OSDOCS-14170: Created doc for enabled port isolation Linux bridge CNI CNV

Author: dfitzmau

modules/virt-linux-bridge-nad-port-isolation.adoc

@@ -0,0 +1,57 @@
+// Module included in the following assemblies:
+//
+// * virt/vm_networking/virt-connecting-vm-to-linux-bridge.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="virt-linux-bridge-nad-port-isolation.adoc_{context}"]
+= Enabling port isolation for a Linux bridge NAD
+
+You can enable port isolation for a Linux bridge network attachment definition (NAD) so that virtual machines (VMs) that run on the same virtual LAN (VLAN) can operate in isolation from one another. When you assign an IP address to the virtual bridge, the virtual bridge can act as a gateway. The Linux bridge NAD creates a virtual bridge, or _virtual switch_, between network interfaces and the physical network. The Linux bridge NAD configures port numbers on the virtual bridge so that only specific traffic can reach each port. 
+
+
+Isolating ports in this way can provide enhanced security, efficient resource use, and performance improvements for VM workloads that run on the same node. 
+
+Before you enable port isolation, you must disable hairpin traffic from reaching the isolated ports.
+
+.Prerequisites
+
+* You created Linux bridge NAD by using either the web console or the command-line interface. 
+
+.Procedure
+
+. Edit the Linux bridge NAD by setting `portIsolation` to `true`:
++
+[source,yaml]
+----
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: bridge-network 
+  annotations:
+    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1 
+spec:
+  config: |
+    {
+      "cniVersion": "0.3.1",
+      "name": "bridge-network", <1>
+      "type": "bridge", <2>
+      "bridge": "br1", <3>
+      "hairpinMode": "true", <4>
+      "portIsolation": "true" <5>
+    }
+# ...
+----
+<1> The name for the configuration. The name must match the the value in the `metadata.name` of the NAD.
+<2> The actual name of the Container Network Interface (CNI) plugin that provides the network for this network attachment definition. Do not change this field unless you want to use a different CNI.
+<3> The name of the Linux bridge that is configured on the node. The name should match the interface bridge name defined in the NodeNetworkConfigurationPolicy manifest.
+<4> Defaults to `false`. When set to `true`, network interfaces that interact with the virtual bridges 
+<5> Enables or disables port isolation on the virtual bridge. Default value is `false`. When set to `true`, each targeted VM is assigned to a specific port number. The virtual bridge prevents traffic from one isolated port from reaching another isolated port.
+
+. Apply the configuration:
++
+[source,terminal]
+----
+$ oc apply -f example-vm.yaml
+----
+
+. Optional: If you edited a running virtual machine, you must restart it for the changes to take effect.

virt/vm_networking/virt-connecting-vm-to-linux-bridge.adoc

@@ -26,10 +26,15 @@ include::modules/virt-creating-linux-bridge-nncp.adoc[leveloffset=+1]
 
 You can create a Linux bridge network attachment definition (NAD) by using the {product-title} web console or command line.
 
+// Creating a Linux bridge NAD by using the web console
 include::modules/virt-creating-linux-bridge-nad-web.adoc[leveloffset=+2]
 
+// Creating a Linux bridge NAD by using the command line
 include::modules/virt-creating-linux-bridge-nad-cli.adoc[leveloffset=+2]
 
+// Enabling port isolation for a Linux bridge NAD
+include::modules/virt-linux-bridge-nad-port-isolation.adoc[leveloffset=+2]
+
 [id="configuring-vm-network-interface"]
 == Configuring a VM network interface