ovn-ic-sb man page

Name

ovn-ic-sb — OVN_IC_Southbound database schema

This database holds configuration and state for interconnecting different OVN deployments. The content of the database is populated and used by the ovn-ic program in each OVN deployment, and not supposed to be directly used by CMS or end user.

The OVN Interconnection Southbound database is shared by ovn-ic program in each OVN deployment. It contains interconnection information from all related OVN deployments, and is used as the intermediate store for each OVN deployment to exchange the information. The ovn-ic program in each deployment is responsible for syncing the data between this database and the its own northbound and southbound databases.

Database Structure

The OVN Interconnection Southbound database contains classes of data with different properties, as described in the sections below.

Availability Zone Specific Information

These tables contain objects that are availability zone specific. Each object is owned and populated by one availability zone, and read by other availability zones.

The Availability_Zone, Gateway, Encap and Port_Binding tables are the availability zone specific tables.

Global Information

The data that does not belong to any specific availability zone but is common for all availability zones.

The Datapath_Binding table contains the common datapath binding information.

Common Columns

Each of the tables in this database contains a special column, named external_ids. This column has the same form and purpose each place it appears.

external_ids: map of string-string pairs

Key-value pairs for use by ovn-ic.

Table Summary

The following list summarizes the purpose of each of the tables in the OVN_IC_Southbound database.  Each table is described in more detail on a later page.

Table

Purpose

IC_SB_Global

IC Southbound configuration

Availability_Zone

Availability Zone Information

Gateway

Interconnection Gateway Information

Encap

Encapsulation Types

Datapath_Binding

Transit Switch Datapath Bindings

Port_Binding

Transit Port Bindings

Route

Route

Connection

OVSDB client connections.

SSL

SSL configuration.

Table Relationships

The following diagram shows the relationship among tables in the database.  Each node represents a table.  Tables that are part of the “root set” are shown with double borders.  Each edge leads from the table that contains it and points to the table that its value represents.  Edges are labeled with their column names, followed by a constraint on the number of allowed values: ? for zero or one, * for zero or more, + for one or more.  Thick lines represent strong references; thin lines represent weak references.

IC_SB_Global Connection SSL Availability_Zone Gateway Encap Datapath_Binding Port_Binding Route connections* ssl? availability_zone encaps+ availability_zone encap? availability_zone

IC_SB_Global TABLE

Interconnection Southbound configuration. This table must have exactly one row.

Summary

Common Columns:
external_ids

map of string-string pairs

options

map of string-string pairs

Connection Options:
connections

set of Connections

ssl

optional SSL

Details

Common Columns:

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

options: map of string-string pairs

Connection Options:

connections: set of Connections

Database clients to which the Open vSwitch database server should connect or on which it should listen, along with options for how these connections should be configured. See the Connection table for more information.

ssl: optional SSL

Global SSL configuration.

Availability_Zone TABLE

Each row in this table represents an Availability Zone. Each OVN deployment is considered an availability zone from OVN control plane perspective, with its own central components, such as northbound and southbound databases and ovn-northd daemon.

Summary

name

string (must be unique within table)

Details

name: string (must be unique within table)

A name that uniquely identifies the availability zone.

Gateway TABLE

Each row in this table represents a interconnection gateway chassis in an availability zone.

Summary

name

string (must be unique within table)

availability_zone

Availability_Zone

hostname

string

Common Columns:
external_ids

map of string-string pairs

Encapsulation Configuration:
encaps

set of 1 or more Encaps

Details

name: string (must be unique within table)

The name of the gateway. See name column of the OVN Southbound database’s Chassis table.

availability_zone: Availability_Zone

The availabilty zone that the gateway belongs to.

hostname: string

The hostname of the gateway.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.

external_ids: map of string-string pairs

Encapsulation Configuration:

OVN uses encapsulation to transmit logical dataplane packets between gateways.

encaps: set of 1 or more Encaps

Points to supported encapsulation configurations to transmit logical dataplane packets to this gateway. Each entry is a Encap record that describes the configuration. See encaps column of the OVN Southbound database’s Chassis table.

Encap TABLE

The encaps column in the Gateway table refers to rows in this table to identify how OVN may transmit logical dataplane packets to this gateway.

Summary

type

string, one of geneve, stt, or vxlan

options

map of string-string pairs

ip

string

gateway_name

string

Details

type: string, one of geneve, stt, or vxlan

The encapsulation to use to transmit packets to this gateway. See type column of the OVN Southbound database’s Encap table.

options: map of string-string pairs

Options for configuring the encapsulation, which may be type specific. See options column of the OVN Southbound database’s Encap table.

ip: string

The IPv4 address of the encapsulation tunnel endpoint.

gateway_name: string

The name of the gateway that created this encap.

