add docs for u2oInterconnection subnet isolate

[changluyi]

Summary by CodeRabbit

• Documentation
  • New guide: "Isolation Between Underlay Subnets with u2oInterconnection Enabled" — adds a two-step configuration workflow for controller and subnet settings, explains node network CIDR must be included in allowed subnets, clarifies private mode restricts inbound (not outbound) traffic, warns about conntrack/ACL behavior, details expected routing via the internal OVN network, and includes example configuration snippets and cautions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0c60e91 and 80b49cf.

📒 Files selected for processing (1)

• docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx

---

Walkthrough

Adds documentation on isolating Underlay subnets when u2oInterconnection: true, explaining that traffic is routed via the internal OVN network and providing a two-step workflow (controller arg update and subnet spec changes) plus cautions about conntrack/ACL behavior and node CIDR inclusion.

Changes

Cohort / File(s)	Summary
Kube-OVN Subnet Isolation Documentation docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx	Adds "Isolation Between Underlay Subnets with u2oInterconnection Enabled" section describing OVN-internal routing, two-step setup (set controller arg --ls-ct-skip-dst-lport-ips=false; configure subnet spec.u2oInterconnection: true, private: true, and allowSubnets including node CIDR), with YAML examples and cautions about conntrack/ACL and inbound vs outbound behavior.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

• fanzy618

Poem

🐰 I nibble docs and hop through lines so neat,
Two steps to bind subnets where underlays meet.
Include the node CIDR, mind conntrack's gate,
Private keeps inbound tidy — outbound's your fate.
A rabbit's small guide, hopped in rhyme and sprite. 🌿

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding documentation for u2oInterconnection subnet isolation, which matches the file addition and content summary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx`:
- Around line 59-70: Add explicit application instructions before the presented
spec YAML: tell the user to run a kubectl edit subnet <subnet-name> (or kubectl
patch subnet <subnet-name> --type=merge -p ...) to add/modify the spec fields
u2oInterconnection, private and allowSubnets, and also mention the alternative
of applying the same changes via the Kube-OVN UI subnet edit workflow; ensure
the text says "Add or modify the following fields under spec:" immediately
before the YAML so users know how to apply the config.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9cba494 and e24b4e3.

📒 Files selected for processing (1)

• docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Step 2 is missing instructions on how to apply the subnet configuration.

Step 1 provides an explicit kubectl edit command, but Step 2 only presents a bare spec: YAML fragment with no guidance on how to apply it — no kubectl edit subnet <name>, no kubectl patch, and no reference to the existing UI workflow from the Procedure section above. Users unfamiliar with Kube-OVN will not know how to apply this config.

✏️ Suggested addition before the YAML block

 Configure the subnet with the following parameters:
 
+```bash
+kubectl edit subnet <subnet-name>
+```
+
+Add or modify the following fields under `spec`:
+
 ```yaml
 spec:
   u2oInterconnection: true

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/en/configure/networking/how_to/kube_ovn/underlay_overlay_st.mdx` around
lines 59 - 70, Add explicit application instructions before the presented spec
YAML: tell the user to run a kubectl edit subnet <subnet-name> (or kubectl patch
subnet <subnet-name> --type=merge -p ...) to add/modify the spec fields
u2oInterconnection, private and allowSubnets, and also mention the alternative
of applying the same changes via the Kube-OVN UI subnet edit workflow; ensure
the text says "Add or modify the following fields under spec:" immediately
before the YAML so users know how to apply the config.