External IDs¶

Summary:¶

Status:

Common Columns:

Details:¶

nb_cfg: integer

Sequence number for client to increment. When a client modifies any part of the northbound database configuration and wishes to wait for ovn-northd and possibly all of the hypervisors to finish applying the changes, it may increment this sequence number.

sb_cfg: integer

Sequence number that ovn-northd sets to the value of nb_cfg after it finishes applying the corresponding configuration changes to the OVN_Southbound database.

hv_cfg: integer

Sequence number that ovn-northd sets to the smallest sequence number of all the chassis in the system, as reported in the Chassis table in the southbound database. Thus, hv_cfg equals nb_cfg if all chassis are caught up with the northbound configuration (which may never happen, if any chassis is down). This value can regress, if a chassis was removed from the system and rejoins before catching up.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

name

string

ports

set of Logical_Switch_Ports

load_balancer

set of Load_Balancers

acls

set of ACLs

other_config:

Common Columns:

Details:¶

name: string

A name for the logical switch. This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database. There is no requirement for the name to be unique. The logical switch’s UUID should be used as the unique identifier.

ports: set of Logical_Switch_Ports

The logical ports connected to the logical switch.

It is an error for multiple logical switches to include the same logical port.

load_balancer: set of Load_Balancers

Load balance a virtual ipv4 address to a set of logical port endpoint ipv4 addresses.

acls: set of ACLs

Access control rules that apply to packets within the logical switch.

other_config : subnet: optional string

Set this to an IPv4 subnet, e.g. 192.168.0.0/24, to enable ovn-northd to automatically assign IP addresses within that subnet. Use the dynamic keyword in the Logical_Switch_Port table’s addresses column to request dynamic address assignment for a particular port.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

Core Features:

Options:

Containers:

Port State:

Addressing:

Common Columns:

Details:¶

name: string (must be unique within table)

The logical port name.

For entities (VMs or containers) that are spawned in the hypervisor, the name used here must match those used in the external_ids:iface-id in the Open_vSwitch database’s Interface table, because hypervisors use external_ids:iface-id as a lookup key to identify the network interface of that entity.

For containers that share a VIF within a VM, the name can be any unique identifier. See Containers, below, for more information.

type: string

Specify a type for this logical port. Logical ports can be used to model other types of connectivity into an OVN logical switch. The following types are defined:

options: map of string-string pairs

This column provides key/value settings specific to the logical port type. The type-specific options are described individually below.

options : router-port: optional string

Required. The name of the Logical_Router_Port to which this logical switch port is connected.

options : nat-addresses: optional string

MAC address of the router-port followed by a list of SNAT and DNAT IP addresses. This is used to send gratuitous ARPs for SNAT and DNAT IP addresses via localnet and is valid for only L3 gateway ports. Example: 80:fa:5b:06:72:b7 158.36.44.22 158.36.44.24. This would result in generation of gratuitous ARPs for IP addresses 158.36.44.22 and 158.36.44.24 with a MAC address of 80:fa:5b:06:72:b7.

options : network_name: optional string

Required. The name of the network to which the localnet port is connected. Each hypervisor, via ovn-controller, uses its local configuration to determine exactly how to connect to this locally accessible network.

options : network_name: optional string

Required. The name of the network to which the l2gateway port is connected. The L2 gateway, via ovn-controller, uses its local configuration to determine exactly how to connect to this network.

options : l2gateway-chassis: optional string

Required. The chassis on which the l2gateway logical port should be bound to. ovn-controller running on the defined chassis will connect this logical port to the physical network.

options : vtep-physical-switch: optional string

Required. The name of the VTEP gateway.

options : vtep-logical-switch: optional string

Required. A logical switch name connected by the VTEP gateway.

options : policing_rate: optional string

If set, indicates the maximum rate for data sent from this interface, in kbps. Data exceeding this rate is dropped.

options : policing_burst: optional string

If set, indicates the maximum burst size for data sent from this interface, in kb.

