OSDOCS-14170: Created doc for enabled port isolation Linux bridge CNI CNV

Author: dfitzmau

modules/virt-linux-bridge-nad-port-isolation.adoc

@@ -0,0 +1,85 @@
+// Module included in the following assemblies:
+//
+// * virt/vm_networking/virt-connecting-vm-to-linux-bridge.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="virt-linux-bridge-nad-port-isolation.adoc_{context}"]
+= Enabling port isolation for a Linux bridge NAD
+
+You can enable port isolation for a Linux bridge network attachment definition (NAD) so that virtual machines (VMs) that run on the same virtual LAN (VLAN) can operate in isolation from one another. The Linux bridge NAD creates a virtual bridge, or _virtual switch_, between network interfaces and the physical network. The Linux bridge NAD configures port numbers on the virtual bridge so that only specific traffic can reach each port. Isolating ports in this way can provide enhanced security, efficient resource use, and performance improvements for VM workloads that run on the same node. 
+
+Before you enable port isolation, you must disable hairpin traffic from reaching the isolated ports.
+
+.Prerequisites
+
+* You created Linux bridge NAD by using either the web console or the command-line interface. 
+
+.Procedure
+
+. Edit the Linux bridge NAD by setting `portIsolation` to `true`:
++
+[source,yaml]
+----
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: bridge-network 
+  annotations:
+    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1 
+spec:
+  config: |
+    {
+      "cniVersion": "0.3.1",
+      "name": "bridge-network", <1>
+      "type": "bridge", <2>
+      "bridge": "br1", <3>
+      "portIsolation": "true" <4>
+    }
+# ...
+----
+<1> The name for the configuration. The name must match the the value in the `metadata.name` of the NAD.
+<2> The actual name of the Container Network Interface (CNI) plugin that provides the network for this network attachment definition. Do not change this field unless you want to use a different CNI.
+<3> The name of the Linux bridge that is configured on the node. The name should match the interface bridge name defined in the NodeNetworkConfigurationPolicy manifest.
+<4> Enables or disables port isolation on the virtual bridge. Default value is `false`. When set to `true`, each targeted VM is assigned to a specific port number. The virtual bridge prevents traffic from one isolated port from reaching another port.
+
+
+
+
+
+
+
+
+. Add the bridge interface and the network attachment definition to the VM configuration as in the following example:
++
+[source,yaml]
+----
+apiVersion: kubevirt.io/v1
+kind: VirtualMachine
+metadata:
+  name: example-vm
+spec:
+  template:
+    spec:
+      domain:
+        devices:
+          interfaces:
+            - bridge: {}
+              name: bridge-net <1>
+# ...
+      networks:
+        - name: bridge-net <2>
+          multus:
+            networkName: a-bridge-network <3>
+----
+<1> The name of the bridge interface.
+<2> The name of the network. This value must match the `name` value of the corresponding `spec.template.spec.domain.devices.interfaces` entry.
+<3> The name of the network attachment definition.
+
+. Apply the configuration:
++
+[source,terminal]
+----
+$ oc apply -f example-vm.yaml
+----
+
+. Optional: If you edited a running virtual machine, you must restart it for the changes to take effect.

virt/vm_networking/virt-connecting-vm-to-linux-bridge.adoc

@@ -26,10 +26,15 @@ include::modules/virt-creating-linux-bridge-nncp.adoc[leveloffset=+1]
 
 You can create a Linux bridge network attachment definition (NAD) by using the {product-title} web console or command line.
 
+// Creating a Linux bridge NAD by using the web console
 include::modules/virt-creating-linux-bridge-nad-web.adoc[leveloffset=+2]
 
+// Creating a Linux bridge NAD by using the command line
 include::modules/virt-creating-linux-bridge-nad-cli.adoc[leveloffset=+2]
 
+// Enabling port isolation for a Linux bridge NAD
+include::modules/virt-linux-bridge-nad-port-isolation.adoc[leveloffset=+2]
+
 [id="configuring-vm-network-interface"]
 == Configuring a VM network interface