Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Cloud-Native Contrail Networking Overview

SUMMARY Learn about Cloud-Native Contrail Networking (CN2).


This section is intended to provide a brief overview of the Juniper Networks Cloud-Native Contrail Networking solution and might contain a description of features not supported in the Kubernetes distribution that you're using. See the Cloud-Native Contrail Networking Release Notes for information on features in the current release for your distribution.

Unless otherwise indicated, all references to Kubernetes in this Overview section are made generically and are not intended to single out a particular distribution.

In release 23.3, Cloud-Native Contrail Networking is supported on the following:

Contrail Networking is an SDN solution that automates the creation and management of virtualized networks to connect, isolate, and secure cloud workloads and services seamlessly across private and public clouds.

Cloud-Native Contrail Networking (CN2) brings this rich SDN feature set natively to Kubernetes as a networking platform and container network interface (CNI) plug-in.

Redesigned for cloud-native architectures, CN2 takes advantage of the benefits that Kubernetes offers, from simplified DevOps to turnkey scalability, all built on a highly available platform. These benefits include leveraging standard Kubernetes tools and practices to manage Contrail throughout its life cycle:

  • Manage CN2 using standard Kubernetes and third-party tools.
  • Scale CN2 by adding or removing nodes.
  • Configure CN2 by using custom resource definitions (CRDs).
  • Upgrade CN2 software by applying updated manifests.
  • Uninstall CN2 by deleting Contrail namespaces and resources (where supported).

More than a CNI plug-in, CN2 is a networking platform that provides dynamic end-to-end virtual networking and security for cloud-native containerized and virtual machine (VM) workloads, across multi-cluster compute and storage environments, all from a central point of control. It supports hard multi-tenancy for single or multi-cluster environments shared across many tenants, teams, applications, or engineering phases, scaling to thousands of nodes.

The CN2 implementation consists of a set of Contrail controllers that reside on either Kubernetes control plane nodes or worker nodes depending on distribution. The Contrail controllers manage a distributed set of data planes implemented by a CNI plug-in and vRouter on every node. Integrating a full-fledged vRouter alongside the workloads provides CN2 the flexibility to support a wide range of networking requirements, from small single clusters to multi-cluster deployments, including:

  • Full overlay networking including load balancing, security and multi-tenancy, elastic and resilient VPNs, and gateway services in single-cluster and multi-cluster deployments
  • Highly available and resilient network controller overseeing all aspects of the network configuration and control planes
  • Analytics services using telemetry and industry standard monitoring and presentation tools such as Prometheus and Grafana
  • Support for both CRI-O and containerd runtimes
  • Support for container and VM workloads (using kubevirt)
  • Support for DPDK data plane acceleration

The Contrail controller automatically detects workload provisioning events such as a new workload being instantiated, network provisioning events such as a new virtual network being created, routing updates from internal and external sources, and unexpected network events such as link and node failures. The Contrail controller reports and logs these events where appropriate and reconfigures the vRouter data plane as necessary.

Although any single node can contain only one Contrail controller, a typical deployment contains multiple controllers running on multiple nodes. When there are multiple Contrail controllers, the controllers keep in synchronization by using iBGP to exchange routes. If a Contrail controller goes down, the Contrail controllers on the other nodes retain all database information and continue to provide the network control plane uninterrupted.

On the worker nodes where workloads reside, each vRouter establishes communications with two Contrail controllers, such that the vRouter can continue to receive instruction if any one controller goes down.

By natively supporting Kubernetes, the CN2 solution leverages the simplicity, flexibility, scalability, and availability inherent to the Kubernetes architecture, while supporting a rich SDN feature set that can meet the requirements of enterprises and service providers alike. Enterprises and service providers can now manage Contrail using simplified and familiar DevOps tools and processes without needing to learn a new life cycle management (LCM) paradigm.

Benefits of Cloud-Native Contrail Networking

  • Support a rich networking feature set for your overlay networks.
  • Deploy a highly scalable and highly available SDN solution on both upstream and commercial Kubernetes distributions.
  • Manage CN2 using familiar, industry-standard tools and practices.
  • Optionally, use the CN2 Web UI to configure and monitor your network.
  • Leverage the skill set of your existing DevOps engineers to quickly get CN2 up and running.
  • Combine with Juniper Networks fabric devices and fabric management solutions or use your own fabric or third-party cloud networks.