<commit_before>// Module included in the following assemblies:
//
// * virt/virtual_machines/vm_networking/virt-attaching-vm-multiple-networks.adoc

[id="virt-creating-bridge-nad-cli_{context}"]
= Creating a Linux bridge network attachment definition in the CLI

As a network administrator, you can configure a network attachment definition of type `cnv-bridge` to provide Layer-2 networking to pods and virtual machines.

[NOTE]
====
The network attachment definition must be in the same namespace as the pod or virtual machine.
====

.Procedure

. Create a network attachment definition manifest.
The manifest must have the following contents, modified to match your configuration:
+
[source,yaml]
----
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: <a-bridge-network> <1>
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/<bridge-interface> <2>
spec:
  config: '{
    "cniVersion": "0.3.1",
    "name": "<a-bridge-network>", <3>
    "plugins": [
      {
        "type": "cnv-bridge", <4>
        "bridge": "<bridge-interface>", <5>
        "vlan": 1 <6>
      },
      {
        "type": "cnv-tuning" <7>
      }
    ]
  }'
----
<1> The name for the `NetworkAttachmentDefinition` object.
<2> Optional: Annotation key-value pair for node selection, where `bridge-interface` is the name of a bridge configured on some nodes. If you add this annotation to your network attachment definition, your virtual machine instances will only run on the nodes that have the `bridge-interface` bridge connected.
<3> The name for the configuration. It is recommended to match the configuration name to the `name` value of the network attachment definition.
<4> The actual name of the Container Network Interface (CNI) plug-in that provides the network for this network attachment definition. Do not change this field unless you want to use a different CNI.
<5> The name of the Linux bridge configured on the node.
<6> Optional: The VLAN tag.
<7> The CNI plug-in that allows the MAC pool manager to assign a unique MAC address to the connection.

. Create the network attachment definition: 
+
[source,terminal]
----
$ oc create -f <network-attachment-definition.yaml> <1>
----
<1> Where `<network-attachment-definition.yaml>` is the file name of the network attachment definition manifest.

.Verification

* Verify that the network attachment definition is created by running either `oc get network-attachment-definition <name>` or `oc get net-attach-def <name>`. For example:
+
[source,terminal]
----
$ oc get network-attachment-definition <a-bridge-network> <1>
----
<1> Where `<a-bridge-network>` is the name specified in the network attachment definition config.
<commit_msg>CNV-11198 Added info about MAC spoof check<commit_after>// Module included in the following assemblies:
//
// * virt/virtual_machines/vm_networking/virt-attaching-vm-multiple-networks.adoc

[id="virt-creating-bridge-nad-cli_{context}"]
= Creating a Linux bridge network attachment definition in the CLI

As a network administrator, you can configure a network attachment definition of type `cnv-bridge` to provide Layer-2 networking to pods and virtual machines.

.Prerequisites

* The network attachment definition must be in the same namespace as the pod or virtual machine.

* The node must support nftables and the `nft` binary must be deployed to enable MAC spoof check.

.Procedure

. Create a network attachment definition manifest.
The manifest must have the following contents, modified to match your configuration:
+
[source,yaml]
----
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: <a-bridge-network> <1>
  annotations:
    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/<bridge-interface> <2>
spec:
  config: '{
    "cniVersion": "0.3.1",
    "name": "<a-bridge-network>", <3>
    "plugins": [
      {
        "type": "cnv-bridge", <4>
        "bridge": "<bridge-interface>", <5>
        "macspoofchk": true, <6>
        "vlan": 1 <7>
      },
      {
        "type": "cnv-tuning" <8>
      }
    ]
  }'
----
<1> The name for the `NetworkAttachmentDefinition` object.
<2> Optional: Annotation key-value pair for node selection, where `bridge-interface` is the name of a bridge configured on some nodes. If you add this annotation to your network attachment definition, your virtual machine instances will only run on the nodes that have the `bridge-interface` bridge connected.
<3> The name for the configuration. It is recommended to match the configuration name to the `name` value of the network attachment definition.
<4> The actual name of the Container Network Interface (CNI) plug-in that provides the network for this network attachment definition. Do not change this field unless you want to use a different CNI.
<5> The name of the Linux bridge configured on the node.
<6> Optional: Flag to enable MAC spoof check. When set to `true`, you cannot change the MAC address of the pod or guest interface. This attribute provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.
<7> Optional: The VLAN tag.
<8> The CNI plug-in that allows the MAC pool manager to assign a unique MAC address to the connection.

. Create the network attachment definition:
+
[source,terminal]
----
$ oc create -f <network-attachment-definition.yaml> <1>
----
<1> Where `<network-attachment-definition.yaml>` is the file name of the network attachment definition manifest.

.Verification

* Verify that the network attachment definition is created by running either `oc get network-attachment-definition <name>` or `oc get net-attach-def <name>`. For example:
+
[source,terminal]
----
$ oc get network-attachment-definition <a-bridge-network> <1>
----
<1> Where `<a-bridge-network>` is the name specified in the network attachment definition config.
{'fraction_non_alphanumeric': 0.10008510638297873, 'fraction_numerical': 0.010382978723404256, 'mean_word_length': 3.9502948609941027, 'pattern_counts': {'":': 15, '<': 61, '<?xml version=': 0, '>': 61, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3212901', 'n_tokens_mistral': 1658, 'n_tokens_neox': 1617, 'n_words': 713}