From 59edc61b422fada5dd812dfed9c6f8fc6000fe5f Mon Sep 17 00:00:00 2001
From: Ashleigh Brennan <abrennan@redhat.com>
Date: Fri, 17 Jul 2026 12:10:01 -0500
Subject: [PATCH] CNV-87842: Update docs for disableContainerInterface

---
 .../virt-creating-linux-bridge-nad-cli.adoc   | 31 ++++++++++++++++---
 .../virt-creating-linux-bridge-nad-web.adoc   | 23 +++++++++++++-
 2 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/modules/virt-creating-linux-bridge-nad-cli.adoc b/modules/virt-creating-linux-bridge-nad-cli.adoc
index f1fa59ab4b2..13fdcd4fd1b 100644
--- a/modules/virt-creating-linux-bridge-nad-cli.adoc
+++ b/modules/virt-creating-linux-bridge-nad-cli.adoc
@@ -12,7 +12,7 @@ The NAD and the VM must be in the same namespace.
 
 [WARNING]
 ====
-Configuring IP address management (IPAM) in a network attachment definition for virtual machines is not supported.
+Configuring IP address management (IPAM) in a network attachment definition for VMs is not supported.
 ====
 
 .Prerequisites
@@ -40,8 +40,8 @@ spec:
       "bridge": "br1", <5>
       "macspoofchk": false, <6>
       "vlan": 100, <7>
-      "disableContainerInterface": true,
-      "preserveDefaultVlan": false <8>
+      "disableContainerInterface": true, <8>
+      "preserveDefaultVlan": false <9>
     }
 ----
 <1> The name for the `NetworkAttachmentDefinition` object.
@@ -51,13 +51,36 @@ spec:
 <5> The name of the Linux bridge configured on the node. The name should match the interface bridge name defined in the `NodeNetworkConfigurationPolicy` manifest.
 <6> Optional: A flag to enable the MAC spoof check. When set to `true`, you cannot change the MAC address of the pod or guest interface. This attribute allows only a single MAC address to exit the pod, which provides security against a MAC spoofing attack.
 <7> Optional: The VLAN tag. No additional VLAN configuration is required on the node network configuration policy.
-<8> Optional: Indicates whether the VM connects to the bridge through the default VLAN. The default value is `true`.
+<8> Optional: When set to `true`, the Bridge CNI plug-in skips creating a standard container virtual ethernet (`veth`) interface inside the pod's network namespace. This enables the virtualization networking backend to attach the layer-2 interface directly to the guest VM instead of a standard container.
+<9> Optional: Indicates whether the VM connects to the bridge through the default VLAN. The default value is `true`.
 +
 [NOTE]
 ====
 A Linux bridge network attachment definition is the most efficient method for connecting a virtual machine to a VLAN.
 ====
 
+. Optional: If you want to connect a VM to the native network, configure the Linux bridge `NetworkAttachmentDefinition` manifest without specifying any VLAN:
++
+[source,yaml]
+----
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: bridge-network
+  annotations:
+    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
+spec:
+  config: |
+    {
+      "cniVersion": "0.3.1",
+      "name": "bridge-network",
+      "type": "bridge",
+      "bridge": "br1",
+      "macspoofchk": false,
+      "disableContainerInterface": true
+    }
+----
+
 . Create the network attachment definition:
 +
 [source,terminal]
diff --git a/modules/virt-creating-linux-bridge-nad-web.adoc b/modules/virt-creating-linux-bridge-nad-web.adoc
index 1c1fb2fe49e..82bfbbe31cb 100644
--- a/modules/virt-creating-linux-bridge-nad-web.adoc
+++ b/modules/virt-creating-linux-bridge-nad-web.adoc
@@ -32,4 +32,25 @@ The network attachment definition must be in the same namespace as the pod or vi
 . Enter the name of the bridge in the *Bridge Name* field.
 . Optional: If the resource has VLAN IDs configured, enter the ID numbers in the *VLAN Tag Number* field.
 . Optional: Select *MAC Spoof Check* to enable MAC spoof filtering. This feature provides security against a MAC spoofing attack by allowing only a single MAC address to exit the pod.
-. Click *Create*.
\ No newline at end of file
+. Optional: In the *YAML* tab, add the `spec.config.disableContainerInterface` field. When set to `true`, the Bridge CNI plug-in skips creating a standard container virtual ethernet (`veth`) interface inside the pod's network namespace. This enables the virtualization networking backend to attach the layer-2 interface directly to the guest VM instead of a standard container.
++
+Example YAML:
++
+[source,yaml]
+----
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: bridge-network
+  annotations:
+    k8s.v1.cni.cncf.io/resourceName: bridge.network.kubevirt.io/br1
+spec:
+  config: |
+    {
+# ...
+      "disableContainerInterface": true,
+# ...
+    }
+----
+
+. Click *Create*.