From 759ba6a4f9125c02322c2f859b3240b94a09a8f0 Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 30 Oct 2026 12:40:07 +0000 Subject: [PATCH 1/2] DOCS-3138: Say KubeVirt live migration is IPv4-only --- .../networking/kubevirt/kubevirt-networking.mdx | 2 ++ .../networking/kubevirt/live-migration-bgp.mdx | 14 -------------- .../networking/kubevirt/kubevirt-networking.mdx | 2 ++ .../networking/kubevirt/live-migration-bgp.mdx | 14 -------------- .../networking/kubevirt/kubevirt-networking.mdx | 2 ++ .../networking/kubevirt/live-migration-bgp.mdx | 14 -------------- .../networking/kubevirt/kubevirt-networking.mdx | 2 ++ .../networking/kubevirt/live-migration-bgp.mdx | 14 -------------- calico/networking/kubevirt/kubevirt-networking.mdx | 2 ++ calico/networking/kubevirt/live-migration-bgp.mdx | 14 -------------- .../networking/kubevirt/kubevirt-networking.mdx | 2 ++ .../networking/kubevirt/live-migration-bgp.mdx | 14 -------------- .../networking/kubevirt/kubevirt-networking.mdx | 2 ++ .../networking/kubevirt/live-migration-bgp.mdx | 14 -------------- 14 files changed, 14 insertions(+), 98 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/kubevirt-networking.mdx b/calico-enterprise/networking/kubevirt/kubevirt-networking.mdx index 71f2859c89..84c2cc93ed 100644 --- a/calico-enterprise/networking/kubevirt/kubevirt-networking.mdx +++ b/calico-enterprise/networking/kubevirt/kubevirt-networking.mdx @@ -97,6 +97,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources using diff --git a/calico-enterprise/networking/kubevirt/live-migration-bgp.mdx b/calico-enterprise/networking/kubevirt/live-migration-bgp.mdx index 8ab6352fd6..93faa38c1e 100644 --- a/calico-enterprise/networking/kubevirt/live-migration-bgp.mdx +++ b/calico-enterprise/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/kubevirt-networking.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/kubevirt-networking.mdx index 0691761388..3931cceb08 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/kubevirt-networking.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/kubevirt-networking.mdx @@ -86,6 +86,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources using diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/live-migration-bgp.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/live-migration-bgp.mdx index 8ab6352fd6..93faa38c1e 100644 --- a/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/live-migration-bgp.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: diff --git a/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/kubevirt-networking.mdx b/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/kubevirt-networking.mdx index 0691761388..3931cceb08 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/kubevirt-networking.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/kubevirt-networking.mdx @@ -86,6 +86,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources using diff --git a/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/live-migration-bgp.mdx b/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/live-migration-bgp.mdx index 8ab6352fd6..93faa38c1e 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/live-migration-bgp.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/kubevirt-networking.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/kubevirt-networking.mdx index 71f2859c89..84c2cc93ed 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/kubevirt-networking.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/kubevirt-networking.mdx @@ -97,6 +97,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources using diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/live-migration-bgp.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/live-migration-bgp.mdx index 8ab6352fd6..93faa38c1e 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/live-migration-bgp.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: diff --git a/calico/networking/kubevirt/kubevirt-networking.mdx b/calico/networking/kubevirt/kubevirt-networking.mdx index 1b3475b036..e3ab5051fc 100644 --- a/calico/networking/kubevirt/kubevirt-networking.mdx +++ b/calico/networking/kubevirt/kubevirt-networking.mdx @@ -75,6 +75,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources, either by installing the $[prodname] diff --git a/calico/networking/kubevirt/live-migration-bgp.mdx b/calico/networking/kubevirt/live-migration-bgp.mdx index 5bc7154799..93688098ef 100644 --- a/calico/networking/kubevirt/live-migration-bgp.mdx +++ b/calico/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: diff --git a/calico_versioned_docs/version-3.32/networking/kubevirt/kubevirt-networking.mdx