diff --git a/src/static/support/dist-docs/ovn-appctl.8.pdf b/src/static/support/dist-docs/ovn-appctl.8.pdf index 0f45e976..20d13903 100644 Binary files a/src/static/support/dist-docs/ovn-appctl.8.pdf and b/src/static/support/dist-docs/ovn-appctl.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-architecture.7.pdf b/src/static/support/dist-docs/ovn-architecture.7.pdf index 36efcef8..e724508f 100644 Binary files a/src/static/support/dist-docs/ovn-architecture.7.pdf and b/src/static/support/dist-docs/ovn-architecture.7.pdf differ diff --git a/src/static/support/dist-docs/ovn-controller-vtep.8.pdf b/src/static/support/dist-docs/ovn-controller-vtep.8.pdf index 97d9036f..66f72e59 100644 Binary files a/src/static/support/dist-docs/ovn-controller-vtep.8.pdf and b/src/static/support/dist-docs/ovn-controller-vtep.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-controller.8.pdf b/src/static/support/dist-docs/ovn-controller.8.pdf index 62c2c548..d3f03981 100644 Binary files a/src/static/support/dist-docs/ovn-controller.8.pdf and b/src/static/support/dist-docs/ovn-controller.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-ctl.8.pdf b/src/static/support/dist-docs/ovn-ctl.8.pdf index 1e5a7c1e..f2147397 100644 Binary files a/src/static/support/dist-docs/ovn-ctl.8.pdf and b/src/static/support/dist-docs/ovn-ctl.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-detrace.1.pdf b/src/static/support/dist-docs/ovn-detrace.1.pdf index 19d81c55..6bd0644e 100644 Binary files a/src/static/support/dist-docs/ovn-detrace.1.pdf and b/src/static/support/dist-docs/ovn-detrace.1.pdf differ diff --git a/src/static/support/dist-docs/ovn-ic-nb.5.pdf b/src/static/support/dist-docs/ovn-ic-nb.5.pdf index cc3a00ba..b50ad3b1 100644 Binary files a/src/static/support/dist-docs/ovn-ic-nb.5.pdf and b/src/static/support/dist-docs/ovn-ic-nb.5.pdf differ diff --git a/src/static/support/dist-docs/ovn-ic-nbctl.8.pdf b/src/static/support/dist-docs/ovn-ic-nbctl.8.pdf index 4f11ba12..d32d7850 100644 Binary files a/src/static/support/dist-docs/ovn-ic-nbctl.8.pdf and b/src/static/support/dist-docs/ovn-ic-nbctl.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-ic-sb.5.pdf b/src/static/support/dist-docs/ovn-ic-sb.5.pdf index 6477cb7d..e7472cad 100644 Binary files a/src/static/support/dist-docs/ovn-ic-sb.5.pdf and b/src/static/support/dist-docs/ovn-ic-sb.5.pdf differ diff --git a/src/static/support/dist-docs/ovn-ic-sbctl.8.pdf b/src/static/support/dist-docs/ovn-ic-sbctl.8.pdf index 5ca653ef..d3b8c875 100644 Binary files a/src/static/support/dist-docs/ovn-ic-sbctl.8.pdf and b/src/static/support/dist-docs/ovn-ic-sbctl.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-ic.8.pdf b/src/static/support/dist-docs/ovn-ic.8.pdf index 53df4096..c5f6be92 100644 Binary files a/src/static/support/dist-docs/ovn-ic.8.pdf and b/src/static/support/dist-docs/ovn-ic.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-nb.5 b/src/static/support/dist-docs/ovn-nb.5 index a6b03f75..b96c123f 100644 --- a/src/static/support/dist-docs/ovn-nb.5 +++ b/src/static/support/dist-docs/ovn-nb.5 @@ -1088,6 +1088,9 @@ optional string .TQ 2.50in \fBoptions : hostname\fR optional string +.TQ 2.50in +\fBoptions : pkt_clone_type\fR +optional string, must be \fBmc_unknown\fR .TQ .25in \fIVIF Plugging Options:\fR .RS .25in @@ -1342,6 +1345,8 @@ If set, indicates the maximum rate for data sent from this interface, in bit/s\[ If set, indicates the maximum burst size for data sent from this interface, in bits\[char46] .IP "\fBoptions : hostname\fR: optional string" If set, indicates the DHCPv4 option \(dqHostname\(dq (option code 12) associated for this Logical Switch Port\[char46] If DHCPv4 is enabled for this Logical Switch Port, hostname dhcp option will be included in DHCP reply\[char46] +.IP "\fBoptions : pkt_clone_type\fR: optional string, must be \fBmc_unknown\fR" +If set to mc_unknown, packets going to this VIF get cloned to all unknown ports connected to the same Logical Switch\[char46] .ST "VIF Plugging Options:" .PP .IP "\fBoptions : vif-plug-type\fR: optional string" diff --git a/src/static/support/dist-docs/ovn-nb.5.html b/src/static/support/dist-docs/ovn-nb.5.html index 681f5924..c8100b95 100644 --- a/src/static/support/dist-docs/ovn-nb.5.html +++ b/src/static/support/dist-docs/ovn-nb.5.html @@ -915,6 +915,7 @@ options : qos_max_rate optional string options : qos_burst optional string options : hostname optional string + options : pkt_clone_type optional string, must be mc_unknown VIF Plugging Options: options : vif-plug-type optional string @@ -1236,22 +1237,26 @@ for this Logical Switch Port, hostname dhcp option will be in‐ cluded in DHCP reply. + options : pkt_clone_type: optional string, must be mc_unknown + If set to mc_unknown, packets going to this VIF get cloned to + all unknown ports connected to the same Logical Switch. + VIF Plugging Options: options : vif-plug-type: optional string If set, OVN will attempt to perform plugging of this VIF. In or‐ - der to get this port plugged by the OVN controller, OVN must be + der to get this port plugged by the OVN controller, OVN must be built with support for VIF plugging. The default behavior is for - the CMS to do the VIF plugging. Each VIF plug provider have + the CMS to do the VIF plugging. Each VIF plug provider have their own options namespaced by name, for example "vif-plug:rep‐ - resentor:key". Please refer to the VIF plug provider documenta‐ + resentor:key". Please refer to the VIF plug provider documenta‐ tion located in Documentation/topics/vif-plug-providers/ for more information. options : vif-plug-mtu-request: optional string - Requested MTU for plugged interfaces. When set the OVN con‐ - troller will fill the mtu_request column of the Open vSwitch - database’s Interface table. This in turn will make OVS vswitchd + Requested MTU for plugged interfaces. When set the OVN con‐ + troller will fill the mtu_request column of the Open vSwitch + database’s Interface table. This in turn will make OVS vswitchd update the MTU of the linked interface. Virtual port Options: @@ -1263,9 +1268,9 @@ options : virtual-parents: optional string This options represents a set of logical port names (with in the - same logical switch) which can own the virtual ip configured in + same logical switch) which can own the virtual ip configured in the options:virtual-ip. All these virtual parents should add the - virtual ip in the port_security if port security addressed are + virtual ip in the port_security if port security addressed are enabled. IP Multicast Snooping Options: @@ -1274,78 +1279,78 @@ other_config :mcast_snoop set to true. options : mcast_flood: optional string, either true or false - If set to true, multicast packets (except reports) are uncondi‐ + If set to true, multicast packets (except reports) are uncondi‐ tionally forwarded to the specific port. Default: false. options : mcast_flood_reports: optional string, either true or false - If set to true, multicast reports are unconditionally forwarded + If set to true, multicast reports are unconditionally forwarded to the specific port. Default: false. Containers: When a large number of containers are nested within a VM, it may be too expensive to dedicate a VIF to each container. OVN can use VLAN tags to - support such cases. Each container is assigned a VLAN ID and each + support such cases. Each container is assigned a VLAN ID and each packet that passes between the hypervisor and the VM is tagged with the appropriate ID for the container. Such VLAN IDs never appear on a phys‐ ical wire, even inside a tunnel, so they need not be unique except rel‐ ative to a single VM on a hypervisor. - These columns are used for VIFs that represent nested containers using - shared VIFs. For VMs and for containers that have dedicated VIFs, they + These columns are used for VIFs that represent nested containers using + shared VIFs. For VMs and for containers that have dedicated VIFs, they are empty. parent_name: optional string - The VM interface through which the nested container sends its - network traffic. This must match the name column for some other + The VM interface through which the nested container sends its + network traffic. This must match the name column for some other Logical_Switch_Port. Note: for performance of the OVN Southbound - database conditional monitoring, unlike for regular VIFs, + database conditional monitoring, unlike for regular VIFs, ovn-controller will register to get updates about all OVN South‐ - bound database Port_Binding table records that correspond to - nested container ports even if external_ids:ovn-monitor-all is + bound database Port_Binding table records that correspond to + nested container ports even if external_ids:ovn-monitor-all is set to false. See ovn-controller(8) for more information. tag_request: optional integer, in range 0 to 4,095 - The VLAN tag in the network traffic associated with a con‐ + The VLAN tag in the network traffic associated with a con‐ tainer’s network interface. The client can request ovn-northd to - allocate a tag that is unique within the scope of a specific - parent (specified in parent_name) by setting a value of 0 in + allocate a tag that is unique within the scope of a specific + parent (specified in parent_name) by setting a value of 0 in this column. The allocated value is written by ovn-northd in the - tag column. (Note that these tags are allocated and managed lo‐ - cally in ovn-northd, so they cannot be reconstructed in the - event that the database is lost.) The client can also request a + tag column. (Note that these tags are allocated and managed lo‐ + cally in ovn-northd, so they cannot be reconstructed in the + event that the database is lost.) The client can also request a specific non-zero tag and ovn-northd will honor it and copy that value to the tag column. - When type is set to localnet or l2gateway, this can be set to - indicate that the port represents a connection to a specific - VLAN on a locally accessible network. The VLAN ID is used to + When type is set to localnet or l2gateway, this can be set to + indicate that the port represents a connection to a specific + VLAN on a locally accessible network. The VLAN ID is used to match incoming traffic and is also added to outgoing traffic. tag: optional integer, in range 1 to 4,095 - The VLAN tag allocated by ovn-northd based on the contents of + The VLAN tag allocated by ovn-northd based on the contents of the tag_request column. Port State: up: optional boolean - This column is populated by ovn-northd, rather than by the CMS + This column is populated by ovn-northd, rather than by the CMS plugin as is most of this database. When a logical port is bound - to a physical location in the OVN Southbound database Binding + to a physical location in the OVN Southbound database Binding table, ovn-northd sets this column to true; otherwise, or if the - port becomes unbound later, it sets it to false. If this column - is empty, the port is not considered up. This allows the CMS to + port becomes unbound later, it sets it to false. If this column + is empty, the port is not considered up. This allows the CMS to wait for a VM’s (or container’s) networking to become active be‐ fore it allows the VM (or container) to start. Logical ports of router type are an exception to this rule. They - are considered to be always up, that is this column is always + are considered to be always up, that is this column is always set to true. enabled: optional boolean - This column is used to administratively set port state. If this - column is empty or is set to true, the port is enabled. If this - column is set to false, the port is disabled. A disabled port + This column is used to administratively set port state. If this + column is empty or is set to true, the port is enabled. If this + column is set to false, the port is disabled. A disabled port has all ingress and egress traffic dropped. Addressing: @@ -1358,164 +1363,164 @@ Ethernet address followed by zero or more IPv4 or IPv6 addresses (or both) An Ethernet address defined is owned by the logical port. - Like a physical Ethernet NIC, a logical port ordinarily + Like a physical Ethernet NIC, a logical port ordinarily has a single fixed Ethernet address. - When a OVN logical switch processes a unicast Ethernet - frame whose destination MAC address is in a logical - port’s addresses column, it delivers it only to that - port, as if a MAC learning process had learned that MAC + When a OVN logical switch processes a unicast Ethernet + frame whose destination MAC address is in a logical + port’s addresses column, it delivers it only to that + port, as if a MAC learning process had learned that MAC address on the port. If IPv4 or IPv6 address(es) (or both) are defined, it in‐ - dicates that the logical port owns the given IP ad‐ + dicates that the logical port owns the given IP ad‐ dresses. - If IPv4 address(es) are defined, the OVN logical switch - uses this information to synthesize responses to ARP re‐ - quests without traversing the physical network. The OVN - logical router connected to the logical switch, if any, - uses this information to avoid issuing ARP requests for + If IPv4 address(es) are defined, the OVN logical switch + uses this information to synthesize responses to ARP re‐ + quests without traversing the physical network. The OVN + logical router connected to the logical switch, if any, + uses this information to avoid issuing ARP requests for logical switch ports. - Note that the order here is important. The Ethernet ad‐ - dress must be listed before the IP address(es) if de‐ + Note that the order here is important. The Ethernet ad‐ + dress must be listed before the IP address(es) if de‐ fined. Examples: 80:fa:5b:06:72:b7 - This indicates that the logical port owns the + This indicates that the logical port owns the above mac address. 80:fa:5b:06:72:b7 10.0.0.4 20.0.0.4 - This indicates that the logical port owns the mac + This indicates that the logical port owns the mac address and two IPv4 addresses. 80:fa:5b:06:72:b7 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41 - This indicates that the logical port owns the mac + This indicates that the logical port owns the mac address and 1 IPv6 address. 80:fa:5b:06:72:b7 10.0.0.4 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41 - This indicates that the logical port owns the mac + This indicates that the logical port owns the mac address and 1 IPv4 address and 1 IPv6 address. unknown - This indicates that the logical port has an unknown set - of Ethernet addresses. When an OVN logical switch - processes a unicast Ethernet frame whose destination MAC + This indicates that the logical port has an unknown set + of Ethernet addresses. When an OVN logical switch + processes a unicast Ethernet frame whose destination MAC address is not in any logical port’s addresses column, it - delivers it to the port (or ports) whose addresses + delivers it to the port (or ports) whose addresses columns include unknown. dynamic Use dynamic to make ovn-northd generate a globally unique MAC address, choose an unused IPv4 address with the logi‐ - cal port’s subnet (if other_config:subnet is set in the + cal port’s subnet (if other_config:subnet is set in the port’s Logical_Switch), and generate an IPv6 address from - the MAC address (if other_config:ipv6_prefix is set in - the port’s Logical_Switch) and store them in the port’s + the MAC address (if other_config:ipv6_prefix is set in + the port’s Logical_Switch) and store them in the port’s dynamic_addresses column. - Only one element containing dynamic may appear in ad‐‐ + Only one element containing dynamic may appear in ad‐‐ dresses. dynamic ip dynamic ipv6 dynamic ip ipv6 These act like dynamic alone but specify particular IPv4 or - IPv6 addresses to use. OVN IPAM will still automatically + IPv6 addresses to use. OVN IPAM will still automatically allocate the other address if configured appropriately. Ex‐ ample: dynamic 192.168.0.1 2001::1. mac dynamic This acts like dynamic alone but specifies a particular MAC - address to use. OVN IPAM will still automatically allocate - IPv4 or IPv6 addresses, or both, if configured appropri‐ + address to use. OVN IPAM will still automatically allocate + IPv4 or IPv6 addresses, or both, if configured appropri‐ ately. Example: 80:fa:5b:06:72:b7 dynamic router - Accepted only when type is router. This indicates that the - Ethernet, IPv4, and IPv6 addresses for this logical switch - port should be obtained from the connected logical router + Accepted only when type is router. This indicates that the + Ethernet, IPv4, and IPv6 addresses for this logical switch + port should be obtained from the connected logical router port, as specified by router-port in options. - The resulting addresses are used to populate the logical - switch’s destination lookup, and also for the logical + The resulting addresses are used to populate the logical + switch’s destination lookup, and also for the logical switch to generate ARP and ND replies. - If the connected logical router port has a distributed - gateway port specified and the logical router has rules - specified in nat with external_mac, then those addresses + If the connected logical router port has a distributed + gateway port specified and the logical router has rules + specified in nat with external_mac, then those addresses are also used to populate the switch’s destination lookup. - Supported only in OVN 2.7 and later. Earlier versions re‐ + Supported only in OVN 2.7 and later. Earlier versions re‐ quired router addresses to be manually synchronized. dynamic_addresses: optional string Addresses assigned to the logical port by ovn-northd, if dynamic - is specified in addresses. Addresses will be of the same format - as those that populate the addresses column. Note that dynami‐ - cally assigned addresses are constructed and managed locally in - ovn-northd, so they cannot be reconstructed in the event that + is specified in addresses. Addresses will be of the same format + as those that populate the addresses column. Note that dynami‐ + cally assigned addresses are constructed and managed locally in + ovn-northd, so they cannot be reconstructed in the event that the database is lost. port_security: set of strings - This column controls the addresses from which the host attached - to the logical port (``the host’’) is allowed to send packets + This column controls the addresses from which the host attached + to the logical port (``the host’’) is allowed to send packets and to which it is allowed to receive packets. If this column is empty, all addresses are permitted. - Each element in the set must begin with one Ethernet address. + Each element in the set must begin with one Ethernet address. This would restrict the host to sending packets from and receiv‐ - ing packets to the ethernet addresses defined in the logical - port’s port_security column. It also restricts the inner source - MAC addresses that the host may send in ARP and IPv6 Neighbor + ing packets to the ethernet addresses defined in the logical + port’s port_security column. It also restricts the inner source + MAC addresses that the host may send in ARP and IPv6 Neighbor Discovery packets. The host is always allowed to receive packets to multicast and broadcast Ethernet addresses. - Each element in the set may additionally contain one or more + Each element in the set may additionally contain one or more IPv4 or IPv6 addresses (or both), with optional masks. If a mask - is given, it must be a CIDR mask. In addition to the restric‐ - tions described for Ethernet addresses above, such an element - restricts the IPv4 or IPv6 addresses from which the host may - send and to which it may receive packets to the specified ad‐ - dresses. A masked address, if the host part is zero, indicates - that the host is allowed to use any address in the subnet; if - the host part is nonzero, the mask simply indicates the size of + is given, it must be a CIDR mask. In addition to the restric‐ + tions described for Ethernet addresses above, such an element + restricts the IPv4 or IPv6 addresses from which the host may + send and to which it may receive packets to the specified ad‐ + dresses. A masked address, if the host part is zero, indicates + that the host is allowed to use any address in the subnet; if + the host part is nonzero, the mask simply indicates the size of the subnet. In addition: • If any IPv4 address is given, the host is also allowed to - receive packets to the IPv4 local broadcast address + receive packets to the IPv4 local broadcast address 255.255.255.255 and to IPv4 multicast addresses - (224.0.0.0/4). If an IPv4 address with a mask is given, + (224.0.0.0/4). If an IPv4 address with a mask is given, the host is also allowed to receive packets to the broad‐ cast address in that specified subnet. - If any IPv4 address is given, the host is additionally - restricted to sending ARP packets with the specified + If any IPv4 address is given, the host is additionally + restricted to sending ARP packets with the specified source IPv4 address. (RARP is not restricted.) • If any IPv6 address is given, the host is also allowed to receive packets to IPv6 multicast addresses (ff00::/8). - If any IPv6 address is given, the host is additionally - restricted to sending IPv6 Neighbor Discovery Solicita‐ - tion or Advertisement packets with the specified source + If any IPv6 address is given, the host is additionally + restricted to sending IPv6 Neighbor Discovery Solicita‐ + tion or Advertisement packets with the specified source address or, for solicitations, the unspecified address. - If an element includes an IPv4 address, but no IPv6 addresses, + If an element includes an IPv4 address, but no IPv6 addresses, then IPv6 traffic is not allowed. If an element includes an IPv6 - address, but no IPv4 address, then IPv4 and ARP traffic is not + address, but no IPv4 address, then IPv4 and ARP traffic is not allowed. - This column uses the same lexical syntax as the match column in + This column uses the same lexical syntax as the match column in the OVN Southbound database’s Pipeline table. Multiple addresses within an element may be space or comma separated. - This column is provided as a convenience to cloud management - systems, but all of the features that it implements can be im‐ + This column is provided as a convenience to cloud management + systems, but all of the features that it implements can be im‐ plemented as ACLs using the ACL table. Examples: @@ -1524,52 +1529,52 @@ The host may send traffic from and receive traffic to the specified MAC address, and to receive traffic to Ethernet multicast and broadcast addresses, but not otherwise. The - host may not send ARP or IPv6 Neighbor Discovery packets - with inner source Ethernet addresses other than the one + host may not send ARP or IPv6 Neighbor Discovery packets + with inner source Ethernet addresses other than the one specified. 