Release v1.9.0

2023 May 09

NSM v1.9.0

NSM v1.9.0 has been successfully integration tested with Kubernetes versions:

  • v1.27.1
  • v1.26.3
  • v1.25.8
  • v1.24.6
  • v1.23.12
  • v1.22.13
  • v1.21.14
  • v1.20.15

NSM v1.9.0 has been tested on:

Added AF_XDP support

Now cmd-forwarder-vpp able to use AF_PACKET to bind to an existing node interface using LinkToAfPacket

AF_XDP is faster than AF_PACKET, but AF_XDP is only usable for our purposes from kernel version 5.4 onward. The good news is that lots of places have kernel versions that are new (including the more recent version of Docker Desktop).

See more details at

Make SRIOV VFs to push/pop tags like vlan or vxlan

Now forwarder vpp is able to program the PF (physical interface) so that the VF (virtual interface) push/pops the correct vlan or vxlan tags. It is working whether or not the mechanism the VF is using is kernel or vfio. VLAN tag is not pushed by software in the kernel, we are programming the PF so that the particular VF is having its vlan tag push/popped in hardware by the NIC.

See more details at

Floating interdomain/ Interdomain NSE composition example

Created an interdomain version of the NSE Composition example. The difference with the single cluster example is that the first half of NSEs are running on the first cluster, and the second half are running on the second cluster.

See more details in

Added support for DNS PTR records

A pointer (PTR) record resolves an IP address (made up of numbers and decimals) into a domain name (such as

The act of translating an IP address into a domain name is known as a “reverse lookup” in the Domain Name System (DNS).

Now it is supported in vl3 DNS.

See more details in

Interdomain DNS examples

We considered and tested the next scenarios:

  1. Interdomain DNS NSE has coredns sidecar. NSC should be able to resolve the DNS address specified in the NSE coredns config. Look at

  2. Floating interdomain DNS The same as Interdomain DNS, but NSE is registered in the floating registry

  3. Floating interdomain VL3 DNS Look at - Look at - NSC should be able to reach other NSCs using vl3 DNS.

And finally we get next new examples:




Get rid of cloudtest in the interdomain repository

We no longer use cloudtest tool in interdomain testing. From this moment on, we’re using cloud provider commands directly in the integraiton-interdomain-k8s repository.

It makes our CI more simple and allows folks to simply reproduce our interdomain scenario on public clusters.

Spire update

Updated spire dependency since:

  1. k8s-workload-registrar has been deprecated and removed in the SPIRE 1.6 release, and SPIRE Controller Manager is included instead.

  2. SPIRE Community is no longer releasing GCR images in favor of scratch images on GHCR, thus the official image path changed to that.

See more details in

Improve UX of examples

Improved and simplified examples with next changes:

  1. Namespaced from examples moved to kustomization files.
  2. Fixed refs: use relative paths in kustomization files
  3. Fixed refs: use refs to kustomization files where we used kubeclt apply -f .
  4. Avoided creating temporary files for configs. For example, usekubectl apply -f - <<EOF instead of
  5. Avoided using environment variables for kubeconfig. Fixed for use --kubeconfig=$KUBECONFIG1 instead of export KUBECONFIG=$KUBECONFIG1
  6. Avoided using environment variables for kubectl exec. Instead of:
NSC=$(kubectl get pods -l app=alpine -n ns-kernel2kernel --template '{{range .items}}{{}}{{"\n"}}{{end}}')
kubectl exec ${NSC} -n ns-kernel2kernel -- ping -c 4

We can use

kubectl exec pods/alpine -n ns-kernel2kernel -- ping -c 4

6.Replaced using bases with resources in kustomization files. Bases is deprecated

See more details in

Improve system stability

Resolved issues: