ovn-ic-sb(5)                  Open vSwitch Manual                 ovn-ic-sb(5)



NAME
       ovn-ic-sb - OVN_IC_Southbound database schema

       This database holds configuration and state for interconnecting differ‐
       ent OVN deployments. The content of the database is populated and  used
       by  the  ovn-ic  program in each OVN deployment, and not supposed to be
       directly used by CMS or end user.

       The OVN Interconnection Southbound database is shared by ovn-ic program
       in  each  OVN  deployment. It contains interconnection information from
       all related OVN deployments, and is used as the intermediate store  for
       each  OVN deployment to exchange the information. The ovn-ic program in
       each deployment is responsible for syncing the data between this  data‐
       base and the its own northbound and southbound databases.

   Database Structure
       The  OVN  Interconnection  Southbound database contains classes of data
       with different properties, as described in the sections below.

     Availability Zone Specific Information

       These tables contain objects that are availability zone specific.  Each
       object  is  owned  and  populated by one availability zone, and read by
       other availability zones.

       The Availability_Zone, Gateway, Encap and Port_Binding tables  are  the
       availability zone specific tables.

     Global Information

       The  data that does not belong to any specific availability zone but is
       common for all availability zones.

       The Datapath_Binding table contains the common datapath binding  infor‐
       mation.

     Common Columns

       Each  of  the  tables in this database contains a special column, named
       external_ids. This column has the same form and purpose each  place  it
       appears.

              external_ids: map of string-string pairs
                     Key-value pairs for use by ovn-ic.

TABLE SUMMARY
       The  following list summarizes the purpose of each of the tables in the
       OVN_IC_Southbound database.  Each table is described in more detail  on
       a later page.

       Table     Purpose
       IC_SB_Global
                 IC Southbound configuration
       Availability_Zone
                 Availability Zone Information
       Gateway   Interconnection Gateway Information
       Encap     Encapsulation Types
       Datapath_Binding
                 Transit Switch Datapath Bindings
       Port_Binding
                 Transit Port Bindings
       Route     Route
       Connection
                 OVSDB client connections.
       SSL       SSL configuration.

IC_SB_Global TABLE
       Interconnection  Southbound configuration. This table must have exactly
       one row.

   Summary:
       Common Columns:
         external_ids                map of string-string pairs
         options                     map of string-string pairs
       Connection Options:
         connections                 set of Connections
         ssl                         optional SSL

   Details:
     Common Columns:

       external_ids: map of string-string pairs
              See External IDs at the beginning of this document.

       options: map of string-string pairs

     Connection Options:

       connections: set of Connections
              Database clients to  which  the  Open  vSwitch  database  server
              should  connect or on which it should listen, along with options
              for how these connections should be configured. See the  Connec
              tion table for more information.

       ssl: optional SSL
              Global SSL configuration.

Availability_Zone TABLE
       Each  row  in  this  table  represents  an  Availability Zone. Each OVN
       deployment is considered an availability zone from  OVN  control  plane
       perspective,  with  its  own central components, such as northbound and
       southbound databases and ovn-northd daemon.

   Summary:
       name                          string (must be unique within table)

   Details:
       name: string (must be unique within table)
              A name that uniquely identifies the availability zone.

Gateway TABLE
       Each row in this table represents a interconnection gateway chassis  in
       an availability zone.

   Summary:
       name                          string (must be unique within table)
       availability_zone             Availability_Zone
       hostname                      string
       Common Columns:
         external_ids                map of string-string pairs
       Encapsulation Configuration:
         encaps                      set of 1 or more Encaps

   Details:
       name: string (must be unique within table)
              The  name  of the gateway. See name column of the OVN Southbound
              database’s Chassis table.

       availability_zone: Availability_Zone
              The availabilty zone that the gateway belongs to.

       hostname: string
              The hostname of the gateway.

     Common Columns:

       The overall purpose of these columns is described under Common  Columns
       at the beginning of this document.

       external_ids: map of string-string pairs

     Encapsulation Configuration:

       OVN  uses  encapsulation  to transmit logical dataplane packets between
       gateways.

       encaps: set of 1 or more Encaps
              Points to supported  encapsulation  configurations  to  transmit
              logical dataplane packets to this gateway. Each entry is a Encap
              record that describes the configuration. See  encaps  column  of
              the OVN Southbound database’s Chassis table.
Encap TABLE
       The  encaps column in the Gateway table refers to rows in this table to
       identify how OVN may transmit logical dataplane packets to  this  gate‐
       way.

   Summary:
       type                          string, one of geneve, stt, or vxlan
       options                       map of string-string pairs
       ip                            string
       gateway_name                  string

   Details:
       type: string, one of geneve, stt, or vxlan
              The  encapsulation  to  use to transmit packets to this gateway.
              See type column of the OVN Southbound database’s Encap table.

       options: map of string-string pairs
              Options for configuring the encapsulation,  which  may  be  type
              specific.  See  options  column of the OVN Southbound database’s
              Encap table.

       ip: string
              The IPv4 address of the encapsulation tunnel endpoint.

       gateway_name: string
              The name of the gateway that created this encap.

Datapath_Binding TABLE
       Each row in this table represents a logical datapath for a transit log‐
       ical switch configured in the OVN Interconnection Northbound database’s
       Transit_Switch table.

   Summary:
       transit_switch                string
       tunnel_key                    integer, in range 1 to  16,777,215  (must
                                     be unique within table)
       Common Columns:
         external_ids                map of string-string pairs

   Details:
       transit_switch: string
              The name of the transit logical switch that is configured in the
              OVN Interconnection Northbound database’s Transit_Switch table.

       tunnel_key: integer, in range 1 to 16,777,215 (must  be  unique  within
       table)
              The tunnel key value to which the logical datapath is bound. The
              key can be generated by any ovn-ic but the same key is shared by
              all  availability  zones  so  that  the logical datapaths can be
              peered across them. A tunnel key  for  transit  switch  datapath
              binding must be globally unique.

              For  more  information  about  the meanings of a tunnel key, see
              tunnel_key  column  of  the  OVN  Southbound  database’s   Data
              path_Binding table.

     Common Columns:

       The  overall purpose of these columns is described under Common Columns
       at the beginning of this document.

       external_ids: map of string-string pairs

Port_Binding TABLE
       Each row in this table binds a logical port on the transit switch to  a
       physical  gateway  and  a  tunnel  key. Each port on the transit switch
       belongs to a specific availability zone.

   Summary:
       Core Features:
         transit_switch              string
         logical_port                string (must be unique within table)
         availability_zone           Availability_Zone
         encap                       optional weak reference to Encap
         gateway                     string
         tunnel_key                  integer, in range 1 to 32,767
         address                     string
       Common Columns:
         external_ids                map of string-string pairs

   Details:
     Core Features:

       transit_switch: string
              The name of the transit switch that  the  corresponding  logical
              port belongs to.

       logical_port: string (must be unique within table)
              A logical port, taken from name in the OVN_Northbound database’s
              Logical_Switch_Port table. The logical port name must be  unique
              across all availability zones.

       availability_zone: Availability_Zone
              The availability zone that the port belongs to.

       encap: optional weak reference to Encap
              Points  to  supported  encapsulation  configurations to transmit
              logical dataplane packets to this gateway. Each entry is a Encap
              record that describes the configuration.

       gateway: string
              The name of the gateway that this port is physically located.

       tunnel_key: integer, in range 1 to 32,767
              A  number  that represents the logical port in the key (e.g. STT
              key or Geneve TLV) field carried within tunnel protocol packets.
              The  key  can  be  generated  by  any ovn-ic but the same key is
              shared by all availability zones so  that  the  packets  can  go
              through the datapath pipelines of different availability zones.

              The tunnel ID must be unique within the scope of a logical data‐
              path.

              For more information about tunnel key, see tunnel_key column  of
              the OVN Southbound database’s Port_Binding table.

       address: string
              The  Ethernet address and IP addresses used by the corresponding
              logical router port peering with the transit switch port. It  is
              a  string  combined with the value of mac column followed by the
              values in networks column in Logical_Router_Port table.

     Common Columns:

       external_ids: map of string-string pairs
              See External IDs at the beginning of this document.

Route TABLE
       Each row in this table represents a route advertised.

   Summary:
       Core Features:
         transit_switch              string
         availability_zone           Availability_Zone
         ip_prefix                   string
         nexthop                     string
       Common Columns:
         external_ids                map of string-string pairs

   Details:
     Core Features:

       transit_switch: string
              The name of the transit switch, upon which the route  is  adver‐
              tised.

       availability_zone: Availability_Zone
              The availability zone that has advertised the route.

       ip_prefix: string
              IP prefix of this route (e.g. 192.168.100.0/24).

       nexthop: string
              Nexthop IP address for this route.

     Common Columns:

       external_ids: map of string-string pairs
              See External IDs at the beginning of this document.

Connection TABLE
       Configuration  for  a  database  connection to an Open vSwitch database
       (OVSDB) client.

       This table  primarily  configures  the  Open  vSwitch  database  server
       (ovsdb-server).

       The  Open vSwitch database server can initiate and maintain active con‐
       nections to remote clients. It can also  listen  for  database  connec‐
       tions.

   Summary:
       Core Features:
         target                      string (must be unique within table)
       Client Failure Detection and Handling:
         max_backoff                 optional integer, at least 1,000
         inactivity_probe            optional integer
       Status:
         is_connected                boolean
         status : last_error         optional string
         status : state              optional  string, one of ACTIVE, BACKOFF,
                                     CONNECTING, IDLE, or VOID
         status : sec_since_connect  optional string, containing  an  integer,
                                     at least 0
         status : sec_since_disconnect
                                     optional  string,  containing an integer,
                                     at least 0
         status : locks_held         optional string
         status : locks_waiting      optional string
         status : locks_lost         optional string
         status : n_connections      optional string, containing  an  integer,
                                     at least 2
         status : bound_port         optional string, containing an integer
       Common Columns:
         external_ids                map of string-string pairs
         other_config                map of string-string pairs

   Details:
     Core Features:

       target: string (must be unique within table)
              Connection methods for clients.

              The following connection methods are currently supported:

              ssl:host[:port]
                     The  specified  SSL  port  on  the  given host, which can
                     either be a DNS name (if built with unbound  library)  or
                     an IP address. A valid SSL configuration must be provided
                     when this form is used, this configuration can be  speci‐
                     fied via command-line options or the SSL table.

                     If port is not specified, it defaults to 6640.

                     SSL  support  is  an  optional feature that is not always
                     built as part of Open vSwitch.

              tcp:host[:port]
                     The specified TCP port  on  the  given  host,  which  can
                     either  be  a DNS name (if built with unbound library) or
                     an IP address (IPv4 or IPv6). If host is an IPv6 address,
                     wrap it in square brackets, e.g. tcp:[::1]:6640.

                     If port is not specified, it defaults to 6640.

              pssl:[port][:host]
                     Listens  for  SSL  connections on the specified TCP port.
                     Specify 0 for  port  to  have  the  kernel  automatically
                     choose  an available port. If host, which can either be a
                     DNS name  (if  built  with  unbound  library)  or  an  IP
                     address, is specified, then connections are restricted to
                     the resolved or specified local IP address  (either  IPv4
                     or  IPv6  address).  If  host is an IPv6 address, wrap in
                     square brackets, e.g. pssl:6640:[::1].  If  host  is  not
                     specified  then  it  listens  only on IPv4 (but not IPv6)
                     addresses. A valid SSL  configuration  must  be  provided
                     when  this form is used, this can be specified either via
                     command-line options or the SSL table.

                     If port is not specified, it defaults to 6640.

                     SSL support is an optional feature  that  is  not  always
                     built as part of Open vSwitch.

              ptcp:[port][:host]
                     Listens  for connections on the specified TCP port. Spec‐
                     ify 0 for port to have the kernel automatically choose an
                     available  port.  If host, which can either be a DNS name
                     (if built with unbound library)  or  an  IP  address,  is
                     specified,   then   connections  are  restricted  to  the
                     resolved or specified local IP address  (either  IPv4  or
                     IPv6  address).  If  host  is an IPv6 address, wrap it in
                     square brackets, e.g. ptcp:6640:[::1].  If  host  is  not
                     specified then it listens only on IPv4 addresses.

                     If port is not specified, it defaults to 6640.

              When  multiple clients are configured, the target values must be
              unique. Duplicate target values yield unspecified results.

     Client Failure Detection and Handling:

       max_backoff: optional integer, at least 1,000
              Maximum  number  of  milliseconds  to  wait  between  connection
              attempts. Default is implementation-specific.

       inactivity_probe: optional integer
              Maximum number of milliseconds of idle time on connection to the
              client before sending  an  inactivity  probe  message.  If  Open
              vSwitch  does  not communicate with the client for the specified
              number of seconds, it will send a probe. If a  response  is  not
              received  for  the  same additional amount of time, Open vSwitch
              assumes the connection has been broken and  attempts  to  recon‐
              nect.  Default is implementation-specific. A value of 0 disables
              inactivity probes.

     Status:

       Key-value pair of is_connected is always updated. Other key-value pairs
       in the status columns may be updated depends on the target type.

       When target specifies a connection method that listens for inbound con‐
       nections (e.g. ptcp: or punix:), both  n_connections  and  is_connected
       may also be updated while the remaining key-value pairs are omitted.

       On  the  other  hand, when target specifies an outbound connection, all
       key-value pairs may be updated, except  the  above-mentioned  two  key-
       value  pairs associated with inbound connection targets. They are omit‐
       ted.

       is_connected: boolean
              true if currently connected to this client, false otherwise.

       status : last_error: optional string
              A human-readable description of the last error on the connection
              to  the  manager; i.e. strerror(errno). This key will exist only
              if an error has occurred.

       status : state: optional string, one of  ACTIVE,  BACKOFF,  CONNECTING,
       IDLE, or VOID
              The state of the connection to the manager:

              VOID   Connection is disabled.

              BACKOFF
                     Attempting to reconnect at an increasing period.

              CONNECTING
                     Attempting to connect.

              ACTIVE Connected, remote host responsive.

              IDLE   Connection is idle. Waiting for response to keep-alive.

              These  values  may  change in the future. They are provided only
              for human consumption.

       status : sec_since_connect: optional string, containing an integer,  at
       least 0
              The amount of time since this client last successfully connected
              to the database (in seconds). Value is empty if client has never
              successfully been connected.

       status  : sec_since_disconnect: optional string, containing an integer,
       at least 0
              The amount of time since this client last disconnected from  the
              database  (in  seconds). Value is empty if client has never dis‐
              connected.

       status : locks_held: optional string
              Space-separated list of the names of OVSDB locks that  the  con‐
              nection  holds.  Omitted  if  the  connection  does not hold any
              locks.

       status : locks_waiting: optional string
              Space-separated list of the names of OVSDB locks that  the  con‐
              nection  is currently waiting to acquire. Omitted if the connec‐
              tion is not waiting for any locks.

       status : locks_lost: optional string
              Space-separated list of the names of OVSDB locks that  the  con‐
              nection  has  had  stolen by another OVSDB client. Omitted if no
              locks have been stolen from this connection.

       status : n_connections: optional  string,  containing  an  integer,  at
       least 2
              When  target  specifies  a  connection  method  that listens for
              inbound connections (e.g. ptcp: or pssl:) and more than one con‐
              nection  is  actually  active, the value is the number of active
              connections. Otherwise, this key-value pair is omitted.

       status : bound_port: optional string, containing an integer
              When target is ptcp: or pssl:, this is the TCP port on which the
              OVSDB  server  is  listening.  (This is particularly useful when
              target specifies a port of 0, allowing the kernel to choose  any
              available port.)

     Common Columns:

       The  overall purpose of these columns is described under Common Columns
       at the beginning of this document.

       external_ids: map of string-string pairs

       other_config: map of string-string pairs

SSL TABLE
       SSL configuration for ovn-sb database access.

   Summary:
       private_key                   string
       certificate                   string
       ca_cert                       string
       bootstrap_ca_cert             boolean
       ssl_protocols                 string
       ssl_ciphers                   string
       Common Columns:
         external_ids                map of string-string pairs

   Details:
       private_key: string
              Name of a PEM file  containing  the  private  key  used  as  the
              switch’s identity for SSL connections to the controller.

       certificate: string
              Name  of a PEM file containing a certificate, signed by the cer‐
              tificate authority (CA) used by the controller and manager, that
              certifies  the  switch’s  private key, identifying a trustworthy
              switch.

       ca_cert: string
              Name of a PEM file containing the CA certificate used to  verify
              that the switch is connected to a trustworthy controller.

       bootstrap_ca_cert: boolean
              If  set to true, then Open vSwitch will attempt to obtain the CA
              certificate from the controller on its first SSL connection  and
              save  it  to  the  named  PEM file. If it is successful, it will
              immediately drop the connection and reconnect, and from then  on
              all  SSL  connections  must  be  authenticated  by a certificate
              signed by the CA certificate thus obtained. This option  exposes
              the  SSL  connection to a man-in-the-middle attack obtaining the
              initial CA certificate. It may still be  useful  for  bootstrap‐
              ping.

       ssl_protocols: string
              List  of  SSL  protocols  to be enabled for SSL connections. The
              default when this option is omitted is TLSv1,TLSv1.1,TLSv1.2.

       ssl_ciphers: string
              List of ciphers (in OpenSSL cipher string  format)  to  be  sup‐
              ported  for  SSL  connections.  The  default when this option is
              omitted is HIGH:!aNULL:!MD5.

     Common Columns:

       The overall purpose of these columns is described under Common  Columns
       at the beginning of this document.

       external_ids: map of string-string pairs



Open vSwitch 21.03.90           DB Schema 1.0.0                   ovn-ic-sb(5)