80:fa:5b:06:72:b7 192.168.1.10/24 - This adds further restrictions to the first example. The - host may send IPv4 packets from or receive IPv4 packets - to only 192.168.1.10, except that it may also receive + This adds further restrictions to the first example. The + host may send IPv4 packets from or receive IPv4 packets + to only 192.168.1.10, except that it may also receive IPv4 packets to 192.168.1.255 (based on the subnet mask), 255.255.255.255, and any address in 224.0.0.0/4. The host - may not send ARPs with a source Ethernet address other - than 80:fa:5b:06:72:b7 or source IPv4 address other than - 192.168.1.10. The host may not send or receive any IPv6 + may not send ARPs with a source Ethernet address other + than 80:fa:5b:06:72:b7 or source IPv4 address other than + 192.168.1.10. The host may not send or receive any IPv6 (including IPv6 Neighbor Discovery) traffic. "80:fa:5b:12:42:ba", "80:fa:5b:06:72:b7 192.168.1.10/24" The host may send traffic from and receive traffic to the specified MAC addresses, and to receive traffic to Ether‐ net multicast and broadcast addresses, but not otherwise. - With MAC 80:fa:5b:12:42:ba, the host may send traffic - from and receive traffic to any L3 address. With MAC + With MAC 80:fa:5b:12:42:ba, the host may send traffic + from and receive traffic to any L3 address. With MAC 80:fa:5b:06:72:b7, the host may send IPv4 packets from or receive IPv4 packets to only 192.168.1.10, except that it - may also receive IPv4 packets to 192.168.1.255 (based on - the subnet mask), 255.255.255.255, and any address in - 224.0.0.0/4. The host may not send or receive any IPv6 + may also receive IPv4 packets to 192.168.1.255 (based on + the subnet mask), 255.255.255.255, and any address in + 224.0.0.0/4. The host may not send or receive any IPv6 (including IPv6 Neighbor Discovery) traffic. DHCP: dhcpv4_options: optional weak reference to DHCP_Options - This column defines the DHCPv4 Options to be included by the - ovn-controller when it replies to the DHCPv4 requests. Please + This column defines the DHCPv4 Options to be included by the + ovn-controller when it replies to the DHCPv4 requests. Please see the DHCP_Options table. dhcpv6_options: optional weak reference to DHCP_Options - This column defines the DHCPv6 Options to be included by the - ovn-controller when it replies to the DHCPv6 requests. Please + This column defines the DHCPv6 Options to be included by the + ovn-controller when it replies to the DHCPv6 requests. Please see the DHCP_Options table. mirror_rules: set of weak reference to Mirrors - Mirror rules that apply to logical switch port which is the + Mirror rules that apply to logical switch port which is the source. Please see the Mirror table. ha_chassis_group: optional HA_Chassis_Group - References a row in the OVN Northbound database’s HA_Chas‐‐ + References a row in the OVN Northbound database’s HA_Chas‐‐ sis_Group table. It indicates the HA chassis group to use if the type is set to external. If type is not external, this column is ignored. @@ -1577,12 +1582,12 @@ Naming: external_ids : neutron:port_name: optional string - This column gives an optional human-friendly name for the port. - This name has no special meaning or purpose other than to pro‐ + This column gives an optional human-friendly name for the port. + This name has no special meaning or purpose other than to pro‐ vide convenience for human interaction with the northbound data‐ base. - Neutron copies this from its own port object’s name. (Neutron + Neutron copies this from its own port object’s name. (Neutron ports do are not assigned human-friendly names by default, so it will often be empty.) @@ -1590,13 +1595,13 @@ options : requested-tnl-key: optional string, containing an integer, in range 1 to 32,767 - Configures the port binding tunnel key for the port. Usually - this is not needed because ovn-northd will assign an unique key - for each port by itself. However, if it is configured, - ovn-northd honors the configured value. The typical use case is - for interconnection: the tunnel keys for ports on transit - switches need to be unique globally, so they are maintained in - the global OVN_IC_Southbound database, and ovn-ic simply syncs + Configures the port binding tunnel key for the port. Usually + this is not needed because ovn-northd will assign an unique key + for each port by itself. However, if it is configured, + ovn-northd honors the configured value. The typical use case is + for interconnection: the tunnel keys for ports on transit + switches need to be unique globally, so they are maintained in + the global OVN_IC_Southbound database, and ovn-ic simply syncs the value from OVN_IC_Southbound through this config. Common Columns: @@ -1604,7 +1609,7 @@ external_ids: map of string-string pairs See External IDs at the beginning of this document. - The ovn-northd program copies all these pairs into the exter‐‐ + The ovn-northd program copies all these pairs into the exter‐‐ nal_ids column of the Port_Binding table in OVN_Southbound data‐ base. @@ -1622,8 +1627,8 @@ Details: name: string - A name for the forwarding group. This name has no special mean‐ - ing or purpose other than to provide convenience for human in‐ + A name for the forwarding group. This name has no special mean‐ + ing or purpose other than to provide convenience for human in‐ teraction with the ovn-nb database. vip: string @@ -1646,19 +1651,19 @@ See External IDs at the beginning of this document. Address_Set TABLE - Each row in this table represents a named set of addresses. An address + Each row in this table represents a named set of addresses. An address set may contain Ethernet, IPv4, or IPv6 addresses with optional bitwise - or CIDR masks. Address set may ultimately be used in ACLs to compare - against fields such as ip4.src or ip6.src. A single address set must - contain addresses of the same type. As an example, the following would + or CIDR masks. Address set may ultimately be used in ACLs to compare + against fields such as ip4.src or ip6.src. A single address set must + contain addresses of the same type. As an example, the following would create an address set with three IP addresses: ovn-nbctl create Address_Set name=set1 addresses=’’10.0.0.1 10.0.0.2 10.0.0.3’’ Address sets may be used in the match column of the ACL table. For syn‐ - tax information, see the details of the expression language used for - the match column in the Logical_Flow table of the OVN_Southbound data‐ + tax information, see the details of the expression language used for + the match column in the Logical_Flow table of the OVN_Southbound data‐ base. Summary: @@ -1669,7 +1674,7 @@ Details: name: string (must be unique within table) - A name for the address set. Names are ASCII and must match + A name for the address set. Names are ASCII and must match [a-zA-Z_.][a-zA-Z_.0-9]*. addresses: set of strings @@ -1681,27 +1686,27 @@ See External IDs at the beginning of this document. Port_Group TABLE - Each row in this table represents a named group of logical switch + Each row in this table represents a named group of logical switch ports. - Port groups may be used in the match column of the ACL table. For syn‐ - tax information, see the details of the expression language used for - the match column in the Logical_Flow table of the OVN_Southbound data‐ + Port groups may be used in the match column of the ACL table. For syn‐ + tax information, see the details of the expression language used for + the match column in the Logical_Flow table of the OVN_Southbound data‐ base. - For each port group, there are two address sets generated to the Ad‐‐ - dress_Set table of the OVN_Southbound database, containing the IP ad‐ - dresses of the group of ports, one for IPv4, and the other for IPv6, - with name being the name of the Port_Group followed by a suffix _ip4 - for IPv4 and _ip6 for IPv6. The generated address sets can be used in + For each port group, there are two address sets generated to the Ad‐‐ + dress_Set table of the OVN_Southbound database, containing the IP ad‐ + dresses of the group of ports, one for IPv4, and the other for IPv6, + with name being the name of the Port_Group followed by a suffix _ip4 + for IPv4 and _ip6 for IPv6. The generated address sets can be used in the same way as regular address sets in the match column of the ACL ta‐ ble. For syntax information, see the details of the expression language - used for the match column in the Logical_Flow table of the OVN_South‐‐ + used for the match column in the Logical_Flow table of the OVN_South‐‐ bound database. Summary: name string (must be unique within table) - ports set of weak reference to Logi‐‐ + ports set of weak reference to Logi‐‐ cal_Switch_Ports acls set of ACLs Common Columns: @@ -1709,16 +1714,16 @@ Details: name: string (must be unique within table) - A name for the port group. Names are ASCII and must match + A name for the port group. Names are ASCII and must match [a-zA-Z_.][a-zA-Z_.0-9]*. ports: set of weak reference to Logical_Switch_Ports The logical switch ports belonging to the group in uuids. acls: set of ACLs - Access control rules that apply to the port group. Applying an - ACL to a port group has the same effect as applying the ACL to - all logical lswitches that the ports of the port group belong + Access control rules that apply to the port group. Applying an + ACL to a port group has the same effect as applying the ACL to + all logical lswitches that the ports of the port group belong to. Common Columns: @@ -1736,7 +1741,7 @@ Health Checks: health_check set of Load_Balancer_Health_Checks ip_port_mappings map of string-string pairs - selection_fields set of strings, one of eth_dst, eth_src, + selection_fields set of strings, one of eth_dst, eth_src, ip_dst, ip_src, tp_dst, or tp_src Common Columns: external_ids map of string-string pairs @@ -1754,89 +1759,89 @@ Details: name: string - A name for the load balancer. This name has no special meaning - or purpose other than to provide convenience for human interac‐ + A name for the load balancer. This name has no special meaning + or purpose other than to provide convenience for human interac‐ tion with the ovn-nb database. vips: map of string-string pairs - A map of virtual IP addresses (and an optional port number with - : as a separator) associated with this load balancer and their - corresponding endpoint IP addresses (and optional port numbers + A map of virtual IP addresses (and an optional port number with + : as a separator) associated with this load balancer and their + corresponding endpoint IP addresses (and optional port numbers with : as separators) separated by commas. If the destination IP - address (and port number) of a packet leaving a container or a - VM matches the virtual IP address (and port number) provided - here as a key, then OVN will statefully replace the destination - IP address by one of the provided IP address (and port number) - in this map as a value. IPv4 and IPv6 addresses are supported - for load balancing; however a VIP of one address family may not - be mapped to a destination IP address of a different family. If + address (and port number) of a packet leaving a container or a + VM matches the virtual IP address (and port number) provided + here as a key, then OVN will statefully replace the destination + IP address by one of the provided IP address (and port number) + in this map as a value. IPv4 and IPv6 addresses are supported + for load balancing; however a VIP of one address family may not + be mapped to a destination IP address of a different family. If specifying an IPv6 address with a port, the address portion must - be enclosed in square brackets. Examples for keys are + be enclosed in square brackets. Examples for keys are "192.168.1.4" and "[fd0f::1]:8800". Examples for value are "10.0.0.1, 10.0.0.2" and "20.0.0.10:8800, 20.0.0.11:8800". - When the Load_Balancer is added to the logical_switch, the VIP - has to be in a different subnet than the one used for the logi‐‐ - cal_switch. Since VIP is in a different subnet, you should con‐ - nect your logical switch to either a OVN logical router or a - real router (this is because the client can now send a packet - with VIP as the destination IP address and router’s mac address + When the Load_Balancer is added to the logical_switch, the VIP + has to be in a different subnet than the one used for the logi‐‐ + cal_switch. Since VIP is in a different subnet, you should con‐ + nect your logical switch to either a OVN logical router or a + real router (this is because the client can now send a packet + with VIP as the destination IP address and router’s mac address as the destination MAC address). protocol: optional string, one of sctp, tcp, or udp - Valid protocols are tcp, udp, or sctp. This column is useful - when a port number is provided as part of the vips column. If - this column is empty and a port number is provided as part of + Valid protocols are tcp, udp, or sctp. This column is useful + when a port number is provided as part of the vips column. If + this column is empty and a port number is provided as part of vips column, OVN assumes the protocol to be tcp. Health Checks: - OVN supports health checks for load balancer endpoints. When health + OVN supports health checks for load balancer endpoints. When health checks are enabled, the load balancer uses only healthy endpoints. - Suppose that vips contains a key-value pair - 10.0.0.10:80=10.0.0.4:8080,20.0.0.4:8080. To enable health checks for - this virtual’s endpoints, add two key-value pairs to ip_port_mappings, + Suppose that vips contains a key-value pair + 10.0.0.10:80=10.0.0.4:8080,20.0.0.4:8080. To enable health checks for + this virtual’s endpoints, add two key-value pairs to ip_port_mappings, with keys 10.0.0.4 and 20.0.0.4, and add to health_check a reference to - a Load_Balancer_Health_Check row whose vip is set to 10.0.0.10. The + a Load_Balancer_Health_Check row whose vip is set to 10.0.0.10. The same approach can be used for IPv6 as well. health_check: set of Load_Balancer_Health_Checks Load balancer health checks associated with this load balancer. ip_port_mappings: map of string-string pairs - Maps from endpoint IP to a colon-separated pair of logical port - name and source IP, e.g. port_name:sourc_ip for IPv4. Health - checks are sent to this port with the specified source IP. For - IPv6 square brackets must be used around IP address, e.g: + Maps from endpoint IP to a colon-separated pair of logical port + name and source IP, e.g. port_name:sourc_ip for IPv4. Health + checks are sent to this port with the specified source IP. For + IPv6 square brackets must be used around IP address, e.g: port_name:[sourc_ip] - For example, in the example above, IP to port mappings might be - defined as 10.0.0.4=sw0-p1:10.0.0.2 and - 20.0.0.4=sw1-p1:20.0.0.2, if the values given were suitable + For example, in the example above, IP to port mappings might be + defined as 10.0.0.4=sw0-p1:10.0.0.2 and + 20.0.0.4=sw1-p1:20.0.0.2, if the values given were suitable ports and IP addresses. - For IPv6 IP to port mappings might be defined as + For IPv6 IP to port mappings might be defined as [2001::1]=sw0-p1:[2002::1]. selection_fields: set of strings, one of eth_dst, eth_src, ip_dst, ip_src, tp_dst, or tp_src - OVN native load balancers are supported using the OpenFlow - groups of type select. OVS supports two selection methods: - dp_hash and hash (with optional fields specified) in selecting - the buckets of a group. Please see the OVS documentation (man - ovs-ofctl) for more details on the selection methods. Each end‐ - point IP (and port if set) is mapped to a bucket in the group + OVN native load balancers are supported using the OpenFlow + groups of type select. OVS supports two selection methods: + dp_hash and hash (with optional fields specified) in selecting + the buckets of a group. Please see the OVS documentation (man + ovs-ofctl) for more details on the selection methods. Each end‐ + point IP (and port if set) is mapped to a bucket in the group flow. - CMS can choose the hash selection method by setting the selec‐ - tion fields in this column. ovs-vswitchd uses the specified + CMS can choose the hash selection method by setting the selec‐ + tion fields in this column. ovs-vswitchd uses the specified fields in generating the hash. dp_hash selection method uses the assistance of datapath to cal‐ culate the hash and it is expected to be faster than hash selec‐ - tion method. So CMS should take this into consideration before - using the hash method. Please consult the OVS documentation and + tion method. So CMS should take this into consideration before + using the hash method. Please consult the OVS documentation and OVS sources for the implementation details. Common Columns: @@ -1847,53 +1852,53 @@ Load_Balancer options: options : reject: optional string, either true or false - If the load balancer is created with --reject option and it has - no active backends, a TCP reset segment (for tcp) or an ICMP - port unreachable packet (for all other kind of traffic) will be - sent whenever an incoming packet is received for this load-bal‐ - ancer. Please note using --reject option will disable empty_lb + If the load balancer is created with --reject option and it has + no active backends, a TCP reset segment (for tcp) or an ICMP + port unreachable packet (for all other kind of traffic) will be + sent whenever an incoming packet is received for this load-bal‐ + ancer. Please note using --reject option will disable empty_lb SB controller event for this load balancer. options : hairpin_snat_ip: optional string - IP to be used as source IP for packets that have been hair- - pinned after load balancing. The default behavior when the op‐ - tion is not set is to use the load balancer VIP as source IP. + IP to be used as source IP for packets that have been hair- + pinned after load balancing. The default behavior when the op‐ + tion is not set is to use the load balancer VIP as source IP. This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a space character. options : skip_snat: optional string - If the load balancing rule is configured with skip_snat option, - the option lb_force_snat_ip configured for the logical router - that references this load