// Module included in the following assemblies:
//
// * virt/vm_networking/virt-networking-overview.adoc

:_mod-docs-content-type: REFERENCE
[id="virt-nw-overview-manage-overlay-nw_{context}"]                                
= Manage overlay networks

[role="_abstract"]
To ensure your virtual machines (VMs) connect reliably by using the standard {product-title} networking model, configure the default pod network for cluster-wide connectivity. 

Overlay networks provide a flexible, software-defined layer of connectivity on top of a physical network, enabling services like network segmentation, custom routing, and simplified management without altering the underlying hardware.


Connect a VM to the default pod network:: Each VM is connected by default to the default internal pod network. You can add or remove network interfaces by editing the VM specification.
+
You can access a virtual machine (VM) that is connected to the default internal pod network on a stable fully qualified domain name (FQDN) by using headless services.

Connect a VM to a custom primary overlay network:: Configure a primary user-defined network (UDN) that supports multi-namespace connectivity to provide isolated and flexible traffic paths for your workloads.
+
Cluster administrators can configure a primary `UserDefinedNetwork` CRD to create a tenant network that isolates the tenant namespace from other namespaces without requiring network policies. Additionally, cluster administrators can use the `ClusterUserDefinedNetwork` CRD to create a shared OVN layer 2 network across multiple namespaces.
+
User-defined networks with the layer 2 overlay topology are useful for VM workloads, and a good alternative to secondary networks in environments where physical network access is limited, such as the public cloud. The layer 2 topology enables seamless migration of VMs without the need for Network Address Translation (NAT), and also provides persistent IP addresses that are preserved between reboots and during live migration.

Connect a VM to a custom secondary overlay network:: Configure a secondary UDN with layer 2 topology to create a private isolated communication channel between a group of VMs across different nodes. A layer 2 topology connects workloads by a cluster-wide logical switch. The OVN-Kubernetes CNI plugin uses the Geneve (Generic Network Virtualization Encapsulation) protocol to create an overlay network between nodes. You can use this overlay network to connect VMs on different nodes, without having to configure any additional physical networking infrastructure.

ifndef::openshift-rosa,openshift-dedicated,openshift-rosa-hcp[]
Configure external ingress by exposing a VM as a service:: You can expose a VM within the cluster or outside the cluster by creating a `Service` object. For on-premise clusters, you can configure a load balancing service by using the MetalLB Operator. You can install the MetalLB Operator by using the {product-title} web console or the CLI.
endif::openshift-rosa,openshift-dedicated,openshift-rosa-hcp[]

ifdef::openshift-rosa,openshift-dedicated,openshift-rosa-hcp[]
Configure external ingress by exposing a VM as a service:: You can expose a VM within the cluster or outside the cluster by creating a `Service` object.
endif::openshift-rosa,openshift-dedicated,openshift-rosa-hcp[]

Add a VM to a {SMProductShortName}:: {VirtProductName} is integrated with {SMProductName}. You can monitor, visualize, and control traffic between pods and virtual machines on the default pod network with IPv4.