Datapath_Binding TABLE

Each row in this table represents a logical datapath for a transit logical switch configured in the OVN Interconnection Northbound database’s Transit_Switch table.

Summary

transit_switch

string

tunnel_key

integer, in range 1 to 16,777,215 (must be unique within table)

Common Columns:
external_ids

map of string-string pairs

Details

transit_switch: string

The name of the transit logical switch that is configured in the OVN Interconnection Northbound database’s Transit_Switch table.

tunnel_key: integer, in range 1 to 16,777,215 (must be unique within table)

The tunnel key value to which the logical datapath is bound. The key can be generated by any ovn-ic but the same key is shared by all availability zones so that the logical datapaths can be peered across them. A tunnel key for transit switch datapath binding must be globally unique.

For more information about the meanings of a tunnel key, see tunnel_key column of the OVN Southbound database’s Datapath_Binding table.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.

external_ids: map of string-string pairs

Port_Binding TABLE

Each row in this table binds a logical port on the transit switch to a physical gateway and a tunnel key. Each port on the transit switch belongs to a specific availability zone.

Summary

Core Features:
transit_switch

string

logical_port

string (must be unique within table)

availability_zone

Availability_Zone

encap

optional weak reference to Encap

gateway

string

tunnel_key

integer, in range 1 to 32,767

address

string

Common Columns:
external_ids

map of string-string pairs

Details

Core Features:

transit_switch: string

The name of the transit switch that the corresponding logical port belongs to.

logical_port: string (must be unique within table)

A logical port, taken from name in the OVN_Northbound database’s Logical_Switch_Port table. The logical port name must be unique across all availability zones.

availability_zone: Availability_Zone

The availability zone that the port belongs to.

encap: optional weak reference to Encap

Points to supported encapsulation configurations to transmit logical dataplane packets to this gateway. Each entry is a Encap record that describes the configuration.

gateway: string

The name of the gateway that this port is physically located.

tunnel_key: integer, in range 1 to 32,767

A number that represents the logical port in the key (e.g. STT key or Geneve TLV) field carried within tunnel protocol packets. The key can be generated by any ovn-ic but the same key is shared by all availability zones so that the packets can go through the datapath pipelines of different availability zones.

The tunnel ID must be unique within the scope of a logical datapath.

For more information about tunnel key, see tunnel_key column of the OVN Southbound database’s Port_Binding table.

address: string

The Ethernet address and IP addresses used by the corresponding logical router port peering with the transit switch port. It is a string combined with the value of mac column followed by the values in networks column in Logical_Router_Port table.

Common Columns:

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Route TABLE

Each row in this table represents a route advertised.

Summary

Core Features:
transit_switch

string

availability_zone

Availability_Zone

ip_prefix

string

nexthop

string

Common Columns:
external_ids

map of string-string pairs

Details

Core Features:

transit_switch: string

The name of the transit switch, upon which the route is advertised.

availability_zone: Availability_Zone

The availability zone that has advertised the route.

ip_prefix: string

IP prefix of this route (e.g. 192.168.100.0/24).

nexthop: string

Nexthop IP address for this route.

Common Columns:

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Connection TABLE

Configuration for a database connection to an Open vSwitch database (OVSDB) client.

This table primarily configures the Open vSwitch database server (ovsdb-server).

The Open vSwitch database server can initiate and maintain active connections to remote clients. It can also listen for database connections.

Summary

Core Features:
target

string (must be unique within table)

Client Failure Detection and Handling:
max_backoff

optional integer, at least 1,000

inactivity_probe

optional integer

Status:
is_connected

boolean

status : last_error

optional string

status : state

optional string, one of ACTIVE, BACKOFF, CONNECTING, IDLE, or VOID

status : sec_since_connect

optional string, containing an integer, at least 0

status : sec_since_disconnect

optional string, containing an integer, at least 0

status : locks_held

optional string

status : locks_waiting

optional string

status : locks_lost

optional string

status : n_connections

optional string, containing an integer, at least 2

status : bound_port

optional string, containing an integer

Common Columns:
external_ids

map of string-string pairs

other_config

map of string-string pairs

Details

Core Features:

target: string (must be unique within table)

Connection methods for clients.

The following connection methods are currently supported:

ssl:host[:port]

The specified SSL port on the given host, which can either be a DNS name (if built with unbound library) or an IP address. A valid SSL configuration must be provided when this form is used, this configuration can be specified via command-line options or the SSL table.

If port is not specified, it defaults to 6640.

SSL support is an optional feature that is not always built as part of Open vSwitch.

tcp:host[:port]

The specified TCP port on the given host, which can either be a DNS name (if built with unbound library) or an IP address (IPv4 or IPv6). If host is an IPv6 address, wrap it in square brackets, e.g. tcp:[::1]:6640.