These columns are used for VIFs that represent nested containers using shared VIFs. For VMs and for containers that have dedicated VIFs, they are empty.

parent_name: optional string

The VM interface through which the nested container sends its network traffic. This must match the name column for some other Logical_Switch_Port.

tag_request: optional integer, in range 0 to 4,095

The VLAN tag in the network traffic associated with a container’s network interface. The client can request ovn-northd to allocate a tag that is unique within the scope of a specific parent (specified in parent_name) by setting a value of 0 in this column. The allocated value is written by ovn-northd in the tag column. (Note that these tags are allocated and managed locally in ovn-northd, so they cannot be reconstructed in the event that the database is lost.) The client can also request a specific non-zero tag and ovn-northd will honor it and copy that value to the tag column.

When type is set to localnet or l2gateway, this can be set to indicate that the port represents a connection to a specific VLAN on a locally accessible network. The VLAN ID is used to match incoming traffic and is also added to outgoing traffic.

tag: optional integer, in range 1 to 4,095

The VLAN tag allocated by ovn-northd based on the contents of the tag_request column.

up: optional boolean

This column is populated by ovn-northd, rather than by the CMS plugin as is most of this database. When a logical port is bound to a physical location in the OVN Southbound database Binding table, ovn-northd sets this column to true; otherwise, or if the port becomes unbound later, it sets it to false. This allows the CMS to wait for a VM’s (or container’s) networking to become active before it allows the VM (or container) to start.

enabled: optional boolean

This column is used to administratively set port state. If this column is empty or is set to true, the port is enabled. If this column is set to false, the port is disabled. A disabled port has all ingress and egress traffic dropped.

addresses: set of strings

Addresses owned by the logical port.

Each element in the set must take one of the following forms:

dynamic_addresses: optional string

Addresses assigned to the logical port by ovn-northd, if dynamic is specified in addresses. Addresses will be of the same format as those that populate the addresses column. Note that these addresses are constructed and managed locally in ovn-northd, so they cannot be reconstructed in the event that the database is lost.

port_security: set of strings

This column controls the addresses from which the host attached to the logical port (``the host’’) is allowed to send packets and to which it is allowed to receive packets. If this column is empty, all addresses are permitted.

Each element in the set must begin with one Ethernet address. This would restrict the host to sending packets from and receiving packets to the ethernet addresses defined in the logical port’s port_security column. It also restricts the inner source MAC addresses that the host may send in ARP and IPv6 Neighbor Discovery packets. The host is always allowed to receive packets to multicast and broadcast Ethernet addresses.

Each element in the set may additionally contain one or more IPv4 or IPv6 addresses (or both), with optional masks. If a mask is given, it must be a CIDR mask. In addition to the restrictions described for Ethernet addresses above, such an element restricts the IPv4 or IPv6 addresses from which the host may send and to which it may receive packets to the specified addresses. A masked address, if the host part is zero, indicates that the host is allowed to use any address in the subnet; if the host part is nonzero, the mask simply indicates the size of the subnet. In addition:

If an element includes an IPv4 address, but no IPv6 addresses, then IPv6 traffic is not allowed. If an element includes an IPv6 address, but no IPv4 address, then IPv4 and ARP traffic is not allowed.

This column uses the same lexical syntax as the match column in the OVN Southbound database’s Pipeline table. Multiple addresses within an element may be space or comma separated.

This column is provided as a convenience to cloud management systems, but all of the features that it implements can be implemented as ACLs using the ACL table.

Examples:

dhcpv4_options: optional weak reference to DHCP_Options

This column defines the DHCPv4 Options to be included by the ovn-controller when it replies to the DHCPv4 requests. Please see the DHCP_Options table.

dhcpv6_options: optional weak reference to DHCP_Options

This column defines the DHCPv6 Options to be included by the ovn-controller when it replies to the DHCPv6 requests. Please see the DHCP_Options table.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

name

string (must be unique within table)

addresses

set of strings

Common Columns:

Details:¶

name: string (must be unique within table)

A name for the address set. This must be unique among all address sets.

addresses: set of strings

The set of addresses in string form.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

vips

map of string-string pairs

protocol

optional string, either udp or tcp

Common Columns:

Details:¶

vips: map of string-string pairs

A map of virtual IPv4 addresses (and an optional port number with : as a separator) associated with this load balancer and their corresponding endpoint IPv4 addresses (and optional port numbers with : as separators) separated by commas. If the destination IP address (and port number) of a packet leaving a container or a VM matches the virtual IPv4 address (and port number) provided here as a key, then OVN will statefully replace the destination IP address by one of the provided IPv4 address (and port number) in this map as a value. Examples for keys are "192.168.1.4" and "172.16.1.8:80". Examples for value are "10.0.0.1, 10.0.0.2" and "20.0.0.10:8800, 20.0.0.11:8800".

