Can't create pod with join subnet about kube-ovn

[oilbeater]

Join is a dedicated subnet for Nodes exclusively, and it should not be utilized by Pods. The main purpose of maintaining a port-group for each subnet on each node is that when networkpolicies are applied we need to make sure that kubelet can access Pods within the same Node, so that the readiness/liveness probe can work.

[Longchuanzheng]

I believe we need to consider two aspects. Firstly, should we permit users to create pods with joined subnets? We may consider adding a webhook or similar mechanism to prevent this. If we determine that allowing pods to join subnets is acceptable, we can then proceed to address this bug.

[Longchuanzheng]

The issue occure because kube-ovn didn't create a port_group named as subnet.name/node.name (join.euler.x86.80) for join subnet.
Can someone explain the process of creating a port_group for a subnet, why we need to create port_group for subnet?

[Longchuanzheng]

You can assign this issue to me.

[oilbeater]

And I am curious why you need a Pod in the join subnet?

[Longchuanzheng]

And I am curious why you need a Pod in the join subnet?

I just want to make a simple test which need to create a pod. I remember I could do this with previous kube-ovn version(maybe I has misremembered).