I have an OKD cluster that is generally running well, but we are struggling with some OVN-Kubernetes features, especially EgressIP and EgressFirewall. We initially considered Cilium Enterprise because of its feature set, but the licensing cost is far beyond our budget, and we do not want to rely on the community edition because of concerns about update and support processes. What reasonably priced CNI options are compatible with OKD and provide comparable egress, network-policy, and traffic-management features?
4 Answers
OVN-Kubernetes is deeply integrated into OKD, so replacing only the CNI may not be the easiest path. It may make more sense to choose a Kubernetes distribution that supports the CNI you want from the start. RKE2, for example, is commonly used with Cilium. Talos is another option, although the best choice depends on your virtualization and management requirements.
I would not attempt an in-place CNI swap on a running OKD cluster. Build a separate test or replacement cluster with the intended networking stack, validate EgressIP, policy behavior, upgrades, storage, and ingress, then move applications over gradually. Also document the exact OVN-Kubernetes failures first; without that information, it is difficult to tell whether a new CNI would actually address the underlying issue.
Check whether newer OKD network-policy features, such as AdminNetworkPolicy, can cover the parts of EgressFirewall you actually use. If you still need a different CNI, Antrea is one open-source option to investigate and has an OpenShift-oriented operator, although compatibility and feature support should be verified against your exact OKD release. Calico is another possibility, but some advanced egress gateway and DNS-policy capabilities may require paid features, so it may not solve the cost problem.
Before migrating, I would investigate the specific EgressIP failures. Problems often come from missing egress-assignable node labels, addresses that are not valid for the node subnet, or upstream switches not learning the gratuitous ARP when an address moves. Newer OKD releases have also improved OVN-Kubernetes, so upgrading and checking the network configuration may solve more than expected. For some workloads that need direct access to a physical network, Multus with SR-IOV or a secondary bare-metal interface could be a better fit than replacing the cluster network entirely.
That is also worth comparing against the migration cost. Rebuilding on another distribution means relearning the platform, replacing OKD-specific integrations, moving workloads, and accepting some operational risk. It may still be the right decision, but the license cost and migration effort should be evaluated together.