protocol: optional string, either udp or tcp

Valid protocols are tcp or udp. This column is useful when a port number is provided as part of the vips column. If this column is empty and a port number is provided as part of vips column, OVN assumes the protocol to be tcp.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

priority

integer, in range 0 to 32,767

direction

string, either to-lport or from-lport

match

string

action

string, one of allow-related, drop, allow, or reject

log

boolean

Common Columns:

Details:¶

priority: integer, in range 0 to 32,767

The ACL rule’s priority. Rules with numerically higher priority take precedence over those with lower. If two ACL rules with the same priority both match, then the one actually applied to a packet is undefined.

Return traffic from an allow-related flow is always allowed and cannot be changed through an ACL.

direction: string, either to-lport or from-lport

Direction of the traffic to which this rule should apply:

match: string

The packets that the ACL should match, in the same expression language used for the match column in the OVN Southbound database’s Logical_Flow table. The outport logical port is only available in the to-lport direction (the inport is available in both directions).

By default all traffic is allowed. When writing a more restrictive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets.

Note that you can not create an ACL matching on a port with type=router.

Note that when localnet port exists in a lswitch, for to-lport direction, the inport works only if the to-lport is located on the same chassis as the inport.

action: string, one of allow-related, drop, allow, or reject

The action to take when the ACL rule matches:

log: boolean

If set to true, packets that match the ACL will trigger a log message on the transport node or nodes that perform ACL processing. Logging may be combined with any action.

Logging is not yet implemented.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

name

string

ports

set of Logical_Router_Ports

static_routes

set of Logical_Router_Static_Routes

enabled

optional boolean

nat

set of NATs

load_balancer

set of Load_Balancers

Options:

Common Columns:

Details:¶

name: string

A name for the logical router. This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database. There is no requirement for the name to be unique. The logical router’s UUID should be used as the unique identifier.

ports: set of Logical_Router_Ports

The router’s ports.

static_routes: set of Logical_Router_Static_Routes

One or more static routes for the router.

enabled: optional boolean

This column is used to administratively set router state. If this column is empty or is set to true, the router is enabled. If this column is set to false, the router is disabled. A disabled router has all ingress and egress traffic dropped.

nat: set of NATs

One or more NAT rules for the router. NAT rules only work on the Gateway routers.

load_balancer: set of Load_Balancers

Load balance a virtual ipv4 address to a set of logical port ipv4 addresses. Load balancer rules only work on the Gateway routers.

options : chassis: optional string

If set, indicates that the logical router in question is a Gateway router (which is centralized) and resides in the set chassis. The same value is also used by ovn-controller to uniquely identify the chassis in the OVN deployment and comes from external_ids:system-id in the Open_vSwitch table of Open_vSwitch database.

The Gateway router can only be connected to a distributed router via a switch if SNAT and DNAT are to be configured in the Gateway router.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

name

string (must be unique within table)

networks

set of 1 or more strings

mac

string

enabled

optional boolean

Attachment:

Common Columns:

Details:¶

name: string (must be unique within table)

A name for the logical router port.

In addition to provide convenience for human interaction with the ovn-nb database, this column is used as reference by its patch port in Logical_Switch_Port or another logical router port in Logical_Router_Port.

networks: set of 1 or more strings

The IP addresses and netmasks of the router. For example, 192.168.0.1/24 indicates that the router’s IP address is 192.168.0.1 and that packets destined to 192.168.0.x should be routed to this port.

A logical router port always adds a link-local IPv6 address (fe80::/64) automatically generated from the interface’s MAC address using the modified EUI-64 format.

mac: string

The Ethernet address that belongs to this router port.

enabled: optional boolean

This column is used to administratively set port state. If this column is empty or is set to true, the port is enabled. If this column is set to false, the port is disabled. A disabled port has all ingress and egress traffic dropped.

peer: optional string

For a router port used to connect two logical routers, this identifies the other router port in the pair by name.

For a router port attached to a logical switch, this column is empty.

external_ids: map of string-string pairs

See External IDs at the beginning of this document.