b/calico_versioned_docs/version-3.32/networking/kubevirt/kubevirt-networking.mdx index 1b3475b036..e3ab5051fc 100644 --- a/calico_versioned_docs/version-3.32/networking/kubevirt/kubevirt-networking.mdx +++ b/calico_versioned_docs/version-3.32/networking/kubevirt/kubevirt-networking.mdx @@ -75,6 +75,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources, either by installing the $[prodname] diff --git a/calico_versioned_docs/version-3.32/networking/kubevirt/live-migration-bgp.mdx b/calico_versioned_docs/version-3.32/networking/kubevirt/live-migration-bgp.mdx index 5bc7154799..93688098ef 100644 --- a/calico_versioned_docs/version-3.32/networking/kubevirt/live-migration-bgp.mdx +++ b/calico_versioned_docs/version-3.32/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: diff --git a/calico_versioned_docs/version-3.33/networking/kubevirt/kubevirt-networking.mdx b/calico_versioned_docs/version-3.33/networking/kubevirt/kubevirt-networking.mdx index 1b3475b036..e3ab5051fc 100644 --- a/calico_versioned_docs/version-3.33/networking/kubevirt/kubevirt-networking.mdx +++ b/calico_versioned_docs/version-3.33/networking/kubevirt/kubevirt-networking.mdx @@ -75,6 +75,8 @@ policy is in place on the destination, or until the timeout expires. ## Before you begin +- IPv4 addressing for the VMs. + Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only. - A working Kubernetes cluster with KubeVirt installed. - $[prodname] installed with BGP networking without overlay. - Access to `projectcalico.org/v3` resources, either by installing the $[prodname] diff --git a/calico_versioned_docs/version-3.33/networking/kubevirt/live-migration-bgp.mdx b/calico_versioned_docs/version-3.33/networking/kubevirt/live-migration-bgp.mdx index 5bc7154799..93688098ef 100644 --- a/calico_versioned_docs/version-3.33/networking/kubevirt/live-migration-bgp.mdx +++ b/calico_versioned_docs/version-3.33/networking/kubevirt/live-migration-bgp.mdx @@ -133,20 +133,6 @@ spec: operations: - setPriority: value: 512 - exportV6: - - action: Accept - peerType: eBGP - priority: 512 - operations: - - addCommunity: - value: "65000:100" - importV6: - - action: Accept - communities: - values: ["65000:100"] - operations: - - setPriority: - value: 512 ``` Key fields used in this filter: From fa2e4f35a49a411c833fc62061c3504b49172a5d Mon Sep 17 00:00:00 2001 From: Chris Tauchen Date: Fri, 30 Oct 2026 12:56:36 +0000 Subject: [PATCH 2/2] DOCS-3138: Say only IPv4 addresses are preserved for imported VMs --- .../networking/kubevirt/install-forklift-kubernetes.mdx | 1 + .../networking/kubevirt/install-forklift-openshift.mdx | 1 + calico-enterprise/networking/l2-bridge/vm-identity.mdx | 3 ++- .../networking/kubevirt/install-forklift-kubernetes.mdx | 1 + .../networking/kubevirt/install-forklift-openshift.mdx | 1 + .../version-3.24-2/networking/l2-bridge/vm-identity.mdx | 3 ++- 6 files changed, 8 insertions(+), 2 deletions(-) diff --git a/calico-enterprise/networking/kubevirt/install-forklift-kubernetes.mdx b/calico-enterprise/networking/kubevirt/install-forklift-kubernetes.mdx index 99d3a95f36..9ccfbd9c67 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-kubernetes.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-kubernetes.mdx @@ -32,6 +32,7 @@ Upstream Forklift's guest conversion fails on clusters whose nodes carry the run - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - KubeVirt. - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx). + Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over. - Multus, for secondary-NIC attachments and for the auto-created `host` provider, whose connection test queries `NetworkAttachmentDefinition` and reports `ConnectionFailed` without that CRD. You need the thick DaemonSet v4.3.1 or later. v4.2.1 through v4.3.0 pass the wrong network config on delete, so Calico never releases the deleted pod's or VM's IP address ([multus-cni#1449](https://github.com/k8snetworkplumbingwg/multus-cni/issues/1449)). If you are upgrading from one of those, `calicoctl ipam check` finds the addresses already leaked. Pin the daemon container and the `install-multus-binary` init container to the same tag, and raise the daemon memory limit from 50Mi to 512Mi to stop it being OOM-killed. - cert-manager, which issues the serving certificates. Without it the `forklift-api`, `forklift-validation`, and `forklift-inventory` pods stay NotReady. OpenShift needs nothing here; its service-ca operator issues the same certificates. No `Issuer` or `ClusterIssuer` setup is needed: the operator creates its own in `konveyor-forklift`, which you can check with `kubectl -n konveyor-forklift get issuers,certificates`. diff --git a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx index 8e259efa8c..f7480bf11a 100644 --- a/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise/networking/kubevirt/install-forklift-openshift.mdx @@ -28,6 +28,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx). + Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over. ## How to diff --git a/calico-enterprise/networking/l2-bridge/vm-identity.mdx b/calico-enterprise/networking/l2-bridge/vm-identity.mdx index 37d5754a82..8df6771d1c 100644 --- a/calico-enterprise/networking/l2-bridge/vm-identity.mdx +++ b/calico-enterprise/networking/l2-bridge/vm-identity.mdx @@ -29,7 +29,8 @@ The configuration is the same for a VM migrating with an address it already had - An L2 network already created and verified. See [Connect workloads to an existing VLAN](connect-vlan.mdx). - KubeVirt installed. -- The VM's current IP address and MAC address, recorded from wherever it runs now. +- The VM's current IPv4 address and MAC address, recorded from wherever it runs now. + Only the IPv4 address is preserved; a VM's IPv6 configuration is not carried over, because IPv6 is not supported on L2 networks. The prefix length comes from the VLAN's subnet in the `Network`, so you do not supply it here. - Confirmation that the address falls inside an `IPPool` on the target VLAN. $[prodname] assigns the address from a pool covering that VLAN, so an address outside every pool cannot be assigned. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-kubernetes.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-kubernetes.mdx index 99d3a95f36..9ccfbd9c67 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-kubernetes.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-kubernetes.mdx @@ -32,6 +32,7 @@ Upstream Forklift's guest conversion fails on clusters whose nodes carry the run - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx). - KubeVirt. - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx). + Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over. - Multus, for secondary-NIC attachments and for the auto-created `host` provider, whose connection test queries `NetworkAttachmentDefinition` and reports `ConnectionFailed` without that CRD. You need the thick DaemonSet v4.3.1 or later. v4.2.1 through v4.3.0 pass the wrong network config on delete, so Calico never releases the deleted pod's or VM's IP address ([multus-cni#1449](https://github.com/k8snetworkplumbingwg/multus-cni/issues/1449)). If you are upgrading from one of those, `calicoctl ipam check` finds the addresses already leaked. Pin the daemon container and the `install-multus-binary` init container to the same tag, and raise the daemon memory limit from 50Mi to 512Mi to stop it being OOM-killed. - cert-manager, which issues the serving certificates. Without it the `forklift-api`, `forklift-validation`, and `forklift-inventory` pods stay NotReady. OpenShift needs nothing here; its service-ca operator issues the same certificates. No `Issuer` or `ClusterIssuer` setup is needed: the operator creates its own in `konveyor-forklift`, which you can check with `kubectl -n konveyor-forklift get issuers,certificates`. diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx index 8e259efa8c..f7480bf11a 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/kubevirt/install-forklift-openshift.mdx @@ -28,6 +28,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available. - A StorageClass for the migrated VM disks. - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx). + Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over. ## How to diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/vm-identity.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/vm-identity.mdx index 37d5754a82..8df6771d1c 100644 --- a/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/vm-identity.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/l2-bridge/vm-identity.mdx @@ -29,7 +29,8 @@ The configuration is the same for a VM migrating with an address it already had - An L2 network already created and verified. See [Connect workloads to an existing VLAN](connect-vlan.mdx). - KubeVirt installed. -- The VM's current IP address and MAC address, recorded from wherever it runs now. +- The VM's current IPv4 address and MAC address, recorded from wherever it runs now. + Only the IPv4 address is preserved; a VM's IPv6 configuration is not carried over, because IPv6 is not supported on L2 networks. The prefix length comes from the VLAN's subnet in the `Network`, so you do not supply it here. - Confirmation that the address falls inside an `IPPool` on the target VLAN. $[prodname] assigns the address from a pool covering that VLAN, so an address outside every pool cannot be assigned.