balancer will not be applied for this + If the load balancing rule is configured with skip_snat option, + the option lb_force_snat_ip configured for the logical router + that references this load balancer will not be applied for this load balancer. options : add_route: optional string - If set to true, then neighbor routers will have logical flows - added that will allow for routing to the VIP IP. It also will + If set to true, then neighbor routers will have logical flows + added that will allow for routing to the VIP IP. It also will have ARP resolution logical flows added. By setting this option, - it means there is no reason to create a Logical_Router_Sta‐‐ - tic_Route from neighbor routers to this NAT address. It also - means that no ARP request is required for neighbor routers to - learn the IP-MAC mapping for this VIP IP. For more information - about what flows are added for IP routes, please see the + it means there is no reason to create a Logical_Router_Sta‐‐ + tic_Route from neighbor routers to this NAT address. It also + means that no ARP request is required for neighbor routers to + learn the IP-MAC mapping for this VIP IP. For more information + about what flows are added for IP routes, please see the ovn-northd manpage section on IP Routing. options : neighbor_responder: optional string - If set to all, then routers on which the load balancer is ap‐ - plied reply to ARP/neighbor discovery requests for all VIPs of - the load balancer. If set to reachable, then routers on which + If set to all, then routers on which the load balancer is ap‐ + plied reply to ARP/neighbor discovery requests for all VIPs of + the load balancer. If set to reachable, then routers on which the load balancer is applied reply to ARP/neighbor discovery re‐ - quests only for VIPs that are part of a router’s subnet. If set - to none, then routers on which the load balancer is applied - never reply to ARP/neighbor discovery requests for any of the + quests only for VIPs that are part of a router’s subnet. If set + to none, then routers on which the load balancer is applied + never reply to ARP/neighbor discovery requests for any of the load balancer VIPs. Load balancers with options:template=true do not support reachable as a valid mode. The default value of this - option, if not specified, is reachable for regular load bal‐ + option, if not specified, is reachable for regular load bal‐ ancers and none for template load balancers. options : template: optional string - Option to be set to true, if the load balancer is a template. - The load balancer VIPs and backends must be using Chassis_Tem‐‐ + Option to be set to true, if the load balancer is a template. + The load balancer VIPs and backends must be using Chassis_Tem‐‐ plate_Var in their definitions. Load balancer template VIP supported formats are: @@ -1901,7 +1906,7 @@ ^VIP_VAR[:^PORT_VAR|:port] - where VIP_VAR and PORT_VAR are keys of the Chassis_Template_Var + where VIP_VAR and PORT_VAR are keys of the Chassis_Template_Var variables records. Note: The VIP and PORT cannot be combined into a single template @@ -1915,34 +1920,34 @@ ^BACKENDS_VAR1,^BACKENDS_VAR2 - where BACKEND_VAR1, PORT_VAR1, BACKEND_VAR2, PORT_VAR2, BACK‐‐ + where BACKEND_VAR1, PORT_VAR1, BACKEND_VAR2, PORT_VAR2, BACK‐‐ ENDS_VAR1 and BACKENDS_VAR2 are keys of the Chassis_Template_Var variables records. options : address-family: optional string - Address family used by the load balancer. Supported values are - ipv4 and ipv6. The address-family is only used for load bal‐ - ancers with options:template=true. For explicit load balancers, + Address family used by the load balancer. Supported values are + ipv4 and ipv6. The address-family is only used for load bal‐ + ancers with options:template=true. For explicit load balancers, setting the address-family has no effect. options : affinity_timeout: optional string - If the CMS provides a positive value (in seconds) for affin‐‐ - ity_timeout, OVN will dnat connections received from the same - client to this lb to the same backend if received in the affin‐ + If the CMS provides a positive value (in seconds) for affin‐‐ + ity_timeout, OVN will dnat connections received from the same + client to this lb to the same backend if received in the affin‐ ity timeslot. Max supported affinity_timeout is 65535 seconds. options : ct_flush: optional string, either true or false - The value indicates whether ovn-controller should flush CT en‐ - tries that are related to this LB. The flush happens if the LB - is removed, any of the backends is updated/removed or the LB is - not considered local anymore by the ovn-controller. This option + The value indicates whether ovn-controller should flush CT en‐ + tries that are related to this LB. The flush happens if the LB + is removed, any of the backends is updated/removed or the LB is + not considered local anymore by the ovn-controller. This option is set to false by default. Load_Balancer_Group TABLE - Each row represents a logical grouping of load balancers. It is up to - the CMS to decide the criteria on which load balancers are grouped to‐ - gether. To simplify configuration and to optimize its processing load - balancers that must be associated to the same set of logical switches + Each row represents a logical grouping of load balancers. It is up to + the CMS to decide the criteria on which load balancers are grouped to‐ + gether. To simplify configuration and to optimize its processing load + balancers that must be associated to the same set of logical switches and/or logical routers should be grouped together. Summary: @@ -1951,8 +1956,8 @@ Details: name: string (must be unique within table) - A name for the load balancer group. This name has no special - meaning or purpose other than to provide convenience for human + A name for the load balancer group. This name has no special + meaning or purpose other than to provide convenience for human interaction with the ovn-nb database. load_balancer: set of weak reference to Load_Balancers @@ -1997,11 +2002,11 @@ See External IDs at the beginning of this document. ACL TABLE - Each row in this table represents one ACL rule for a logical switch or + Each row in this table represents one ACL rule for a logical switch or a port group that points to it through its acls column. The action col‐ - umn for the highest-priority matching row in this table determines a - packet’s treatment. If no row matches, packets are allowed by default. - (Default-deny treatment is possible: add a rule with priority 0, 1 as + umn for the highest-priority matching row in this table determines a + packet’s treatment. If no row matches, packets are allowed by default. + (Default-deny treatment is possible: add a rule with priority 0, 1 as match, and deny as action.) Summary: @@ -2010,16 +2015,16 @@ direction string, either from-lport or to-lport match string action string, one of allow-related, al‐‐ - low-stateless, allow, drop, pass, or re‐‐ + low-stateless, allow, drop, pass, or re‐‐ ject tier integer, in range 0 to 3 options: options : apply-after-lb optional string Logging: log boolean - name optional string, at most 63 characters + name optional string, at most 63 characters long - severity optional string, one of alert, debug, + severity optional string, one of alert, debug, info, notice, or warning meter optional string Common Columns: @@ -2030,26 +2035,26 @@ Details: label: integer, in range 0 to 4,294,967,295 - Associates an identifier with the ACL. The same value will be - written to corresponding connection tracker entry. The value - should be a valid 32-bit unsigned integer. This value can help - in debugging from connection tracker side. For example, through + Associates an identifier with the ACL. The same value will be + written to corresponding connection tracker entry. The value + should be a valid 32-bit unsigned integer. This value can help + in debugging from connection tracker side. For example, through this "label" we can backtrack to the ACL rule which is causing a "leaked" connection. Connection tracker entries are created only for allowed connections so the label is valid only for allow and allow-related actions. priority: integer, in range 0 to 32,767 - The ACL rule’s priority. Rules with numerically higher priority + The ACL rule’s priority. Rules with numerically higher priority take precedence over those with lower. If two ACL rules with the - same priority both match, then the one actually applied to a + same priority both match, then the one actually applied to a packet is undefined. - Return traffic from an allow-related flow is always allowed and + Return traffic from an allow-related flow is always allowed and cannot be changed through an ACL. - allow-stateless flows always take precedence before stateful - ACLs, regardless of their priority. (Both allow and allow-re‐‐ + allow-stateless flows always take precedence before stateful + ACLs, regardless of their priority. (Both allow and allow-re‐‐ lated ACLs can be stateful.) direction: string, either from-lport or to-lport @@ -2059,74 +2064,74 @@ from a logical port. These rules are applied to the logi‐ cal switch’s ingress pipeline. - • to-lport: Used to implement filters on traffic forwarded + • to-lport: Used to implement filters on traffic forwarded to a logical port. These rules are applied to the logical switch’s egress pipeline. match: string - The packets that the ACL should match, in the same expression - language used for the match column in the OVN Southbound data‐ - base’s Logical_Flow table. The outport logical port is only - available in the to-lport direction (the inport is available in + The packets that the ACL should match, in the same expression + language used for the match column in the OVN Southbound data‐ + base’s Logical_Flow table. The outport logical port is only + available in the to-lport direction (the inport is available in both directions). - By default all traffic is allowed. When writing a more restric‐ - tive policy, it is important to remember to allow flows such as + By default all traffic is allowed. When writing a more restric‐ + tive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets. - Note that you can not create an ACL matching on a port with + Note that you can not create an ACL matching on a port with type=router or type=localnet. action: string, one of allow-related, allow-stateless, allow, drop, pass, or reject The action to take when the ACL rule matches: - • allow-stateless: Always forward the packet in stateless - manner, omitting connection tracking mechanism, regard‐ - less of other rules defined for the switch. May require - defining additional rules for inbound replies. For exam‐ - ple, if you define a rule to allow outgoing TCP traffic + • allow-stateless: Always forward the packet in stateless + manner, omitting connection tracking mechanism, regard‐ + less of other rules defined for the switch. May require + defining additional rules for inbound replies. For exam‐ + ple, if you define a rule to allow outgoing TCP traffic directed to an IP address, then you probably also want to - define another rule to allow incoming TCP traffic coming - from this same IP address. In addition, traffic that + define another rule to allow incoming TCP traffic coming + from this same IP address. In addition, traffic that matches stateless ACLs will bypass load-balancer DNAT/un- - DNAT processing. Stateful ACLs should be used instead if + DNAT processing. Stateful ACLs should be used instead if the traffic is supposed to be load-balanced. - • allow: Forward the packet. It will also send the packets - through connection tracking when allow-related rules ex‐ - ist on the logical switch. Otherwise, it’s equivalent to + • allow: Forward the packet. It will also send the packets + through connection tracking when allow-related rules ex‐ + ist on the logical switch. Otherwise, it’s equivalent to allow-stateless. - • allow-related: Forward the packet and related traffic + • allow-related: Forward the packet and related traffic (e.g. inbound replies to an outbound connection). • drop: Silently drop the packet. - • reject: Drop the packet, replying with a RST for TCP or - ICMPv4/ICMPv6 unreachable message for other + • reject: Drop the packet, replying with a RST for TCP or + ICMPv4/ICMPv6 unreachable message for other IPv4/IPv6-based protocols. - • pass: Pass to the next ACL tier. If using multiple ACL - tiers, a match on this ACL will stop evaluating ACLs at - the current tier and move to the next one. If not using - ACL tiers or if a pass ACL is matched at the final tier, - then the options:default_acl_drop option from the + • pass: Pass to the next ACL tier. If using multiple ACL + tiers, a match on this ACL will stop evaluating ACLs at + the current tier and move to the next one. If not using + ACL tiers or if a pass ACL is matched at the final tier, + then the options:default_acl_drop option from the NB_Global table is used to determine how to proceed. tier: integer, in range 0 to 3 The hierarchical tier that this ACL belongs to. - ACLs can be assigned to numerical tiers. When evaluating ACLs, - an internal counter is used to determine which tier of ACLs + ACLs can be assigned to numerical tiers. When evaluating ACLs, + an internal counter is used to determine which tier of ACLs should be evaluated. Tier 0 ACLs are evaluated first. If no ver‐ - dict can be determined, then tier 1 ACLs are evaluated next. - This continues until the maximum tier value is reached. If all - tiers of ACLs are evaluated and no verdict is reached, then the - options:default_acl_drop option from table NB_Global is used to + dict can be determined, then tier 1 ACLs are evaluated next. + This continues until the maximum tier value is reached. If all + tiers of ACLs are evaluated and no verdict is reached, then the + options:default_acl_drop option from table NB_Global is used to determine how to proceed. - In this version of OVN, the maximum tier value for ACLs is 3, + In this version of OVN, the maximum tier value for ACLs is 3, meaning there are 4 tiers of ACLs allowed (0-3). options: @@ -2134,70 +2139,70 @@ ACLs options. options : apply-after-lb: optional string - If set to true, the ACL will be applied after load balancing + If set to true, the ACL will be applied after load balancing stage. Supported only for from-lport direction. - The main use case of this option is to support ACLs matching on - the destination IP address of the packet for the backend IPs of + The main use case of this option is to support ACLs matching on + the destination IP address of the packet for the backend IPs of load balancers. - OVN will apply the from-lport ACLs in two stages. ACLs without - this option apply-after-lb set, will be applied before the load + OVN will apply the from-lport ACLs in two stages. ACLs without + this option apply-after-lb set, will be applied before the load balancer stage and ACLs with this option set will be applied af‐ - ter the load balancer stage. The priorities are indepedent be‐ - tween these stages and may not be obvious to the CMS. Hence CMS - should be extra careful when using this option and should care‐ - fully evaluate the priorities of all the ACLs and the default + ter the load balancer stage. The priorities are indepedent be‐ + tween these stages and may not be obvious to the CMS. Hence CMS + should be extra careful when using this option and should care‐ + fully evaluate the priorities of all the ACLs and the default deny/allow ACLs if any. Logging: - These columns control whether and how OVN logs packets that match an + These columns control whether and how OVN logs packets that match an ACL. log: boolean - If set to true, packets that match the ACL will trigger a log + If set to true, packets that match the ACL will trigger a log message on the transport node or nodes that perform ACL process‐ ing. Logging may be combined with any action. - If set to false, the remaining columns in this group have no + If set to false, the remaining columns in this group have no significance. name: optional string, at most 63 characters long - This name, if it is provided, is included in log records. It + This name, if it is provided, is included in log records. It provides the administrator and the cloud management system a way to associate a log record with a particular ACL. severity: optional string, one of alert, debug, info, notice, or warn‐‐ ing The severity of the ACL. The severity levels match those of sys‐ - log, in decreasing level of severity: alert, warning, notice, + log, in decreasing level of severity: alert, warning, notice, info, or debug. When the column is empty, the default is info. meter: optional string - The name of a meter to rate-limit log messages for the ACL. The - string must match the name column of a row in the Meter table. - By default, log messages are not rate-limited. In order to en‐ - sure that the same Meter rate limits multiple ACL logs sepa‐ + The name of a meter to rate-limit log messages for the ACL. The + string must match the name column of a row in the Meter table. + By default, log messages are not rate-limited. In order to en‐ + sure that the same Meter rate limits multiple ACL logs sepa‐ rately, set the fair column. Common Columns: options: map of string-string pairs - This column provides general key/value settings. The supported + This column provides general key/value settings. The supported options are described individually below. ACL configuration options: options : log-related: optional string If set to true, then log when reply or related traffic is admit‐ - ted from a stateful ACL. In order for this option to function, - the log option must be set to true and a label must be set, and - it must be unique to the ACL. The label is necessary as it is - the only means to associate the reply traffic with the ACL to + ted from a stateful ACL. In order for this option to function, + the log option must be set to true and a label must be set, and + it must be unique to the ACL. The label is necessary as it is + the only means to associate the reply traffic with the ACL to which it belongs. It must be unique, because otherwise it is am‐ - biguous which ACL will be matched. Note: If this option is en‐ - abled, an extra flow is installed in order to log the related + biguous which ACL will be matched. Note: If this option is en‐ + abled, an extra flow is installed in order to log the related traffic. Therefore, if this is enabled on all ACLs, then the to‐ tal number of flows necessary to log the ACL traffic is doubled, compared to if this option is not enabled. @@ -2232,9 +2237,9 @@ options : always_learn_from_arp_request optional string, either true or false options : requested-tnl-key - optional string, containing an integer, + optional string, containing an integer, in range 1 to 16,777,215 - options : snat-ct-zone optional string, containing an integer, + options : snat-ct-zone optional string, containing an integer, in range 0 to 65,535 options : mac_binding_age_threshold optional string @@ -2252,18 +2257,18 @@ Zero or more routing policies for the router. enabled: optional boolean - This column is used to administratively set router state. If - this column is empty or is set to true, the router is enabled. - If this column is set to false, the router is disabled. A dis‐ + This column is used to administratively set router state. If + this column is empty or is set to true, the router is enabled. + If this column is set to false, the router is disabled. A dis‐ abled router has all ingress and egress traffic dropped. nat: set of NATs - One or more NAT rules for the router. NAT rules only work on - Gateway routers, and on distributed routers with one and only + One or more NAT rules for the router. NAT rules only work on + Gateway routers, and on distributed routers with one and only one distributed gateway port. load_balancer: set of weak reference to Load_Balancers - Set of load balancers associated to this logical router. Load + Set of load balancers associated to this logical router. Load balancer Load balancer rules only work on the Gateway routers or routers with one and only one distributed gateway port. @@ -2274,14 +2279,14 @@ These columns provide names for the logical router. From OVN’s perspec‐ tive, these names have no special meaning or purpose other than to pro‐ - vide convenience for human interaction with the northbound database. - There is no requirement for the name to be unique. (For a unique iden‐ + vide convenience for human interaction with the northbound database. + There is no requirement for the name to be unique. (For a unique iden‐ tifier for a logical router, use its row UUID.) (Originally, name was intended to serve the purpose of a human-friendly - name, but the Neutron integration used it to uniquely identify its own - router object, in the format neutron-uuid. Later on, Neutron started - propagating the friendly name of a router as external_ids:neu‐‐ + name, but the Neutron integration used it to uniquely identify its own + router object, in the format neutron-uuid. Later on, Neutron started + propagating the friendly name of a router as external_ids:neu‐‐ tron:router_name. Perhaps this can be cleaned up someday.) name: string @@ -2301,25 +2306,25 @@ options : chassis: optional string If set, indicates that the logical router in question is a Gate‐ - way router (which is centralized) and resides in the set chas‐ - sis. The same value is also used by ovn-controller to uniquely + way router (which is centralized) and resides in the set chas‐ + sis. The same value is also used by ovn-controller to uniquely identify the chassis in the OVN deployment and comes from exter‐‐ - nal_ids:system-id in the Open_vSwitch table of Open_vSwitch + nal_ids:system-id in the Open_vSwitch table of Open_vSwitch database. The Gateway router can only be connected to a distributed router - via a switch if SNAT and DNAT are to be configured in the Gate‐ + via a switch if SNAT and DNAT are to be configured in the Gate‐ way router. options : dnat_force_snat_ip: optional string - If set, indicates a set of IP addresses to use to force SNAT a - packet that has already been DNATed in the gateway router. When - multiple gateway routers are configured, a packet can poten‐ - tially enter any of the gateway router, get DNATted and eventu‐ + If set, indicates a set of IP addresses to use to force SNAT a + packet that has already been DNATed in the gateway router. When + multiple gateway routers are configured, a packet can poten‐ + tially enter any of the gateway router, get DNATted and eventu‐ ally reach the logical switch port. For the return traffic to go - back to the same gateway router (for unDNATing), the packet + back to the same gateway router (for unDNATing), the packet needs a SNAT in the first place. This can be achieved by setting - the above option with a gateway specific set of IP addresses. + the above option with a gateway specific set of IP addresses. This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a a space. @@ -2327,113 +2332,113 @@ If set, this option can take two possible type of values. Either a set of IP addresses or the string value - router_ip. - If a set of IP addresses are configured, it indicates to use to - force SNAT a packet that has already been load-balanced in the - gateway router. When multiple gateway routers are configured, a - packet can potentially enter any of the gateway routers, get - DNATted as part of the load-balancing and eventually reach the - logical switch port. For the return traffic to go back to the - same gateway router (for unDNATing), the packet needs a SNAT in - the first place. This can be achieved by setting the above op‐ - tion with a gateway specific set of IP addresses. This option - may have exactly one IPv4 and/or one IPv6 address on it, sepa‐ + If a set of IP addresses are configured, it indicates to use to + force SNAT a packet that has already been load-balanced in the + gateway router. When multiple gateway routers are configured, a + packet can potentially enter any of the gateway routers, get + DNATted as part of the load-balancing and eventually reach the + logical switch port. For the return traffic to go back to the + same gateway router (for unDNATing), the packet needs a SNAT in + the first place. This can be achieved by setting the above op‐ + tion with a gateway specific set of IP addresses. This option + may have exactly one IPv4 and/or one IPv6 address on it, sepa‐ rated by a space character. If it is configured with the value router_ip, then the load bal‐ - anced packet is SNATed with the IP of router port (attached to + anced packet is SNATed with the IP of router port (attached to the gateway router) selected as the destination after taking the routing decision. options : mcast_relay: optional string, either true or false - Enables/disables IP multicast relay between logical switches + Enables/disables IP multicast relay between logical switches connected to the logical router. Default: False. options : dynamic_neigh_routers: optional string, either true or false - If set to true, the router will resolve neighbor routers’ MAC - addresses only by dynamic ARP/ND, instead of prepopulating sta‐ - tic mappings for all neighbor routers in the ARP/ND Resolution - stage. This reduces number of flows, but requires ARP/ND mes‐ + If set to true, the router will resolve neighbor routers’ MAC + addresses only by dynamic ARP/ND, instead of prepopulating sta‐ + tic mappings for all neighbor routers in the ARP/ND Resolution + stage. This reduces number of flows, but requires ARP/ND mes‐ sages to resolve the IP-MAC bindings when needed. It is false by default. It is recommended to set to true when a large number of - logical routers are connected to the same logical switch but - most of them never need to send traffic between each other. By - default, ovn-northd does not create mappings to NAT and load + logical routers are connected to the same logical switch but + most of them never need to send traffic between each other. By + default, ovn-northd does not create mappings to NAT and load balancer addresess. However, for NAT and load balancer addresses - that have the add_route option added, ovn-northd will create + that have the add_route option added, ovn-northd will create logical flows that map NAT and load balancer IP addresses to the - appropriate MAC address. Setting dynamic_neigh_routers to true + appropriate MAC address. Setting dynamic_neigh_routers to true will prevent the automatic creation of these logical flows. options : always_learn_from_arp_request: optional string, either true or false - This option controls the behavior when handling IPv4 ARP re‐ - quests or IPv6 ND-NS packets - whether a dynamic neighbor (MAC + This option controls the behavior when handling IPv4 ARP re‐ + quests or IPv6 ND-NS packets - whether a dynamic neighbor (MAC binding) entry is added/updated. - true - Always learn the MAC-IP binding, and add/update the MAC + true - Always learn the MAC-IP binding, and add/update the MAC binding entry. - false - If there is a MAC binding for that IP and the MAC is - different, or, if TPA of ARP request belongs to any router port - on this router, then update/add that MAC-IP binding. Otherwise, + false - If there is a MAC binding for that IP and the MAC is + different, or, if TPA of ARP request belongs to any router port + on this router, then update/add that MAC-IP binding. Otherwise, don’t update/add entries. - It is true by default. It is recommended to set to false when a - large number of logical routers are connected to the same logi‐ - cal switch but most of them never need to send traffic between + It is true by default. It is recommended to set to false when a + large number of logical routers are connected to the same logi‐ + cal switch but most of them never need to send traffic between each other, to reduce the size of the MAC binding table. options : requested-tnl-key: optional string, containing an integer, in range 1 to 16,777,215 - Configures the datapath tunnel key for the logical router. This - is not needed because ovn-northd will assign an unique key for - each datapath by itself. However, if it is configured, + Configures the datapath tunnel key for the logical router. This + is not needed because ovn-northd will assign an unique key for + each datapath by itself. However, if it is configured, ovn-northd honors the configured value. options : snat-ct-zone: optional string, containing an integer, in range 0 to 65,535 Use the requested conntrack zone for SNAT with this router. This - can be useful if egress traffic from the host running OVN comes - from both OVN and other sources. This way, OVN and the other + can be useful if egress traffic from the host running OVN comes + from both OVN and other sources. This way, OVN and the other sources can make use of the same conntrack zone. options : mac_binding_age_threshold: optional string - Specifies the MAC binding aging thresholds based on CIDRs, with + Specifies the MAC binding aging thresholds based on CIDRs, with the format: entry[;entry[...]], where each entry has the format: [cidr:]threshold • cidr: Can be either an IPv4 or IPv6 CIDR. - • threshold: Threshold value in seconds. MAC bindings with + • threshold: Threshold value in seconds. MAC bindings with IP addresses matching the specified CIDR that exceed this timeout will be automatically removed. - If an entry is provided without an CIDR (just the threshold + If an entry is provided without an CIDR (just the threshold value), it specifies the default threshold for MAC bindings that - don’t match any of the given CIDRs. If there are multiple de‐ - fault threshold entries in the option, the behavior is unde‐ + don’t match any of the given CIDRs. If there are multiple de‐ + fault threshold entries in the option, the behavior is unde‐ fined. - If there are multiple CIDRs matching a MAC binding IP, the one + If there are multiple CIDRs matching a MAC binding IP, the one with the longest prefix length takes effect. If there are multi‐ - ple entries with the same CIDR in the option, the behavior is + ple entries with the same CIDR in the option, the behavior is undefined. - If no matching CIDR is found for a MAC binding IP, and no de‐ + If no matching CIDR is found for a MAC binding IP, and no de‐ fault threshold is specified, the behavior defaults to the orig‐ inal: the binding will not be removed based on age. - The value can also default to an empty string, which means that - the aging threshold is disabled. Any string not in the above + The value can also default to an empty string, which means that + the aging threshold is disabled. Any string not in the above format is regarded as invalid and the aging is disabled. Example: 192.168.0.0/16:300;192.168.10.0/24:0;fe80::/10:600;1200 - This sets a threshold of 300 seconds for MAC bindings with IP + This sets a threshold of 300 seconds for MAC bindings with IP addresses in the 192.168.0.0/16 range, excluding the - 192.168.1.0/24 range (for which the aging is disabled), a - threshold of 600 seconds for MAC bindings with IP addresses in - the fe80::/10 IPv6 range, and a default threshold of 1200 sec‐ + 192.168.1.0/24 range (for which the aging is disabled), a + threshold of 600 seconds for MAC bindings with IP addresses in + the fe80::/10 IPv6 range, and a default threshold of 1200 sec‐ onds for all other MAC bindings. Common Columns: @@ -2442,53 +2447,53 @@ See External IDs at the beginning of this document. QoS TABLE - Each row in this table represents one QoS rule for a logical switch - that points to it through its qos_rules column. Two types of QoS are + Each row in this table represents one QoS rule for a logical switch + that points to it through its qos_rules column. Two types of QoS are supported: DSCP marking and metering. A match with the highest-priority - will have QoS applied to it. If the action column is specified, then - matching packets will have DSCP marking applied. If the bandwidth col‐ + will have QoS applied to it. If the action column is specified, then + matching packets will have DSCP marking applied. If the bandwidth col‐ umn is specified, then matching packets will have metering applied. ac‐‐ - tion and bandwidth are not exclusive, so both marking and metering by - defined for the same QoS entry. If no row matches, packets will not + tion and bandwidth are not exclusive, so both marking and metering by + defined for the same QoS entry. If no row matches, packets will not have any QoS applied. Summary: priority integer, in range 0 to 32,767 direction string, either from-lport or to-lport match string - action map of string-integer pairs, key either - dscp or mark, value in range 0 to + action map of string-integer pairs, key either + dscp or mark, value in range 0 to 4,294,967,295 - bandwidth map of string-integer pairs, key either + bandwidth map of string-integer pairs, key either burst or rate, value in range 1 to 4,294,967,295 external_ids map of string-string pairs Details: priority: integer, in range 0 to 32,767 - The QoS rule’s priority. Rules with numerically higher priority + The QoS rule’s priority. Rules with numerically higher priority take precedence over those with lower. If two QoS rules with the - same priority both match, then the one actually applied to a + same priority both match, then the one actually applied to a packet is undefined. direction: string, either from-lport or to-lport - The value of this field is similar to ACL column in the OVN + The value of this field is similar to ACL column in the OVN Northbound database’s ACL table. match: string The packets that the QoS rules should match, in the same expres‐ - sion language used for the match column in the OVN Southbound - database’s Logical_Flow table. The outport logical port is only - available in the to-lport direction (the inport is available in + sion language used for the match column in the OVN Southbound + database’s Logical_Flow table. The outport logical port is only + available in the to-lport direction (the inport is available in both directions). action: map of string-integer pairs, key either dscp or mark, value in range 0 to 4,294,967,295 - When dscp action is specified, matching flows will have have - DSCP marking applied. When mark action is specified, matching + When dscp action is specified, matching flows will have have + DSCP marking applied. When mark action is specified, matching flows will have packet marking applied. - • dscp: The value of this action should be in the range of + • dscp: The value of this action should be in the range of 0 to 63 (inclusive). • mark: The value of this action should be a positive inte‐ @@ -2496,7 +2501,7 @@ bandwidth: map of string-integer pairs, key either burst or rate, value in range 1 to 4,294,967,295 - When specified, matching packets will have bandwidth metering + When specified, matching packets will have bandwidth metering applied. Traffic over the limit will be dropped. • rate: The value of rate limit in kbps. @@ -2508,13 +2513,13 @@ See External IDs at the beginning of this document. Mirror TABLE - Each row in this table represents a mirror that can be used for port - mirroring. These mirrors are referenced by the mirror_rules column in + Each row in this table represents a mirror that can be used for port + mirroring. These mirrors are referenced by the mirror_rules column in the Logical_Switch_Port table. Summary: name string (must be unique within table) - filter string, one of both, from-lport, or + filter string, one of both, from-lport, or to-lport sink string type string, one of erspan, gre, or local @@ -2526,34 +2531,34 @@ Represents the name of the mirror. filter: string, one of both, from-lport, or to-lport - The value of this field represents selection criteria of the - mirror. to-lport mirrors the packets coming into logical port. - from-lport mirrors the packets going out of logical port. both + The value of this field represents selection criteria of the + mirror. to-lport mirrors the packets coming into logical port. + from-lport mirrors the packets going out of logical port. both mirrors for both directions. sink: string - The value of this field represents the destination/sink of the - mirror. If the type is gre or erspan, the value indicates the - tunnel remote IP (either IPv4 or IPv6). For a type of local, - this field defines a local interface on the OVS integration - bridge to be used as the mirror destination. The interface must + The value of this field represents the destination/sink of the + mirror. If the type is gre or erspan, the value indicates the + tunnel remote IP (either IPv4 or IPv6). For a type of local, + this field defines a local interface on the OVS integration + bridge to be used as the mirror destination. The interface must possess external-ids:mirror-id that matches this string. type: string, one of erspan, gre, or local - The value of this field specifies the mirror type - gre, erspan + The value of this field specifies the mirror type - gre, erspan or local. index: integer The value of this field represents the tunnel ID. If the config‐ ured tunnel type is gre, this field represents the GRE key value - and if the configured tunnel type is erspan it represents the + and if the configured tunnel type is erspan it represents the erspan_idx value. It is ignored if the type is local. external_ids: map of string-string pairs See External IDs at the beginning of this document. Meter TABLE - Each row in this table represents a meter that can be used for QoS or + Each row in this table represents a meter that can be used for QoS or rate-limiting. Summary: @@ -2567,26 +2572,26 @@ name: string (must be unique within table) A name for this meter. - Names that begin with "__" (two underscores) are reserved for + Names that begin with "__" (two underscores) are reserved for OVN internal use and should not be added manually. unit: string, either kbps or pktps - The unit for rate and burst_rate parameters in the bands entry. - kbps specifies kilobits per second, and pktps specifies packets + The unit for rate and burst_rate parameters in the bands entry. + kbps specifies kilobits per second, and pktps specifies packets per second. bands: set of 1 or more Meter_Bands The bands associated with this meter. Each band specifies a rate - above which the band is to take the action action. If multiple - bands’ rates are exceeded, then the band with the highest rate + above which the band is to take the action action. If multiple + bands’ rates are exceeded, then the band with the highest rate among the exceeded bands is selected. fair: optional boolean - This column is used to further describe the desired behavior of + This column is used to further describe the desired behavior of the meter when there are multiple references to it. If this col‐ - umn is empty or is set to false, the rate will be shared across - all rows that refer to the same Meter name. Conversely, when - this column is set to true, each user of the same Meter will be + umn is empty or is set to false, the rate will be shared across + all rows that refer to the same Meter name. Conversely, when + this column is set to true, each user of the same Meter will be rate-limited on its own. external_ids: map of string-string pairs @@ -2594,7 +2599,7 @@ Meter_Band TABLE Each row in this table represents a meter band which specifies the rate - above which the configured action should be applied. These bands are + above which the configured action should be applied. These bands are referenced by the bands column in the Meter table. Summary: @@ -2610,13 +2615,13 @@ rate: integer, in range 1 to 4,294,967,295 The rate limit for this band, in kilobits per second or bits per - second, depending on whether the parent Meter entry’s unit col‐ + second, depending on whether the parent Meter entry’s unit col‐ umn specified kbps or pktps. burst_size: integer, in range 0 to 4,294,967,295 - The maximum burst allowed for the band in kilobits or packets, - depending on whether kbps or pktps was selected in the parent - Meter entry’s unit column. If the size is zero, the switch is + The maximum burst allowed for the band in kilobits or packets, + depending on whether kbps or pktps was selected in the parent + Meter entry’s unit column. If the size is zero, the switch is free to select some reasonable value depending on its configura‐ tion. @@ -2626,7 +2631,7 @@ Logical_Router_Port TABLE A port within an L3 logical router. - Exactly one Logical_Router row must reference a given logical router + Exactly one Logical_Router row must reference a given logical router port. Summary: @@ -2640,7 +2645,7 @@ Options for Physical VLAN MTU Issues: options : reside-on-redirect-chassis optional string, either true or false - options : redirect-type optional string, either bridged or over‐‐ + options : redirect-type optional string, either bridged or over‐‐ lay ipv6_prefix set of strings ipv6_ra_configs: @@ -2662,13 +2667,13 @@ Options: options : mcast_flood optional string, either true or false options : requested-tnl-key - optional string, containing an integer, + optional string, containing an integer, in range 1 to 32,767 options : prefix_delegation optional string, either true or false options : prefix optional string, either true or false options : route_table optional string - options : gateway_mtu optional string, containing an integer, + options : gateway_mtu optional string, containing an integer, in range 68 to 65,535 options : gateway_mtu_bypass optional string @@ -2683,21 +2688,21 @@ name: string (must be unique within table) A name for the logical router port. - In addition to provide convenience for human interaction with + In addition to provide convenience for human interaction with the northbound database, this column is used as reference by its patch port in Logical_Switch_Port or another logical router port in Logical_Router_Port. - A logical router port may not have the same name as a logical + A logical router port may not have the same name as a logical switch port, but the database schema cannot enforce this. networks: set of 1 or more strings - The IP addresses and netmasks of the router. For example, - 192.168.0.1/24 indicates that the router’s IP address is - 192.168.0.1 and that packets destined to 192.168.0.x should be + The IP addresses and netmasks of the router. For example, + 192.168.0.1/24 indicates that the router’s IP address is + 192.168.0.1 and that packets destined to 192.168.0.x should be routed to this port. - A logical router port always adds a link-local IPv6 address + A logical router port always adds a link-local IPv6 address (fe80::/64) automatically generated from the interface’s MAC ad‐ dress using the modified EUI-64 format. @@ -2705,129 +2710,129 @@ The Ethernet address that belongs to this router port. enabled: optional boolean - This column is used to administratively set port state. If this - column is empty or is set to true, the port is enabled. If this - column is set to false, the port is disabled. A disabled port + This column is used to administratively set port state. If this + column is empty or is set to true, the port is enabled. If this + column is set to false, the port is disabled. A disabled port has all ingress and egress traffic dropped. Distributed Gateway Ports: - Gateways, as documented under Gateways in the OVN architecture guide, - provide limited connectivity between logical networks and physical - ones. OVN support multiple kinds of gateways. The Logical_Router_Port - table can be used two different ways to configure distributed gateway - ports, which are one kind of gateway. These two forms of configuration + Gateways, as documented under Gateways in the OVN architecture guide, + provide limited connectivity between logical networks and physical + ones. OVN support multiple kinds of gateways. The Logical_Router_Port + table can be used two different ways to configure distributed gateway + ports, which are one kind of gateway. These two forms of configuration exist for historical reasons. Both of them produce the same kind of OVN southbound records and the same behavior in practice. - If either of these are set, this logical router port represents a dis‐ - tributed gateway port that connects this router to a logical switch + If either of these are set, this logical router port represents a dis‐ + tributed gateway port that connects this router to a logical switch with a localnet port or a connection to another OVN deployment. Also mentioned in the OVN architecture guide, distributed gateway ports - can also be used for scalability reasons in deployments where logical + can also be used for scalability reasons in deployments where logical switches are dedicated to chassises rather than distributed. The preferred way to configure a gateway is ha_chassis_group, but gate‐‐ - way_chassis is also supported for backward compatibility. Only one of - these should be set at a time on a given LRP, since they configure the + way_chassis is also supported for backward compatibility. Only one of + these should be set at a time on a given LRP, since they configure the same features. Even when a gateway is configured, the logical router port still effec‐ tively resides on each chassis. However, due to the implications of the use of L2 learning in the physical network, as well as the need to sup‐ port advanced features such as one-to-many NAT (aka IP masquerading), a - subset of the logical router processing is handled in a centralized + subset of the logical router processing is handled in a centralized manner on the gateway chassis. There can be more than one distributed gateway ports configured on each - logical router, each connecting to different L2 segments. Load-balanc‐ + logical router, each connecting to different L2 segments. Load-balanc‐ ing is not yet supported on logical routers with more than one distrib‐ uted gateway ports. - For each distributed gateway port, it may have more than one gateway - chassises. When more than one gateway chassis is specified, OVN only - uses one at a time. OVN can rely on OVS BFD implementation to monitor - gateway connectivity, preferring the highest-priority gateway that is - online. Priorities are specified in the priority column of Gate‐‐ + For each distributed gateway port, it may have more than one gateway + chassises. When more than one gateway chassis is specified, OVN only + uses one at a time. OVN can rely on OVS BFD implementation to monitor + gateway connectivity, preferring the highest-priority gateway that is + online. Priorities are specified in the priority column of Gate‐‐ way_Chassis or HA_Chassis. - ovn-northd programs the external_mac rules specified in the LRP’s LR - into the peer logical switch’s destination lookup on the chassis where + ovn-northd programs the external_mac rules specified in the LRP’s LR + into the peer logical switch’s destination lookup on the chassis where the logical_port resides. In addition, the logical router’s MAC address - is automatically programmed in the peer logical switch’s destination - lookup flow on the gateway chasssis. If it is desired to generate gra‐ + is automatically programmed in the peer logical switch’s destination + lookup flow on the gateway chasssis. If it is desired to generate gra‐ tuitous ARPs for NAT addresses, then set the peer LSP’s options:nat-ad‐‐ dresses to router. - OVN 20.03 and earlier supported a third way to configure distributed - gateway ports using options:redirect-chassis to specify the gateway + OVN 20.03 and earlier supported a third way to configure distributed + gateway ports using options:redirect-chassis to specify the gateway chassis. This method is no longer supported. Any remaining users should - switch to one of the newer methods instead. A gateway_chassis may be - easily configured from the command line, e.g. ovn-nbctl lrp-set-gate‐‐ + switch to one of the newer methods instead. A gateway_chassis may be + easily configured from the command line, e.g. ovn-nbctl lrp-set-gate‐‐ way-chassis lrp chassis. ha_chassis_group: optional HA_Chassis_Group - Designates an HA_Chassis_Group to provide gateway high avail‐ + Designates an HA_Chassis_Group to provide gateway high avail‐ ability. gateway_chassis: set of Gateway_Chassises - Designates one or more Gateway_Chassis for the logical router + Designates one or more Gateway_Chassis for the logical router port. Options for Physical VLAN MTU Issues: - MTU issues arise in mixing tunnels with logical networks that are - bridged to a physical VLAN. For an explanation of the MTU issues, see - Physical VLAN MTU Issues in the OVN architecture document. The follow‐ - ing options, which are alternatives, provide solutions. Both of them - cause packets to be sent over localnet instead of tunnels, but they - differ in whether some or all packets are sent this way. The most + MTU issues arise in mixing tunnels with logical networks that are + bridged to a physical VLAN. For an explanation of the MTU issues, see + Physical VLAN MTU Issues in the OVN architecture document. The follow‐ + ing options, which are alternatives, provide solutions. Both of them + cause packets to be sent over localnet instead of tunnels, but they + differ in whether some or all packets are sent this way. The most prominent tradeoff between these options is that reside-on-redi‐‐ - rect-chassis is easier to configure and that redirect-type performs + rect-chassis is easier to configure and that redirect-type performs better for east-west traffic. options : reside-on-redirect-chassis: optional string, either true or false - If set to true, this option forces all traffic across the logi‐ - cal router port to pass through the gateway chassis using a hop + If set to true, this option forces all traffic across the logi‐ + cal router port to pass through the gateway chassis using a hop across a localnet port. This changes behavior in two ways: - • Without this option, east-west traffic passes directly - between source and destination chassis (or even within a - single chassis, for co-located VMs). With this option, + • Without this option, east-west traffic passes directly + between source and destination chassis (or even within a + single chassis, for co-located VMs). With this option, all east-west traffic passes through the gateway chassis. - • Without this option, traffic between the gateway chassis - and other chassis is encapsulated in tunnels. With this + • Without this option, traffic between the gateway chassis + and other chassis is encapsulated in tunnels. With this option, traffic passes over a localnet interface. - This option may usefully be set only on logical router ports - that connect a distributed logical router to a logical switch + This option may usefully be set only on logical router ports + that connect a distributed logical router to a logical switch with VIFs. It should not be set on a distributed gateway port. - OVN honors this option only if the logical router has one and - only one distributed gateway port and if the LRP’s peer switch + OVN honors this option only if the logical router has one and + only one distributed gateway port and if the LRP’s peer switch has a localnet port. options : redirect-type: optional string, either bridged or overlay - If set to bridged on a distributed gateway port, this option + If set to bridged on a distributed gateway port, this option causes OVN to redirect packets to the gateway chassis over a lo‐‐ calnet port instead of a tunnel. The relevant chassis must share a localnet port. - This feature requires the administrator or the CMS to configure - each participating chassis with a unique Ethernet address for - the logical router by setting ovn-chassis-mac-mappings in the + This feature requires the administrator or the CMS to configure + each participating chassis with a unique Ethernet address for + the logical router by setting ovn-chassis-mac-mappings in the Open vSwitch database, for use by ovn-controller. - Setting this option to overlay or leaving it unset has no ef‐ - fect. This option may usefully be set only on a distributed - gateway port when there is one and only one distributed gateway + Setting this option to overlay or leaving it unset has no ef‐ + fect. This option may usefully be set only on a distributed + gateway port when there is one and only one distributed gateway port on the logical router. It is otherwise ignored. ipv6_prefix: set of strings - This column contains IPv6 prefix obtained by prefix delegation + This column contains IPv6 prefix obtained by prefix delegation router according to RFC 3633 ipv6_ra_configs: @@ -2837,23 +2842,23 @@ tion requests. ipv6_ra_configs : address_mode: optional string - The address mode to be used for IPv6 address configuration. The + The address mode to be used for IPv6 address configuration. The supported values are: - • slaac: Address configuration using Router Advertisement - (RA) packet. The IPv6 prefixes defined in the Logi‐‐ - cal_Router_Port table’s networks column will be included + • slaac: Address configuration using Router Advertisement + (RA) packet. The IPv6 prefixes defined in the Logi‐‐ + cal_Router_Port table’s networks column will be included in the RA’s ICMPv6 option - Prefix information. • dhcpv6_stateful: Address configuration using DHCPv6. - • dhcpv6_stateless: Address configuration using Router Ad‐ - vertisement (RA) packet. Other IPv6 options are provided + • dhcpv6_stateless: Address configuration using Router Ad‐ + vertisement (RA) packet. Other IPv6 options are provided by DHCPv6. ipv6_ra_configs : router_preference: optional string Default Router Preference (PRF) indicates whether to prefer this - router over other default routers (RFC 4191). Possible values + router over other default routers (RFC 4191). Possible values are: • HIGH: mapped to 0x01 in RA PRF field @@ -2865,7 +2870,7 @@ ipv6_ra_configs : route_info: optional string Route Info is used to configure Route Info Option sent in Router Advertisement according to RFC 4191. Route Info is a comma sepa‐ - rated string where each field provides PRF and prefix for a + rated string where each field provides PRF and prefix for a given route (e.g: HIGH-aef1::11/48,LOW-aef2::11/96) Possible PRF values are: @@ -2876,26 +2881,26 @@ • LOW: mapped to 0x11 in RA PRF field ipv6_ra_configs : mtu: optional string - The recommended MTU for the link. Default is 0, which means no - MTU Option will be included in RA packet replied by ovn-con‐ + The recommended MTU for the link. Default is 0, which means no + MTU Option will be included in RA packet replied by ovn-con‐ troller. Per RFC 2460, the mtu value is recommended no less than - 1280, so any mtu value less than 1280 will be considered as no + 1280, so any mtu value less than 1280 will be considered as no MTU Option. ipv6_ra_configs : send_periodic: optional string - If set to true, then this router interface will send router ad‐ + If set to true, then this router interface will send router ad‐ vertisements periodically. The default is false. ipv6_ra_configs : max_interval: optional string - The maximum number of seconds to wait between sending periodic + The maximum number of seconds to wait between sending periodic router advertisements. This option has no effect if ipv6_ra_con‐‐ figs:send_periodic is false. The default is 600. ipv6_ra_configs : min_interval: optional string - The minimum number of seconds to wait between sending periodic + The minimum number of seconds to wait between sending periodic router advertisements. This option has no effect if ipv6_ra_con‐‐ - figs:send_periodic is false. The default is one-third of - ipv6_ra_configs:max_interval, i.e. 200 seconds if that key is + figs:send_periodic is false. The default is one-third of + ipv6_ra_configs:max_interval, i.e. 200 seconds if that key is unset. ipv6_ra_configs : rdnss: optional string @@ -2903,7 +2908,7 @@ ment OVN supports just one RDNSS server. ipv6_ra_configs : dnssl: optional string - DNS Search List announced in RA packets. Multiple DNS Search + DNS Search List announced in RA packets. Multiple DNS Search List must be ’comma’ separated (e.g. "a.b.c, d.e.f") Options: @@ -2914,46 +2919,46 @@ If set to true, multicast traffic (including reports) are uncon‐ ditionally forwarded to the specific port. - This option applies when the port is part of a logical router + This option applies when the port is part of a logical router which has options:mcast_relay set to true. Default: false. options : requested-tnl-key: optional string, containing an integer, in range 1 to 32,767 - Configures the port binding tunnel key for the port. Usually - this is not needed because ovn-northd will assign an unique key - for each port by itself. However, if it is configured, + Configures the port binding tunnel key for the port. Usually + this is not needed because ovn-northd will assign an unique key + for each port by itself. However, if it is configured, ovn-northd honors the configured value. options : prefix_delegation: optional string, either true or false - If set to true, enable IPv6 prefix delegation state machine on - this logical router port (RFC3633). IPv6 prefix delegation is + If set to true, enable IPv6 prefix delegation state machine on + this logical router port (RFC3633). IPv6 prefix delegation is available just on a gateway router or on a gateway router port. options : prefix: optional string, either true or false - If set to true, this interface will receive an IPv6 prefix ac‐ + If set to true, this interface will receive an IPv6 prefix ac‐ cording to RFC3663 options : route_table: optional string - Designates lookup Logical_Router_Static_Routes with specified - route_table value. Routes to directly connected networks from - same Logical Router and routes without route_table option set + Designates lookup Logical_Router_Static_Routes with specified + route_table value. Routes to directly connected networks from + same Logical Router and routes without route_table option set have higher priority than routes with route_table option set. options : gateway_mtu: optional string, containing an integer, in range 68 to 65,535 - If set, logical flows will be added to router pipeline to check - packet length. If packet length is greater than the value set, - ICMPv4 type 3 (Destination Unreachable) code 4 (Fragmentation - Needed and Don’t Fragment was Set) or ICMPv6 type 2 (Packet Too + If set, logical flows will be added to router pipeline to check + packet length. If packet length is greater than the value set, + ICMPv4 type 3 (Destination Unreachable) code 4 (Fragmentation + Needed and Don’t Fragment was Set) or ICMPv6 type 2 (Packet Too Big) code 0 (no route to destination) packets will be generated. This allows for Path MTU Discovery. options : gateway_mtu_bypass: optional string - When configured, represents a match expression, in the same ex‐ - pression language used for the match column in the OVN South‐ - bound database’s Logical_Flow table. Packets matching this ex‐ + When configured, represents a match expression, in the same ex‐ + pression language used for the match column in the OVN South‐ + bound database’s Logical_Flow table. Packets matching this ex‐ pression will bypass the length check configured through the op‐‐ tions:gateway_mtu option. @@ -2962,22 +2967,22 @@ A given router port serves one of two purposes: • To attach a logical switch to a logical router. A logical - router port of this type is referenced by exactly one - Logical_Switch_Port of type router. The value of name is - set as router-port in column options of Logi‐‐ + router port of this type is referenced by exactly one + Logical_Switch_Port of type router. The value of name is + set as router-port in column options of Logi‐‐ cal_Switch_Port. In this case peer column is empty. • To connect one logical router to another. This requires a pair of logical router ports, each connected to a differ‐ - ent router. Each router port in the pair specifies the + ent router. Each router port in the pair specifies the other in its peer column. No Logical_Switch refers to the router port. peer: optional string - For a router port used to connect two logical routers, this + For a router port used to connect two logical routers, this identifies the other router port in the pair by name. - For a router port attached to a logical switch, this column is + For a router port attached to a logical switch, this column is empty. Common Columns: @@ -2985,7 +2990,7 @@ external_ids: map of string-string pairs See External IDs at the beginning of this document. - The ovn-northd program copies all these pairs into the exter‐‐ + The ovn-northd program copies all these pairs into the exter‐‐ nal_ids column of the Port_Binding table in OVN_Southbound data‐ base. @@ -2996,20 +3001,20 @@ status : hosting-chassis: optional string This option is populated by ovn-northd. - When a distributed gateway port is bound to a location in the - OVN Southbound database Port_Binding ovn-northd will populate - this key with the name of the Chassis that is currently hosting + When a distributed gateway port is bound to a location in the + OVN Southbound database Port_Binding ovn-northd will populate + this key with the name of the Chassis that is currently hosting this port. Logical_Router_Static_Route TABLE Each record represents a static route. - When multiple routes match a packet, the longest-prefix match is cho‐ - sen. For a given prefix length, a dst-ip route is preferred over a + When multiple routes match a packet, the longest-prefix match is cho‐ + sen. For a given prefix length, a dst-ip route is preferred over a src-ip route. - When there are ECMP routes, i.e. multiple routes with same prefix and - policy, one of them will be selected based on the 5-tuple hashing of + When there are ECMP routes, i.e. multiple routes with same prefix and + policy, one of them will be selected based on the 5-tuple hashing of the packet header. Summary: @@ -3034,54 +3039,54 @@ IP prefix of this route (e.g. 192.168.100.0/24). policy: optional string, either dst-ip or src-ip - If it is specified, this setting describes the policy used to - make routing decisions. This setting must be one of the follow‐ + If it is specified, this setting describes the policy used to + make routing decisions. This setting must be one of the follow‐ ing strings: - • src-ip: This policy sends the packet to the nexthop when + • src-ip: This policy sends the packet to the nexthop when the packet’s source IP address matches ip_prefix. - • dst-ip: This policy sends the packet to the nexthop when + • dst-ip: This policy sends the packet to the nexthop when the packet’s destination IP address matches ip_prefix. If not specified, the default is dst-ip. nexthop: string - Nexthop IP address for this route. Nexthop IP address should be + Nexthop IP address for this route. Nexthop IP address should be the IP address of a connected router port or the IP address of a logical port or can be set to discard for dropping packets which match the given route. output_port: optional string - The name of the Logical_Router_Port via which the packet needs - to be sent out. This is optional and when not specified, OVN - will automatically figure this out based on the nexthop. When - this is specified and there are multiple IP addresses on the - router port and none of them are in the same subnet of nexthop, - OVN chooses the first IP address as the one via which the nex‐‐ + The name of the Logical_Router_Port via which the packet needs + to be sent out. This is optional and when not specified, OVN + will automatically figure this out based on the nexthop. When + this is specified and there are multiple IP addresses on the + router port and none of them are in the same subnet of nexthop, + OVN chooses the first IP address as the one via which the nex‐‐ thop is reachable. bfd: optional weak reference to BFD Reference to BFD row if the route has associated a BFD session route_table: string - Any string to place route to separate routing table. If Logical - Router Port has configured value in options:route_table other + Any string to place route to separate routing table. If Logical + Router Port has configured value in options:route_table other than empty string, OVN performs route lookup for all packets en‐ - tering Logical Router ingress pipeline from this port in the + tering Logical Router ingress pipeline from this port in the following manner: - • 1. First lookup among "global" routes: routes without - route_table value set and routes to directly connected + • 1. First lookup among "global" routes: routes without + route_table value set and routes to directly connected networks. - • 2. Next lookup among routes with same route_table value + • 2. Next lookup among routes with same route_table value as specified in LRP’s options:route_table field. external_ids : ic-learned-route: optional string - ovn-ic populates this key if the route is learned from the - global OVN_IC_Southbound database. In this case the value will - be set to the uuid of the row in Route table of the + ovn-ic populates this key if the route is learned from the + global OVN_IC_Southbound database. In this case the value will + be set to the uuid of the row in Route table of the OVN_IC_Southbound database. Common Columns: @@ -3092,35 +3097,35 @@ Common options: options: map of string-string pairs - This column provides general key/value settings. The supported + This column provides general key/value settings. The supported options are described individually below. options : ecmp_symmetric_reply: optional string If true, then new traffic that arrives over this route will have - its reply traffic bypass ECMP route selection and will be sent - out this route instead. Note that this option overrides any - rules set in the Logical_Router_policy table. This option only - works on gateway routers (routers that have options:chassis + its reply traffic bypass ECMP route selection and will be sent + out this route instead. Note that this option overrides any + rules set in the Logical_Router_policy table. This option only + works on gateway routers (routers that have options:chassis set). options : origin: optional string In case ovn-interconnection has been learned this route, it will have its origin set: either "connected" or "static". This key is - supposed to be written only by ovn-ic daemon. ovn-northd then - checks this value when generating Logical Flows. Logi‐‐ - cal_Router_Static_Route records with same ip_prefix within same - Logical Router will have next lookup order based on origin key + supposed to be written only by ovn-ic daemon. ovn-northd then + checks this value when generating Logical Flows. Logi‐‐ + cal_Router_Static_Route records with same ip_prefix within same + Logical Router will have next lookup order based on origin key value: 1. connected 2. static Logical_Router_Policy TABLE - Each row in this table represents one routing policy for a logical + Each row in this table represents one routing policy for a logical router that points to it through its policies column. The action column - for the highest-priority matching row in this table determines a - packet’s treatment. If no row matches, packets are allowed by default. - (Default-deny treatment is possible: add a rule with priority 0, 1 as + for the highest-priority matching row in this table determines a + packet’s treatment. If no row matches, packets are allowed by default. + (Default-deny treatment is possible: add a rule with priority 0, 1 as match, and drop as action.) Summary: @@ -3136,17 +3141,17 @@ Details: priority: integer, in range 0 to 32,767 - The routing policy’s priority. Rules with numerically higher - priority take precedence over those with lower. A rule is + The routing policy’s priority. Rules with numerically higher + priority take precedence over those with lower. A rule is uniquely identified by the priority and match string. match: string - The packets that the routing policy should match, in the same - expression language used for the match column in the OVN South‐ + The packets that the routing policy should match, in the same + expression language used for the match column in the OVN South‐ bound database’s Logical_Flow table. - By default all traffic is allowed. When writing a more restric‐ - tive policy, it is important to remember to allow flows such as + By default all traffic is allowed. When writing a more restric‐ + tive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets. action: string, one of allow, drop, or reroute @@ -3161,13 +3166,13 @@ nexthop: optional string Note: This column is deprecated in favor of nexthops. - Next-hop IP address for this route, which should be the IP ad‐ - dress of a connected router port or the IP address of a logical + Next-hop IP address for this route, which should be the IP ad‐ + dress of a connected router port or the IP address of a logical port. nexthops: set of strings - Next-hop ECMP IP addresses for this route. Each IP in the list - should be the IP address of a connected router port or the IP + Next-hop ECMP IP addresses for this route. Each IP in the list + should be the IP address of a connected router port or the IP address of a logical port. One IP from the list is selected as next hop. @@ -3179,7 +3184,7 @@ options : pkt_mark: optional string Marks the packet with the value specified when the router policy is applied. CMS can inspect this packet marker and take some de‐ - cisions if desired. This value is not preserved when the packet + cisions if desired. This value is not preserved when the packet goes out on the wire. Common Columns: @@ -3191,7 +3196,7 @@ Each record represents a NAT rule. Summary: - type string, one of dnat, dnat_and_snat, or + type string, one of dnat, dnat_and_snat, or snat external_ip string external_mac optional string @@ -3200,7 +3205,7 @@ logical_port optional string allowed_ext_ips optional Address_Set exempted_ext_ips optional Address_Set - gateway_port optional weak reference to Logi‐‐ + gateway_port optional weak reference to Logi‐‐ cal_Router_Port options : stateless optional string options : add_route optional string @@ -3211,19 +3216,19 @@ type: string, one of dnat, dnat_and_snat, or snat Type of the NAT rule. - • When type is dnat, the externally visible IP address ex‐‐ - ternal_ip is DNATted to the IP address logical_ip in the + • When type is dnat, the externally visible IP address ex‐‐ + ternal_ip is DNATted to the IP address logical_ip in the logical space. - • When type is snat, IP packets with their source IP ad‐ + • When type is snat, IP packets with their source IP ad‐ dress that either matches the IP address in logical_ip or - is in the network provided by logical_ip is SNATed into + is in the network provided by logical_ip is SNATed into the IP address in external_ip. • When type is dnat_and_snat, the externally visible IP ad‐ dress external_ip is DNATted to the IP address logical_ip - in the logical space. In addition, IP packets with the - source IP address that matches logical_ip is SNATed into + in the logical space. In addition, IP packets with the + source IP address that matches logical_ip is SNATed into the IP address in external_ip. external_ip: string @@ -3232,14 +3237,14 @@ external_mac: optional string A MAC address. - This is only used on the gateway port on distributed routers. + This is only used on the gateway port on distributed routers. This must be specified in order for the NAT rule to be processed in a distributed manner on all chassis. If this is not specified - for a NAT rule on a distributed router, then this NAT rule will - be processed in a centralized manner on the gateway port in‐ + for a NAT rule on a distributed router, then this NAT rule will + be processed in a centralized manner on the gateway port in‐ stance on the gateway chassis. - This MAC address must be unique on the logical switch that the + This MAC address must be unique on the logical switch that the gateway port is attached to. If the MAC address used on the log‐‐ ical_port is globally unique, then that MAC address can be spec‐ ified as this external_mac. @@ -3247,8 +3252,8 @@ external_port_range: string L4 source port range - Range of ports, from which a port number will be picked that - will replace the source port of to be NATed packet. This is ba‐ + Range of ports, from which a port number will be picked that + will replace the source port of to be NATed packet. This is ba‐ sically PAT (port address translation). Value of the column is in the format, port_lo-port_hi. For exam‐ @@ -3263,88 +3268,88 @@ The name of the logical port where the logical_ip resides. This is only used on distributed routers. This must be specified - in order for the NAT rule to be processed in a distributed man‐ + in order for the NAT rule to be processed in a distributed man‐ ner on all chassis. If this is not specified for a NAT rule on a - distributed router, then this NAT rule will be processed in a - centralized manner on the gateway port instance on the gateway + distributed router, then this NAT rule will be processed in a + centralized manner on the gateway port instance on the gateway chassis. allowed_ext_ips: optional Address_Set - It represents Address Set of external ips that NAT rule is ap‐ + It represents Address Set of external ips that NAT rule is ap‐ plicable to. For SNAT type NAT rules, this refers to destination - addresses. For DNAT type NAT rules, this refers to source ad‐ + addresses. For DNAT type NAT rules, this refers to source ad‐ dresses. - This configuration overrides the default NAT behavior of apply‐ - ing a rule solely based on internal IP. Without this configura‐ - tion, NAT happens without considering the external IP (i.e - dest/source for snat/dnat type rule). With this configuration - NAT rule is applied ONLY if external ip is in the input Address + This configuration overrides the default NAT behavior of apply‐ + ing a rule solely based on internal IP. Without this configura‐ + tion, NAT happens without considering the external IP (i.e + dest/source for snat/dnat type rule). With this configuration + NAT rule is applied ONLY if external ip is in the input Address Set. exempted_ext_ips: optional Address_Set - It represents Address Set of external ips that NAT rule is NOT - applicable to. For SNAT type NAT rules, this refers to destina‐ - tion addresses. For DNAT type NAT rules, this refers to source + It represents Address Set of external ips that NAT rule is NOT + applicable to. For SNAT type NAT rules, this refers to destina‐ + tion addresses. For DNAT type NAT rules, this refers to source addresses. - This configuration overrides the default NAT behavior of apply‐ - ing a rule solely based on internal IP. Without this configura‐ - tion, NAT happens without considering the external IP (i.e - dest/source for snat/dnat type rule). With this configuration - NAT rule is NOT applied if external ip is in the input Address + This configuration overrides the default NAT behavior of apply‐ + ing a rule solely based on internal IP. Without this configura‐ + tion, NAT happens without considering the external IP (i.e + dest/source for snat/dnat type rule). With this configuration + NAT rule is NOT applied if external ip is in the input Address Set. - If there are NAT rules in a logical router with overlapping IP - prefixes (including /32), then usage of exempted_ext_ips should - be avoided in following scenario. a. SNAT rule (let us say - RULE1) with logical_ip PREFIX/MASK (let us say 50.0.0.0/24). b. - SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1 (let - us say 50.0.0.0/25). c. Now, if exempted_ext_ips is associated + If there are NAT rules in a logical router with overlapping IP + prefixes (including /32), then usage of exempted_ext_ips should + be avoided in following scenario. a. SNAT rule (let us say + RULE1) with logical_ip PREFIX/MASK (let us say 50.0.0.0/24). b. + SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1 (let + us say 50.0.0.0/25). c. Now, if exempted_ext_ips is associated with RULE2, then a logical ip which matches both 50.0.0.0/24 and 50.0.0.0/25 may get the RULE2 applied to it instead of RULE1. - allowed_ext_ips and exempted_ext_ips are mutually exclusive to - each other. If both Address Sets are set for a rule, then the + allowed_ext_ips and exempted_ext_ips are mutually exclusive to + each other. If both Address Sets are set for a rule, then the NAT rule is not considered. gateway_port: optional weak reference to Logical_Router_Port - A distributed gateway port in the Logical_Router_Port table + A distributed gateway port in the Logical_Router_Port table where the NAT rule needs to be applied. When multiple distributed gateway ports are configured on a Log‐‐ - ical_Router, applying a NAT rule at each of the distributed - gateway ports might not be desired. Consider the case where a + ical_Router, applying a NAT rule at each of the distributed + gateway ports might not be desired. Consider the case where a logical router has 2 distributed gateway port, one with networks - 50.0.0.10/24 and the other with networks 60.0.0.10/24. If the - logical router has a NAT rule of type snat, logical_ip - 10.1.1.0/24 and external_ip 50.1.1.20/24, the rule needs to be + 50.0.0.10/24 and the other with networks 60.0.0.10/24. If the + logical router has a NAT rule of type snat, logical_ip + 10.1.1.0/24 and external_ip 50.1.1.20/24, the rule needs to be selectively applied on matching packets entering/leaving through the distributed gateway port with networks 50.0.0.10/24. When a logical router has multiple distributed gateway ports and this column is not set for a NAT rule, then the rule will be ap‐ - plied at the distributed gateway port which is in the same net‐ - work as the external_ip of the NAT rule, if such a router port - exists. If logical router has a single distributed gateway port - and this column is not set for a NAT rule, the rule will be ap‐ + plied at the distributed gateway port which is in the same net‐ + work as the external_ip of the NAT rule, if such a router port + exists. If logical router has a single distributed gateway port + and this column is not set for a NAT rule, the rule will be ap‐ plied at the distributed gateway port even if the router port is not in the same network as the external_ip of the NAT rule. options : stateless: optional string - Indicates if a dnat_and_snat rule should lead to connection + Indicates if a dnat_and_snat rule should lead to connection tracking state or not. options : add_route: optional string - If set to true, then neighbor routers will have logical flows - added that will allow for routing to the NAT address. It also - will have ARP resolution logical flows added. By setting this - option, it means there is no reason to create a Logi‐‐ - cal_Router_Static_Route from neighbor routers to this NAT ad‐ - dress. It also means that no ARP request is required for neigh‐ - bor routers to learn the IP-MAC mapping for this NAT address. + If set to true, then neighbor routers will have logical flows + added that will allow for routing to the NAT address. It also + will have ARP resolution logical flows added. By setting this + option, it means there is no reason to create a Logi‐‐ + cal_Router_Static_Route from neighbor routers to this NAT ad‐ + dress. It also means that no ARP request is required for neigh‐ + bor routers to learn the IP-MAC mapping for this NAT address. This option only applies to NATs of type dnat and dnat_and_snat. - For more information about what flows are added for IP routes, + For more information about what flows are added for IP routes, please see the ovn-northd manpage section on IP Routing. Common Columns: @@ -3353,13 +3358,13 @@ See External IDs at the beginning of this document. DHCP_Options TABLE - OVN implements native DHCPv4 support which caters to the common use - case of providing an IPv4 address to a booting instance by providing + OVN implements native DHCPv4 support which caters to the common use + case of providing an IPv4 address to a booting instance by providing stateless replies to DHCPv4 requests based on statically configured ad‐ - dress mappings. To do this it allows a short list of DHCPv4 options to + dress mappings. To do this it allows a short list of DHCPv4 options to be configured and applied at each compute host running ovn-controller. - OVN also implements native DHCPv6 support which provides stateless + OVN also implements native DHCPv6 support which provides stateless replies to DHCPv6 requests. Summary: @@ -3368,7 +3373,7 @@ Mandatory DHCPv4 options: options : server_id optional string options : server_mac optional string - options : lease_time optional string, containing an integer, + options : lease_time optional string, containing an integer, in range 0 to 4,294,967,295 IPv4 DHCP Options: options : router optional string @@ -3396,24 +3401,24 @@ optional string, either 0 or 1 options : ethernet_encap optional string, either 0 or 1 Integer DHCP Options: - options : default_ttl optional string, containing an integer, + options : default_ttl optional string, containing an integer, in range 0 to 255 - options : tcp_ttl optional string, containing an integer, + options : tcp_ttl optional string, containing an integer, in range 0 to 255 - options : mtu optional string, containing an integer, + options : mtu optional string, containing an integer, in range 68 to 65,535 - options : T1 optional string, containing an integer, + options : T1 optional string, containing an integer, in range 68 to 4,294,967,295 - options : T2 optional string, containing an integer, + options : T2 optional string, containing an integer, in range 68 to 4,294,967,295 options : arp_cache_timeout - optional string, containing an integer, + optional string, containing an integer, in range 0 to 255 options : tcp_keepalive_interval - optional string, containing an integer, + optional string, containing an integer, in range 0 to 255 options : netbios_node_type - optional string, containing an integer, + optional string, containing an integer, in range 0 to 255 String DHCP Options: options : wpad optional string @@ -3447,14 +3452,14 @@ Details: cidr: string - The DHCPv4/DHCPv6 options will be included if the logical port + The DHCPv4/DHCPv6 options will be included if the logical port has its IP address in this cidr. DHCPv4 options: - The CMS should define the set of DHCPv4 options as key/value pairs in - the options column of this table. For ovn-controller to include these - DHCPv4 options, the dhcpv4_options of Logical_Switch_Port should refer + The CMS should define the set of DHCPv4 options as key/value pairs in + the options column of this table. For ovn-controller to include these + DHCPv4 options, the dhcpv4_options of Logical_Switch_Port should refer to an entry in this table. Mandatory DHCPv4 options: @@ -3463,7 +3468,7 @@ options : server_id: optional string The IP address for the DHCP server to use. This should be in the - subnet of the offered IP. This is also included in the DHCP of‐ + subnet of the offered IP. This is also included in the DHCP of‐ fer as option 54, ``server identifier.’’ options : server_mac: optional string @@ -3477,14 +3482,14 @@ IPv4 DHCP Options: - Below are the supported DHCPv4 options whose values are an IPv4 ad‐ - dress, e.g. 192.168.1.1. Some options accept multiple IPv4 addresses - enclosed within curly braces, e.g. {192.168.1.2, 192.168.1.3}. Please + Below are the supported DHCPv4 options whose values are an IPv4 ad‐ + dress, e.g. 192.168.1.1. Some options accept multiple IPv4 addresses + enclosed within curly braces, e.g. {192.168.1.2, 192.168.1.3}. Please refer to RFC 2132 for more details on DHCPv4 options and their codes. options : router: optional string - The IP address of a gateway for the client to use. This should - be in the subnet of the offered IP. The DHCPv4 option code for + The IP address of a gateway for the client to use. This should + be in the subnet of the offered IP. The DHCPv4 option code for this option is 3. options : netmask: optional string @@ -3521,19 +3526,19 @@ The DHCPv4 option code for this option is 121. This option can contain one or more static routes, each of which - consists of a destination descriptor and the IP address of the + consists of a destination descriptor and the IP address of the router that should be used to reach that destination. Please see RFC 3442 for more details. Example: {30.0.0.0/24,10.0.0.10, 0.0.0.0/0,10.0.0.1} options : ms_classless_static_route: optional string - The DHCPv4 option code for this option is 249. This option is + The DHCPv4 option code for this option is 249. This option is similar to classless_static_route supported by Microsoft Windows DHCPv4 clients. options : next_server: optional string - The DHCPv4 option code for setting the "Next server IP address" + The DHCPv4 option code for setting the "Next server IP address" field in the DHCP header. Boolean DHCP Options: @@ -3568,14 +3573,14 @@ options : T1: optional string, containing an integer, in range 68 to 4,294,967,295 - This specifies the time interval from address assignment until + This specifies the time interval from address assignment until the client begins trying to renew its address. The DHCPv4 option code for this option is 58. options : T2: optional string, containing an integer, in range 68 to 4,294,967,295 - This specifies the time interval from address assignment until - the client begins trying to rebind its address. The DHCPv4 op‐ + This specifies the time interval from address assignment until + the client begins trying to rebind its address. The DHCPv4 op‐ tion code for this option is 59. options : arp_cache_timeout: optional string, containing an integer, in @@ -3598,30 +3603,30 @@ These options accept a string value. options : wpad: optional string - The DHCPv4 option code for this option is 252. This option is - used as part of web proxy auto discovery to provide a URL for a + The DHCPv4 option code for this option is 252. This option is + used as part of web proxy auto discovery to provide a URL for a web proxy. options : bootfile_name: optional string - The DHCPv4 option code for this option is 67. This option is + The DHCPv4 option code for this option is 67. This option is used to identify a bootfile. options : path_prefix: optional string The DHCPv4 option code for this option is 210. In PXELINUX’ case - this option is used to set a common path prefix, instead of de‐ + this option is used to set a common path prefix, instead of de‐ riving it from the bootfile name. options : tftp_server_address: optional string - The DHCPv4 option code for this option is 150. The option con‐ - tains one or more IPv4 addresses that the client MAY use. This + The DHCPv4 option code for this option is 150. The option con‐ + tains one or more IPv4 addresses that the client MAY use. This option is Cisco proprietary, the IEEE standard that matches with this requirement is option 66 (tftp_server). options : hostname: optional string - The DHCPv4 option code for this option is 12. If set, indicates - the DHCPv4 option "Hostname". Alternatively, this option can be + The DHCPv4 option code for this option is 12. If set, indicates + the DHCPv4 option "Hostname". Alternatively, this option can be configured in options:hostname column in table Logi‐‐ - cal_Switch_Port. If Hostname option value is set in both con‐ + cal_Switch_Port. If Hostname option value is set in both con‐ flicting Logical_Switch_Port and DHCP_Options tables, Logi‐‐ cal_Switch_Port takes precedence. @@ -3631,10 +3636,10 @@ names via the Domain Name System. options : bootfile_name_alt: optional string - "bootfile_name_alt" option is used to support iPXE. When both + "bootfile_name_alt" option is used to support iPXE. When both "bootfile_name" and "bootfile_name_alt" are provided by the CMS, - "bootfile_name" will be used for option 67 if the dhcp request - contains etherboot option (175), otherwise "bootfile_name_alt" + "bootfile_name" will be used for option 67 if the dhcp request + contains etherboot option (175), otherwise "bootfile_name_alt" will be used. options : broadcast_address: optional string @@ -3650,7 +3655,7 @@ DHCP Options of type domains: - These options accept string value which is a comma separated list of + These options accept string value which is a comma separated list of domain names. The domain names are encoded based on RFC 1035. options : domain_search_list: optional string @@ -3658,10 +3663,10 @@ DHCPv6 options: - OVN also implements native DHCPv6 support. The CMS should define the - set of DHCPv6 options as key/value pairs. The define DHCPv6 options - will be included in the DHCPv6 response to the DHCPv6 Solicit/Re‐ - quest/Confirm packet from the logical ports having the IPv6 addresses + OVN also implements native DHCPv6 support. The CMS should define the + set of DHCPv6 options as key/value pairs. The define DHCPv6 options + will be included in the DHCPv6 response to the DHCPv6 Solicit/Re‐ + quest/Confirm packet from the logical ports having the IPv6 addresses in the cidr. Mandatory DHCPv6 options: @@ -3669,17 +3674,17 @@ The following options must be defined. options : server_id: optional string - The Ethernet address for the DHCP server to use. This is also - included in the DHCPv6 reply as option 2, ``Server Identifier’’ - to carry a DUID identifying a server between a client and a - server. ovn-controller defines DUID based on Link-layer Address + The Ethernet address for the DHCP server to use. This is also + included in the DHCPv6 reply as option 2, ``Server Identifier’’ + to carry a DUID identifying a server between a client and a + server. ovn-controller defines DUID based on Link-layer Address [DUID-LL]. IPv6 DHCPv6 options: - Below are the supported DHCPv6 options whose values are an IPv6 ad‐ - dress, e.g. aef0::4. Some options accept multiple IPv6 addresses en‐ - closed within curly braces, e.g. {aef0::4, aef0::5}. Please refer to + Below are the supported DHCPv6 options whose values are an IPv6 ad‐ + dress, e.g. aef0::4. Some options accept multiple IPv6 addresses en‐ + closed within curly braces, e.g. {aef0::4, aef0::5}. Please refer to RFC 3315 for more details on DHCPv6 options and their codes. options : dns_server: optional string @@ -3692,21 +3697,21 @@ options : domain_search: optional string The DHCPv6 option code for this option is 24. This option speci‐ - fies the domain search list the client should use to resolve + fies the domain search list the client should use to resolve hostnames with DNS. Example: "ovn.org". options : dhcpv6_stateless: optional string - This option specifies the OVN native DHCPv6 will work in state‐ + This option specifies the OVN native DHCPv6 will work in state‐ less mode, which means OVN native DHCPv6 will not offer IPv6 ad‐ - dresses for VM/VIF ports, but only reply other configurations, - such as DNS and domain search list. When setting this option - with string value "true", VM/VIF will configure IPv6 addresses + dresses for VM/VIF ports, but only reply other configurations, + such as DNS and domain search list. When setting this option + with string value "true", VM/VIF will configure IPv6 addresses by stateless way. Default value for this option is false. options : fqdn: optional string - The DHCPv6 option code for this option is 39. If set, indicates + The DHCPv6 option code for this option is 39. If set, indicates the DHCPv6 option "FQDN". Common Columns: @@ -3715,14 +3720,14 @@ See External IDs at the beginning of this document. Connection TABLE - Configuration for a database connection to an Open vSwitch database + Configuration for a database connection to an Open vSwitch database (OVSDB) client. - This table primarily configures the Open vSwitch database server + This table primarily configures the Open vSwitch database server (ovsdb-server). - The Open vSwitch database server can initiate and maintain active con‐ - nections to remote clients. It can also listen for database connec‐ + The Open vSwitch database server can initiate and maintain active con‐ + nections to remote clients. It can also listen for database connec‐ tions. Summary: @@ -3734,17 +3739,17 @@ Status: is_connected boolean status : last_error optional string - status : state optional string, one of ACTIVE, BACKOFF, + status : state optional string, one of ACTIVE, BACKOFF, CONNECTING, IDLE, or VOID - status : sec_since_connect optional string, containing an integer, + status : sec_since_connect optional string, containing an integer, at least 0 status : sec_since_disconnect - optional string, containing an integer, + optional string, containing an integer, at least 0 status : locks_held optional string status : locks_waiting optional string status : locks_lost optional string - status : n_connections optional string, containing an integer, + status : n_connections optional string, containing an integer, at least 2 status : bound_port optional string, containing an integer Common Columns: @@ -3760,20 +3765,20 @@ The following connection methods are currently supported: ssl:host[:port] - The specified SSL port on the host at the given host, + The specified SSL port on the host at the given host, which can either be a DNS name (if built with unbound li‐ - brary) or an IP address. A valid SSL configuration must - be provided when this form is used, this configuration - can be specified via command-line options or the SSL ta‐ + brary) or an IP address. A valid SSL configuration must + be provided when this form is used, this configuration + can be specified via command-line options or the SSL ta‐ ble. If port is not specified, it defaults to 6640. - SSL support is an optional feature that is not always + SSL support is an optional feature that is not always built as part of Open vSwitch. tcp:host[:port] - The specified TCP port on the host at the given host, + The specified TCP port on the host at the given host, which can either be a DNS name (if built with unbound li‐ brary) or an IP address. If host is an IPv6 address, wrap it in square brackets, e.g. tcp:[::1]:6640. @@ -3781,54 +3786,54 @@ If port is not specified, it defaults to 6640. pssl:[port][:host] - Listens for SSL connections on the specified TCP port. - Specify 0 for port to have the kernel automatically - choose an available port. If host, which can either be a - DNS name (if built with unbound library) or an IP ad‐ - dress, is specified, then connections are restricted to + Listens for SSL connections on the specified TCP port. + Specify 0 for port to have the kernel automatically + choose an available port. If host, which can either be a + DNS name (if built with unbound library) or an IP ad‐ + dress, is specified, then connections are restricted to the resolved or specified local IPaddress (either IPv4 or IPv6 address). If host is an IPv6 address, wrap in square - brackets, e.g. pssl:6640:[::1]. If host is not specified - then it listens only on IPv4 (but not IPv6) addresses. A - valid SSL configuration must be provided when this form - is used, this can be specified either via command-line + brackets, e.g. pssl:6640:[::1]. If host is not specified + then it listens only on IPv4 (but not IPv6) addresses. A + valid SSL configuration must be provided when this form + is used, this can be specified either via command-line options or the SSL table. If port is not specified, it defaults to 6640. - SSL support is an optional feature that is not always + SSL support is an optional feature that is not always built as part of Open vSwitch. ptcp:[port][:host] - Listens for connections on the specified TCP port. Spec‐ + Listens for connections on the specified TCP port. Spec‐ ify 0 for port to have the kernel automatically choose an - available port. If host, which can either be a DNS name - (if built with unbound library) or an IP address, is - specified, then connections are restricted to the re‐ + available port. If host, which can either be a DNS name + (if built with unbound library) or an IP address, is + specified, then connections are restricted to the re‐ solved or specified local IP address (either IPv4 or IPv6 - address). If host is an IPv6 address, wrap it in square - brackets, e.g. ptcp:6640:[::1]. If host is not specified + address). If host is an IPv6 address, wrap it in square + brackets, e.g. ptcp:6640:[::1]. If host is not specified then it listens only on IPv4 addresses. If port is not specified, it defaults to 6640. - When multiple clients are configured, the target values must be + When multiple clients are configured, the target values must be unique. Duplicate target values yield unspecified results. Client Failure Detection and Handling: max_backoff: optional integer, at least 1,000 - Maximum number of milliseconds to wait between connection at‐ + Maximum number of milliseconds to wait between connection at‐ tempts. Default is implementation-specific. inactivity_probe: optional integer Maximum number of milliseconds of idle time on connection to the - client before sending an inactivity probe message. If Open - vSwitch does not communicate with the client for the specified - number of seconds, it will send a probe. If a response is not - received for the same additional amount of time, Open vSwitch - assumes the connection has been broken and attempts to recon‐ - nect. Default is implementation-specific. A value of 0 disables + client before sending an inactivity probe message. If Open + vSwitch does not communicate with the client for the specified + number of seconds, it will send a probe. If a response is not + received for the same additional amount of time, Open vSwitch + assumes the connection has been broken and attempts to recon‐ + nect. Default is implementation-specific. A value of 0 disables inactivity probes. Status: @@ -3837,12 +3842,12 @@ in the status columns may be updated depends on the target type. When target specifies a connection method that listens for inbound con‐ - nections (e.g. ptcp: or punix:), both n_connections and is_connected + nections (e.g. ptcp: or punix:), both n_connections and is_connected may also be updated while the remaining key-value pairs are omitted. - On the other hand, when target specifies an outbound connection, all - key-value pairs may be updated, except the above-mentioned two key- - value pairs associated with inbound connection targets. They are omit‐ + On the other hand, when target specifies an outbound connection, all + key-value pairs may be updated, except the above-mentioned two key- + value pairs associated with inbound connection targets. They are omit‐ ted. is_connected: boolean @@ -3850,7 +3855,7 @@ status : last_error: optional string A human-readable description of the last error on the connection - to the manager; i.e. strerror(errno). This key will exist only + to the manager; i.e. strerror(errno). This key will exist only if an error has occurred. status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, @@ -3869,7 +3874,7 @@ IDLE Connection is idle. Waiting for response to keep-alive. - These values may change in the future. They are provided only + These values may change in the future. They are provided only for human consumption. status : sec_since_connect: optional string, containing an integer, at @@ -3880,48 +3885,48 @@ status : sec_since_disconnect: optional string, containing an integer, at least 0 - The amount of time since this client last disconnected from the - database (in seconds). Value is empty if client has never dis‐ + The amount of time since this client last disconnected from the + database (in seconds). Value is empty if client has never dis‐ connected. status : locks_held: optional string - Space-separated list of the names of OVSDB locks that the con‐ - nection holds. Omitted if the connection does not hold any + Space-separated list of the names of OVSDB locks that the con‐ + nection holds. Omitted if the connection does not hold any locks. status : locks_waiting: optional string - Space-separated list of the names of OVSDB locks that the con‐ - nection is currently waiting to acquire. Omitted if the connec‐ + Space-separated list of the names of OVSDB locks that the con‐ + nection is currently waiting to acquire. Omitted if the connec‐ tion is not waiting for any locks. status : locks_lost: optional string - Space-separated list of the names of OVSDB locks that the con‐ - nection has had stolen by another OVSDB client. Omitted if no + Space-separated list of the names of OVSDB locks that the con‐ + nection has had stolen by another OVSDB client. Omitted if no locks have been stolen from this connection. status : n_connections: optional string, containing an integer, at least 2 - When target specifies a connection method that listens for in‐ - bound connections (e.g. ptcp: or pssl:) and more than one con‐ - nection is actually active, the value is the number of active + When target specifies a connection method that listens for in‐ + bound connections (e.g. ptcp: or pssl:) and more than one con‐ + nection is actually active, the value is the number of active connections. Otherwise, this key-value pair is omitted. status : bound_port: optional string, containing an integer When target is ptcp: or pssl:, this is the TCP port on which the - OVSDB server is listening. (This is particularly useful when - target specifies a port of 0, allowing the kernel to choose any + OVSDB server is listening. (This is particularly useful when + target specifies a port of 0, allowing the kernel to choose any available port.) Common Columns: - The overall purpose of these columns is described under Common Columns + The overall purpose of these columns is described under Common Columns at the beginning of this document. external_ids: map of string-string pairs other_config: map of string-string pairs DNS TABLE - Each row in this table stores the DNS records. The Logical_Switch ta‐ + Each row in this table stores the DNS records. The Logical_Switch ta‐ ble’s dns_records references these records. Summary: @@ -3933,8 +3938,8 @@ records: map of string-string pairs Key-value pair of DNS records with DNS query name as the key and value as a string of IP address(es) separated by comma or space. - For PTR requests, the key-value pair can be Reverse IPv4 ad‐‐ - dress.in-addr.arpa and the value DNS domain name. For IPv6 ad‐ + For PTR requests, the key-value pair can be Reverse IPv4 ad‐‐ + dress.in-addr.arpa and the value DNS domain name. For IPv6 ad‐ dresses, the key has to be Reverse IPv6 address.ip6.arpa. Example: "vm1.ovn.org" = "10.0.0.4 aef0::4" @@ -3942,13 +3947,13 @@ Example: "4.0.0.10.in-addr.arpa" = "vm1.ovn.org" options : ovn-owned: optional string - If set to true, then the OVN will be the main responsible for + If set to true, then the OVN will be the main responsible for DNS Records within this row. - A DNS row with this option set to true can be created for do‐ - mains that the user needs to configure locally and don’t care - about IPv6 only interested in IPv4 or vice versa. This will let - ovn send IPv4 DNS reply and reject/ignore IPv6 queries to save + A DNS row with this option set to true can be created for do‐ + mains that