Summary:¶

ip_prefix

string

nexthop

string

output_port

optional string

Details:¶

ip_prefix: string

IP prefix of this route (e.g. 192.168.100.0/24).

nexthop: string

Nexthop IP address for this route. Nexthop IP address should be the IP address of a connected router port or the IP address of a logical port.

output_port: optional string

The name of the Logical_Router_Port via which the packet needs to be sent out. This is optional and when not specified, OVN will automatically figure this out based on the nexthop.

Summary:¶

type

string, one of snat, dnat, or dnat_and_snat

external_ip

string

logical_ip

string

Details:¶

type: string, one of snat, dnat, or dnat_and_snat

Type of the NAT rule.

external_ip: string

An IPv4 address.

logical_ip: string

An IPv4 network (e.g 192.168.1.0/24) or an IPv4 address.

Summary:¶

cidr

string

DHCPv4 options:

DHCPv6 options:

Common Columns:

Details:¶

cidr: string

The DHCPv4/DHCPv6 options will be included if the logical port has its IP address in this cidr.

options : server_id: optional string

The IP address for the DHCP server to use. This should be in the subnet of the offered IP. This is also included in the DHCP offer as option 54, ``server identifier.’’

options : server_mac: optional string

The Ethernet address for the DHCP server to use.

options : router: optional string

The IP address of a gateway for the client to use. This should be in the subnet of the offered IP. The DHCPv4 option code for this option is 3.

options : lease_time: optional string, containing an integer, in range 0 to 4,294,967,295

The offered lease time in seconds,

The DHCPv4 option code for this option is 51.

options : netmask: optional string

The DHCPv4 option code for this option is 1.

options : dns_server: optional string

The DHCPv4 option code for this option is 6.

options : log_server: optional string

The DHCPv4 option code for this option is 7.

options : lpr_server: optional string

The DHCPv4 option code for this option is 9.

options : swap_server: optional string

The DHCPv4 option code for this option is 16.

options : policy_filter: optional string

The DHCPv4 option code for this option is 21.

options : router_solicitation: optional string

The DHCPv4 option code for this option is 32.

options : nis_server: optional string

The DHCPv4 option code for this option is 41.

options : ntp_server: optional string

The DHCPv4 option code for this option is 42.

options : tftp_server: optional string

The DHCPv4 option code for this option is 66.

options : classless_static_route: optional string

The DHCPv4 option code for this option is 121.

This option can contain one or more static routes, each of which consists of a destination descriptor and the IP address of the router that should be used to reach that destination. Please see RFC 3442 for more details.

Example: {30.0.0.0/24,10.0.0.10, 0.0.0.0/0,10.0.0.1}

options : ms_classless_static_route: optional string

The DHCPv4 option code for this option is 249. This option is similar to classless_static_route supported by Microsoft Windows DHCPv4 clients.

options : ip_forward_enable: optional string, either 1 or 0

The DHCPv4 option code for this option is 19.

options : router_discovery: optional string, either 1 or 0

The DHCPv4 option code for this option is 31.

options : ethernet_encap: optional string, either 1 or 0

The DHCPv4 option code for this option is 36.

options : default_ttl: optional string, containing an integer, in range 0 to 255

The DHCPv4 option code for this option is 23.

options : tcp_ttl: optional string, containing an integer, in range 0 to 255

The DHCPv4 option code for this option is 37.

options : mtu: optional string, containing an integer, in range 68 to 65,535

The DHCPv4 option code for this option is 26.

options : T1: optional string, containing an integer, in range 68 to 4,294,967,295

This specifies the time interval from address assignment until the client begins trying to renew its address. The DHCPv4 option code for this option is 58.

options : T2: optional string, containing an integer, in range 68 to 4,294,967,295

This specifies the time interval from address assignment until the client begins trying to rebind its address. The DHCPv4 option code for this option is 59.

options : server_id: optional string

The Ethernet address for the DHCP server to use. This is also included in the DHCPv6 reply as option 2, ``Server Identifier’’ to carry a DUID identifying a server between a client and a server. ovn-controller defines DUID based on Link-layer Address [DUID-LL].

options : dns_server: optional string

The DHCPv6 option code for this option is 23. This option specifies the DNS servers that the VM should use.

options : domain_search: optional string

The DHCPv6 option code for this option is 24. This option specifies the domain search list the client should use to resolve hostnames with DNS.

Example: "ovn.org".

external_ids: map of string-string pairs

See External IDs at the beginning of this document.