ctauchen · Oct 30, 2026 · Oct 30, 2026
@@ -32,6 +32,7 @@ Upstream Forklift's guest conversion fails on clusters whose nodes carry the run
 - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx).
 - KubeVirt.
 - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx).
+  Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over.
 - Multus, for secondary-NIC attachments and for the auto-created `host` provider, whose connection test queries `NetworkAttachmentDefinition` and reports `ConnectionFailed` without that CRD. You need the thick DaemonSet v4.3.1 or later. v4.2.1 through v4.3.0 pass the wrong network config on delete, so Calico never releases the deleted pod's or VM's IP address ([multus-cni#1449](https://github.com/k8snetworkplumbingwg/multus-cni/issues/1449)). If you are upgrading from one of those, `calicoctl ipam check` finds the addresses already leaked. Pin the daemon container and the `install-multus-binary` init container to the same tag, and raise the daemon memory limit from 50Mi to 512Mi to stop it being OOM-killed.
 - cert-manager, which issues the serving certificates. Without it the `forklift-api`, `forklift-validation`, and `forklift-inventory` pods stay NotReady. OpenShift needs nothing here; its service-ca operator issues the same certificates. No `Issuer` or `ClusterIssuer` setup is needed: the operator creates its own in `konveyor-forklift`, which you can check with `kubectl -n konveyor-forklift get issuers,certificates`.
 

@@ -28,6 +28,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a
 - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available.
 - A StorageClass for the migrated VM disks.
 - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx).
+  Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over.
 
 ## How to
 

@@ -97,6 +97,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources using

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter:

@@ -29,7 +29,8 @@ The configuration is the same for a VM migrating with an address it already had
 - An L2 network already created and verified.
   See [Connect workloads to an existing VLAN](connect-vlan.mdx).
 - KubeVirt installed.
-- The VM's current IP address and MAC address, recorded from wherever it runs now.
+- The VM's current IPv4 address and MAC address, recorded from wherever it runs now.
+  Only the IPv4 address is preserved; a VM's IPv6 configuration is not carried over, because IPv6 is not supported on L2 networks.
   The prefix length comes from the VLAN's subnet in the `Network`, so you do not supply it here.
 - Confirmation that the address falls inside an `IPPool` on the target VLAN.
   $[prodname] assigns the address from a pool covering that VLAN, so an address outside every pool cannot be assigned.

@@ -86,6 +86,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources using

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter:

@@ -86,6 +86,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources using

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter:

@@ -32,6 +32,7 @@ Upstream Forklift's guest conversion fails on clusters whose nodes carry the run
 - The BPF data plane enabled: `bpfEnabled: true` in the default `FelixConfiguration`. See [Enable eBPF on an existing cluster](../../operations/ebpf/enabling-ebpf.mdx).
 - KubeVirt.
 - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx).
+  Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over.
 - Multus, for secondary-NIC attachments and for the auto-created `host` provider, whose connection test queries `NetworkAttachmentDefinition` and reports `ConnectionFailed` without that CRD. You need the thick DaemonSet v4.3.1 or later. v4.2.1 through v4.3.0 pass the wrong network config on delete, so Calico never releases the deleted pod's or VM's IP address ([multus-cni#1449](https://github.com/k8snetworkplumbingwg/multus-cni/issues/1449)). If you are upgrading from one of those, `calicoctl ipam check` finds the addresses already leaked. Pin the daemon container and the `install-multus-binary` init container to the same tag, and raise the daemon memory limit from 50Mi to 512Mi to stop it being OOM-killed.
 - cert-manager, which issues the serving certificates. Without it the `forklift-api`, `forklift-validation`, and `forklift-inventory` pods stay NotReady. OpenShift needs nothing here; its service-ca operator issues the same certificates. No `Issuer` or `ClusterIssuer` setup is needed: the operator creates its own in `konveyor-forklift`, which you can check with `kubectl -n konveyor-forklift get issuers,certificates`.
 

@@ -28,6 +28,7 @@ Install the Tigera fork of Forklift on an OpenShift cluster and connect it to a
 - OpenShift Virtualization (KubeVirt and CDI) installed, with `HyperConverged` Available.
 - A StorageClass for the migrated VM disks.
 - IP pools covering the VM addresses. The pod network uses an ordinary pool; each L2 VLAN needs its own pool with `allowedUses: [L2Workload]` and `disableBGPExport: true`. A VM keeps its address only if that address falls inside a pool. See [Connect workloads to an existing VLAN](../l2-bridge/connect-vlan.mdx).
+  Only IPv4 addresses are preserved; a source VM's IPv6 configuration is not carried over.
 
 ## How to
 

@@ -97,6 +97,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources using

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter:

@@ -29,7 +29,8 @@ The configuration is the same for a VM migrating with an address it already had
 - An L2 network already created and verified.
   See [Connect workloads to an existing VLAN](connect-vlan.mdx).
 - KubeVirt installed.
-- The VM's current IP address and MAC address, recorded from wherever it runs now.
+- The VM's current IPv4 address and MAC address, recorded from wherever it runs now.
+  Only the IPv4 address is preserved; a VM's IPv6 configuration is not carried over, because IPv6 is not supported on L2 networks.
   The prefix length comes from the VLAN's subnet in the `Network`, so you do not supply it here.
 - Confirmation that the address falls inside an `IPPool` on the target VLAN.
   $[prodname] assigns the address from a pool covering that VLAN, so an address outside every pool cannot be assigned.

@@ -75,6 +75,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources, either by installing the $[prodname]

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter:

@@ -75,6 +75,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources, either by installing the $[prodname]

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter:

@@ -75,6 +75,8 @@ policy is in place on the destination, or until the timeout expires.
 
 ## Before you begin
 
+- IPv4 addressing for the VMs.
+  Live migration requires KubeVirt's bridge binding, which does not pass IPv6 to the VM, so live-migrating VMs are IPv4 only.
 - A working Kubernetes cluster with KubeVirt installed.
 - $[prodname] installed with BGP networking without overlay.
 - Access to `projectcalico.org/v3` resources, either by installing the $[prodname]

@@ -133,20 +133,6 @@ spec:
       operations:
         - setPriority:
             value: 512
-  exportV6:
-    - action: Accept
-      peerType: eBGP
-      priority: 512
-      operations:
-        - addCommunity:
-            value: "65000:100"
-  importV6:
-    - action: Accept
-      communities:
-        values: ["65000:100"]
-      operations:
-        - setPriority:
-            value: 512
 ```
 
 Key fields used in this filter: