// Module included in the following assemblies:
//
// * virt/vm_networking/virt-connecting-vm-to-primary-udn.adoc

:_mod-docs-content-type: PROCEDURE
[id="virt-creating-a-primary-udn_{context}"]
= Creating a primary namespace-scoped user-defined network by using the CLI

[role="_abstract"]
You can create an isolated primary network in your project namespace by using the CLI. You must use the OVN-Kubernetes layer 2 topology and enable persistent IP address allocation in the user-defined network (UDN) configuration to ensure VM live migration support.

.Prerequisites

* You have installed the {oc-first}.
* You have created a namespace and applied the `k8s.ovn.org/primary-user-defined-network` label.

.Procedure

. Create a `UserDefinedNetwork` object to specify the custom network configuration.
+
Example `UserDefinedNetwork` manifest:
+
[source,yaml]
----
apiVersion: k8s.ovn.org/v1
kind: UserDefinedNetwork
metadata:
  name: udn-l2-net
  namespace: my-namespace
spec:
  topology: Layer2
  layer2:
    role: Primary
    subnets:
      - "10.0.0.0/24"
      - "2001:db8::/60"
    ipam:
      lifecycle: Persistent
----
** `metadata.name` specifies the name of the `UserDefinedNetwork` custom resource.
** `metadata.namespace` specifies the namespace in which the VM is located. The namespace must have the `k8s.ovn.org/primary-user-defined-network` label. The namespace must not be `default`, an `openshift-*` namespace, or match any global namespaces that are defined by the Cluster Network Operator (CNO).
** `spec.topology` specifies the topological configuration of the network. The required value is `Layer2`. A `Layer2` topology creates a logical switch that is shared by all nodes.
** `spec.layer2.role` specifies whether the UDN is primary or secondary. The `Primary` role means that the UDN acts as the primary network for the VM and all default traffic passes through this network.
** `spec.layer2.ipam.lifecycle` specifies that virtual workloads have consistent IP addresses across reboots and migration. The `spec.layer2.subnets` field is required when `ipam.lifecycle: Persistent` is specified.

. Apply the `UserDefinedNetwork` manifest by running the following command:
+
[source,terminal]
----
$ oc apply -f --validate=true <filename>.yaml
----
