM590000tun0: OVS internal port (port 2 on br0). This port is assigned the cluster subnet gateway 
address and is used for external network access. OpenShift SDN configures netfilter and 
routing rules to enable access from the cluster subnet to the external network by way of 
NAT.
/SM590000vxlan_sys_4789: OVS VXLAN device (port 1 on br0), which provides access to containers 
on remote nodes. It is referred to as vxlan0 in the OVS rules.
When a pod is started on the host, OpenShift SDN completes the following process:
1. Assigns the pod an open IP address from the node’s cluster subnet.
2. Attaches the host side of the pod’s veth interface pair to the OVS bridge br0.
3. Adds OpenFlow rules to the OVS database to route traffic that is addressed to the new 
pod to the correct OVS port. In the case, of the ovs-multitenant plug-in, it adds OpenFlow 
rules to tag traffic that is coming from the Pod with the Pod’s VNID, and to allow traffic into 
the Pod if the traffic’s VNID matches the Pod’s VNID (or is the privileged VNID 0). 
Non-matching traffic is filtered out by a generic rule.
OpenShift SDN nodes also watch for subnet updates from the SDN master. When a subnet is 
added, the node adds OpenFlow rules on br0 so that packets with a destination IP address in 
the remote subnet go to vxlan0 (port 1 on br0) and thus out onto the network. The ovs-subnet 
plug-in sends all packets across the VXLAN with VNID 0, but the ovs-multitenant plug-in uses 
the suitable VNID for the source container.
Figure 4-4 shows the components that are involved in pods communication. 
Figure 4-4   Communication example between pods
If both containers are running in the same node, the communication flow from one pod to 
another uses the vethx interface from the same br0 interface of the node. 
If the containers are running on different nodes, the flow of packets from one pod to another 
use the vethX interface from the br0 ovs interface on different nodes.