If port is not specified, it defaults to 6640.

pssl:[port][:host]

Listens for SSL connections on the specified TCP port. Specify 0 for port to have the kernel automatically choose an available port. If host, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address). If host is an IPv6 address, wrap in square brackets, e.g. pssl:6640:[::1]. If host is not specified then it listens only on IPv4 (but not IPv6) addresses. A valid SSL configuration must be provided when this form is used, this can be specified either via command-line options or the SSL table.

If port is not specified, it defaults to 6640.

SSL support is an optional feature that is not always built as part of Open vSwitch.

ptcp:[port][:host]

Listens for connections on the specified TCP port. Specify 0 for port to have the kernel automatically choose an available port. If host, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address). If host is an IPv6 address, wrap it in square brackets, e.g. ptcp:6640:[::1]. If host is not specified then it listens only on IPv4 addresses.

If port is not specified, it defaults to 6640.

When multiple clients are configured, the target values must be unique. Duplicate target values yield unspecified results.

Client Failure Detection and Handling:

max_backoff: optional integer, at least 1,000

Maximum number of milliseconds to wait between connection attempts. Default is implementation-specific.

inactivity_probe: optional integer

Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message. If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe. If a response is not received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect. Default is implementation-specific. A value of 0 disables inactivity probes.

Status:

Key-value pair of is_connected is always updated. Other key-value pairs in the status columns may be updated depends on the target type.

When target specifies a connection method that listens for inbound connections (e.g. ptcp: or punix:), both n_connections and is_connected may also be updated while the remaining key-value pairs are omitted.

On the other hand, when target specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets. They are omitted.

is_connected: boolean

true if currently connected to this client, false otherwise.

status : last_error: optional string

A human-readable description of the last error on the connection to the manager; i.e. strerror(errno). This key will exist only if an error has occurred.

status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, IDLE, or VOID

The state of the connection to the manager:

VOID

Connection is disabled.

BACKOFF

Attempting to reconnect at an increasing period.

CONNECTING

Attempting to connect.

ACTIVE

Connected, remote host responsive.

IDLE

Connection is idle. Waiting for response to keep-alive.

These values may change in the future. They are provided only for human consumption.

status : sec_since_connect: optional string, containing an integer, at least 0

The amount of time since this client last successfully connected to the database (in seconds). Value is empty if client has never successfully been connected.

status : sec_since_disconnect: optional string, containing an integer, at least 0

The amount of time since this client last disconnected from the database (in seconds). Value is empty if client has never disconnected.

status : locks_held: optional string

Space-separated list of the names of OVSDB locks that the connection holds. Omitted if the connection does not hold any locks.

status : locks_waiting: optional string

Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire. Omitted if the connection is not waiting for any locks.

status : locks_lost: optional string

Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client. Omitted if no locks have been stolen from this connection.

status : n_connections: optional string, containing an integer, at least 2

When target specifies a connection method that listens for inbound connections (e.g. ptcp: or pssl:) and more than one connection is actually active, the value is the number of active connections. Otherwise, this key-value pair is omitted.

status : bound_port: optional string, containing an integer

When target is ptcp: or pssl:, this is the TCP port on which the OVSDB server is listening. (This is particularly useful when target specifies a port of 0, allowing the kernel to choose any available port.)

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.

external_ids: map of string-string pairs

other_config: map of string-string pairs

SSL Table

SSL configuration for ovn-sb database access.

Summary

private_key

string

certificate

string

ca_cert

string

bootstrap_ca_cert

boolean

ssl_protocols

string

ssl_ciphers

string

Common Columns:
external_ids

map of string-string pairs

Details

private_key: string

Name of a PEM file containing the private key used as the switch’s identity for SSL connections to the controller.

certificate: string

Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch’s private key, identifying a trustworthy switch.

ca_cert: string

Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller.

bootstrap_ca_cert: boolean

If set to true, then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL connection and save it to the named PEM file. If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained. This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate. It may still be useful for bootstrapping.

ssl_protocols: string

List of SSL protocols to be enabled for SSL connections. The default when this option is omitted is TLSv1,TLSv1.1,TLSv1.2.

ssl_ciphers: string

List of ciphers (in OpenSSL cipher string format) to be supported for SSL connections. The default when this option is omitted is HIGH:!aNULL:!MD5.

Common Columns:

The overall purpose of these columns is described under Common Columns at the beginning of this document.

external_ids: map of string-string pairs

Referenced By

ovn-ic-sbctl(8).

DB Schema 1.0.0 Open vSwitch 20.03.0 Open vSwitch Manual