the user needs to configure locally and don’t care + about IPv6 only interested in IPv4 or vice versa. This will let + ovn send IPv4 DNS reply and reject/ignore IPv6 queries to save the waiting for a timeout on those uninteresting queries. external_ids: map of string-string pairs @@ -3969,28 +3974,28 @@ Details: private_key: string - Name of a PEM file containing the private key used as the + Name of a PEM file containing the private key used as the switch’s identity for SSL connections to the controller. certificate: string - Name of a PEM file containing a certificate, signed by the cer‐ + Name of a PEM file containing a certificate, signed by the cer‐ tificate authority (CA) used by the controller and manager, that - certifies the switch’s private key, identifying a trustworthy + certifies the switch’s private key, identifying a trustworthy switch. ca_cert: string - Name of a PEM file containing the CA certificate used to verify + Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller. bootstrap_ca_cert: boolean - If set to true, then Open vSwitch will attempt to obtain the CA - certificate from the controller on its first SSL connection and - save it to the named PEM file. If it is successful, it will im‐ - mediately drop the connection and reconnect, and from then on - all SSL connections must be authenticated by a certificate - signed by the CA certificate thus obtained. This option exposes - the SSL connection to a man-in-the-middle attack obtaining the - initial CA certificate. It may still be useful for bootstrap‐ + If set to true, then Open vSwitch will attempt to obtain the CA + certificate from the controller on its first SSL connection and + save it to the named PEM file. If it is successful, it will im‐ + mediately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certificate + signed by the CA certificate thus obtained. This option exposes + the SSL connection to a man-in-the-middle attack obtaining the + initial CA certificate. It may still be useful for bootstrap‐ ping. ssl_protocols: string @@ -3998,18 +4003,18 @@ fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2. ssl_ciphers: string - List of ciphers (in OpenSSL cipher string format) to be sup‐ - ported for SSL connections. The default when this option is + List of ciphers (in OpenSSL cipher string format) to be sup‐ + ported for SSL connections. The default when this option is omitted is HIGH:!aNULL:!MD5. Common Columns: - The overall purpose of these columns is described under Common Columns + The overall purpose of these columns is described under Common Columns at the beginning of this document. external_ids: map of string-string pairs Gateway_Chassis TABLE - Association of a chassis to a logical router port. The traffic going + Association of a chassis to a logical router port. The traffic going out through an specific router port will be redirected to a chassis, or a set of them in high availability configurations. @@ -4030,11 +4035,11 @@ chassis_name: string Name of the chassis that we want to redirect traffic through for - the associated logical router port. The value must match the + the associated logical router port. The value must match the name column of the Chassis table in the OVN_Southbound database. priority: integer, in range 0 to 32,767 - This is the priority of a chassis among all Gateway_Chassis be‐ + This is the priority of a chassis among all Gateway_Chassis be‐ longing to the same logical router port. options: map of string-string pairs @@ -4047,11 +4052,11 @@ HA_Chassis_Group TABLE Table representing a group of chassis which can provide high availabil‐ - ity services. Each chassis in the group is represented by the table - HA_Chassis. The HA chassis with highest priority will be the master of - this group. If the master chassis failover is detected, the HA chassis - with the next higher priority takes over the responsibility of provid‐ - ing the HA. If a distributed gateway router port references a row in + ity services. Each chassis in the group is represented by the table + HA_Chassis. The HA chassis with highest priority will be the master of + this group. If the master chassis failover is detected, the HA chassis + with the next higher priority takes over the responsibility of provid‐ + ing the HA. If a distributed gateway router port references a row in this table, then the master HA chassis in this group provides the gate‐ way functionality. @@ -4082,12 +4087,12 @@ Details: chassis_name: string - Name of the chassis which is part of the HA chassis group. The - value must match the name column of the Chassis table in the + Name of the chassis which is part of the HA chassis group. The + value must match the name column of the Chassis table in the OVN_Southbound database. priority: integer, in range 0 to 32,767 - Priority of the chassis. Chassis with highest priority will be + Priority of the chassis. Chassis with highest priority will be the master. Common Columns: @@ -4096,13 +4101,13 @@ See External IDs at the beginning of this document. BFD TABLE - Contains BFD parameter for ovn-controller BFD configuration. OVN BFD + Contains BFD parameter for ovn-controller BFD configuration. OVN BFD implementation is used to provide detection of failures in the path be‐ - tween adjacent forwarding engines, including the OVN interfaces. OVN - BFD provides link status info to OVN northd in order to update logical - flows according to the status of BFD endpoints. In the current imple‐ - mentation OVN BFD is used to check next-hop status for ECMP routes. - Please note BFD table refers to OVN BFD implementation and not to OVS + tween adjacent forwarding engines, including the OVN interfaces. OVN + BFD provides link status info to OVN northd in order to update logical + flows according to the status of BFD endpoints. In the current imple‐ + mentation OVN BFD is used to check next-hop status for ECMP routes. + Please note BFD table refers to OVN BFD implementation and not to OVS legacy one. Summary: @@ -4130,21 +4135,21 @@ BFD peer IP address. min_tx: optional integer, at least 1 - This is the minimum interval, in milliseconds, that the local - system would like to use when transmitting BFD Control packets, - less any jitter applied. The value zero is reserved. Default + This is the minimum interval, in milliseconds, that the local + system would like to use when transmitting BFD Control packets, + less any jitter applied. The value zero is reserved. Default value is 1000 ms. min_rx: optional integer - This is the minimum interval, in milliseconds, between received - BFD Control packets that this system is capable of supporting, - less any jitter applied by the sender. If this value is zero, - the transmitting system does not want the remote system to send + This is the minimum interval, in milliseconds, between received + BFD Control packets that this system is capable of supporting, + less any jitter applied by the sender. If this value is zero, + the transmitting system does not want the remote system to send any periodic BFD Control packets. detect_mult: optional integer, at least 1 - Detection time multiplier. The negotiated transmit interval, - multiplied by this value, provides the Detection Time for the + Detection time multiplier. The negotiated transmit interval, + multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode. Default value is 5. options: map of string-string pairs @@ -4180,7 +4185,7 @@ Details: Configuration: - ovn-northd reads configuration from these columns and propagates the + ovn-northd reads configuration from these columns and propagates the value to SBDB. logical_port: string @@ -4196,19 +4201,19 @@ Override dynamically learnt MACs. Chassis_Template_Var TABLE - One record per chassis, each containing a map, variables, between tem‐ - plate variable names and their value for that specific chassis. A tem‐ + One record per chassis, each containing a map, variables, between tem‐ + plate variable names and their value for that specific chassis. A tem‐ plate variable has a name and potentially different values on different - hypervisors in the OVN cluster. For example, two rows, R1 = (.chas‐‐ - sis=C1, variables={(N: V1)} and R2 = (.chassis=C2, variables={(N: V2)} + hypervisors in the OVN cluster. For example, two rows, R1 = (.chas‐‐ + sis=C1, variables={(N: V1)} and R2 = (.chassis=C2, variables={(N: V2)} will make ovn-controller running on chassis C1 and C2 interpret the to‐ - ken N either as V1 (on C1) or as V2 (on C2). Users can refer to tem‐ + ken N either as V1 (on C1) or as V2 (on C2). Users can refer to tem‐ plate variables from within other logical components, e.g., within ACL, - QoS or Logical_Router_Policy matches or from Load_Balancer VIP and + QoS or Logical_Router_Policy matches or from Load_Balancer VIP and backend definitions. - If a template variable is referenced on a chassis for which that vari‐ - able is not defined then ovn-controller running on that chassis will + If a template variable is referenced on a chassis for which that vari‐ + able is not defined then ovn-controller running on that chassis will just interpret it as a raw string literal. Summary: diff --git a/src/static/support/dist-docs/ovn-nb.5.pdf b/src/static/support/dist-docs/ovn-nb.5.pdf index c1550683..56988eaf 100644 Binary files a/src/static/support/dist-docs/ovn-nb.5.pdf and b/src/static/support/dist-docs/ovn-nb.5.pdf differ diff --git a/src/static/support/dist-docs/ovn-nb.5.txt b/src/static/support/dist-docs/ovn-nb.5.txt index 85fd1e6e..b853a31a 100644 --- a/src/static/support/dist-docs/ovn-nb.5.txt +++ b/src/static/support/dist-docs/ovn-nb.5.txt @@ -914,6 +914,7 @@ Logical_Switch_Port TABLE options : qos_max_rate optional string options : qos_burst optional string options : hostname optional string + options : pkt_clone_type optional string, must be mc_unknown VIF Plugging Options: options : vif-plug-type optional string @@ -1235,22 +1236,26 @@ Logical_Switch_Port TABLE for this Logical Switch Port, hostname dhcp option will be in‐ cluded in DHCP reply. + options : pkt_clone_type: optional string, must be mc_unknown + If set to mc_unknown, packets going to this VIF get cloned to + all unknown ports connected to the same Logical Switch. + VIF Plugging Options: options : vif-plug-type: optional string If set, OVN will attempt to perform plugging of this VIF. In or‐ - der to get this port plugged by the OVN controller, OVN must be + der to get this port plugged by the OVN controller, OVN must be built with support for VIF plugging. The default behavior is for - the CMS to do the VIF plugging. Each VIF plug provider have + the CMS to do the VIF plugging. Each VIF plug provider have their own options namespaced by name, for example "vif-plug:rep‐ - resentor:key". Please refer to the VIF plug provider documenta‐ + resentor:key". Please refer to the VIF plug provider documenta‐ tion located in Documentation/topics/vif-plug-providers/ for more information. options : vif-plug-mtu-request: optional string - Requested MTU for plugged interfaces. When set the OVN con‐ - troller will fill the mtu_request column of the Open vSwitch - database’s Interface table. This in turn will make OVS vswitchd + Requested MTU for plugged interfaces. When set the OVN con‐ + troller will fill the mtu_request column of the Open vSwitch + database’s Interface table. This in turn will make OVS vswitchd update the MTU of the linked interface. Virtual port Options: @@ -1262,9 +1267,9 @@ Logical_Switch_Port TABLE options : virtual-parents: optional string This options represents a set of logical port names (with in the - same logical switch) which can own the virtual ip configured in + same logical switch) which can own the virtual ip configured in the options:virtual-ip. All these virtual parents should add the - virtual ip in the port_security if port security addressed are + virtual ip in the port_security if port security addressed are enabled. IP Multicast Snooping Options: @@ -1273,78 +1278,78 @@ Logical_Switch_Port TABLE other_config :mcast_snoop set to true. options : mcast_flood: optional string, either true or false - If set to true, multicast packets (except reports) are uncondi‐ + If set to true, multicast packets (except reports) are uncondi‐ tionally forwarded to the specific port. Default: false. options : mcast_flood_reports: optional string, either true or false - If set to true, multicast reports are unconditionally forwarded + If set to true, multicast reports are unconditionally forwarded to the specific port. Default: false. Containers: When a large number of containers are nested within a VM, it may be too expensive to dedicate a VIF to each container. OVN can use VLAN tags to - support such cases. Each container is assigned a VLAN ID and each + support such cases. Each container is assigned a VLAN ID and each packet that passes between the hypervisor and the VM is tagged with the appropriate ID for the container. Such VLAN IDs never appear on a phys‐ ical wire, even inside a tunnel, so they need not be unique except rel‐ ative to a single VM on a hypervisor. - These columns are used for VIFs that represent nested containers using - shared VIFs. For VMs and for containers that have dedicated VIFs, they + These columns are used for VIFs that represent nested containers using + shared VIFs. For VMs and for containers that have dedicated VIFs, they are empty. parent_name: optional string - The VM interface through which the nested container sends its - network traffic. This must match the name column for some other + The VM interface through which the nested container sends its + network traffic. This must match the name column for some other Logical_Switch_Port. Note: for performance of the OVN Southbound - database conditional monitoring, unlike for regular VIFs, + database conditional monitoring, unlike for regular VIFs, ovn-controller will register to get updates about all OVN South‐ - bound database Port_Binding table records that correspond to - nested container ports even if external_ids:ovn-monitor-all is + bound database Port_Binding table records that correspond to + nested container ports even if external_ids:ovn-monitor-all is set to false. See ovn-controller(8) for more information. tag_request: optional integer, in range 0 to 4,095 - The VLAN tag in the network traffic associated with a con‐ + The VLAN tag in the network traffic associated with a con‐ tainer’s network interface. The client can request ovn-northd to - allocate a tag that is unique within the scope of a specific - parent (specified in parent_name) by setting a value of 0 in + allocate a tag that is unique within the scope of a specific + parent (specified in parent_name) by setting a value of 0 in this column. The allocated value is written by ovn-northd in the - tag column. (Note that these tags are allocated and managed lo‐ - cally in ovn-northd, so they cannot be reconstructed in the - event that the database is lost.) The client can also request a + tag column. (Note that these tags are allocated and managed lo‐ + cally in ovn-northd, so they cannot be reconstructed in the + event that the database is lost.) The client can also request a specific non-zero tag and ovn-northd will honor it and copy that value to the tag column. - When type is set to localnet or l2gateway, this can be set to - indicate that the port represents a connection to a specific - VLAN on a locally accessible network. The VLAN ID is used to + When type is set to localnet or l2gateway, this can be set to + indicate that the port represents a connection to a specific + VLAN on a locally accessible network. The VLAN ID is used to match incoming traffic and is also added to outgoing traffic. tag: optional integer, in range 1 to 4,095 - The VLAN tag allocated by ovn-northd based on the contents of + The VLAN tag allocated by ovn-northd based on the contents of the tag_request column. Port State: up: optional boolean - This column is populated by ovn-northd, rather than by the CMS + This column is populated by ovn-northd, rather than by the CMS plugin as is most of this database. When a logical port is bound - to a physical location in the OVN Southbound database Binding + to a physical location in the OVN Southbound database Binding table, ovn-northd sets this column to true; otherwise, or if the - port becomes unbound later, it sets it to false. If this column - is empty, the port is not considered up. This allows the CMS to + port becomes unbound later, it sets it to false. If this column + is empty, the port is not considered up. This allows the CMS to wait for a VM’s (or container’s) networking to become active be‐ fore it allows the VM (or container) to start. Logical ports of router type are an exception to this rule. They - are considered to be always up, that is this column is always + are considered to be always up, that is this column is always set to true. enabled: optional boolean - This column is used to administratively set port state. If this - column is empty or is set to true, the port is enabled. If this - column is set to false, the port is disabled. A disabled port + This column is used to administratively set port state. If this + column is empty or is set to true, the port is enabled. If this + column is set to false, the port is disabled. A disabled port has all ingress and egress traffic dropped. Addressing: @@ -1357,164 +1362,164 @@ Logical_Switch_Port TABLE Ethernet address followed by zero or more IPv4 or IPv6 addresses (or both) An Ethernet address defined is owned by the logical port. - Like a physical Ethernet NIC, a logical port ordinarily + Like a physical Ethernet NIC, a logical port ordinarily has a single fixed Ethernet address. - When a OVN logical switch processes a unicast Ethernet - frame whose destination MAC address is in a logical - port’s addresses column, it delivers it only to that - port, as if a MAC learning process had learned that MAC + When a OVN logical switch processes a unicast Ethernet + frame whose destination MAC address is in a logical + port’s addresses column, it delivers it only to that + port, as if a MAC learning process had learned that MAC address on the port. If IPv4 or IPv6 address(es) (or both) are defined, it in‐ - dicates that the logical port owns the given IP ad‐ + dicates that the logical port owns the given IP ad‐ dresses. - If IPv4 address(es) are defined, the OVN logical switch - uses this information to synthesize responses to ARP re‐ - quests without traversing the physical network. The OVN - logical router connected to the logical switch, if any, - uses this information to avoid issuing ARP requests for + If IPv4 address(es) are defined, the OVN logical switch + uses this information to synthesize responses to ARP re‐ + quests without traversing the physical network. The OVN + logical router connected to the logical switch, if any, + uses this information to avoid issuing ARP requests for logical switch ports. - Note that the order here is important. The Ethernet ad‐ - dress must be listed before the IP address(es) if de‐ + Note that the order here is important. The Ethernet ad‐ + dress must be listed before the IP address(es) if de‐ fined. Examples: 80:fa:5b:06:72:b7 - This indicates that the logical port owns the + This indicates that the logical port owns the above mac address. 80:fa:5b:06:72:b7 10.0.0.4 20.0.0.4 - This indicates that the logical port owns the mac + This indicates that the logical port owns the mac address and two IPv4 addresses. 80:fa:5b:06:72:b7 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41 - This indicates that the logical port owns the mac + This indicates that the logical port owns the mac address and 1 IPv6 address. 80:fa:5b:06:72:b7 10.0.0.4 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41 - This indicates that the logical port owns the mac + This indicates that the logical port owns the mac address and 1 IPv4 address and 1 IPv6 address. unknown - This indicates that the logical port has an unknown set - of Ethernet addresses. When an OVN logical switch - processes a unicast Ethernet frame whose destination MAC + This indicates that the logical port has an unknown set + of Ethernet addresses. When an OVN logical switch + processes a unicast Ethernet frame whose destination MAC address is not in any logical port’s addresses column, it - delivers it to the port (or ports) whose addresses + delivers it to the port (or ports) whose addresses columns include unknown. dynamic Use dynamic to make ovn-northd generate a globally unique MAC address, choose an unused IPv4 address with the logi‐ - cal port’s subnet (if other_config:subnet is set in the + cal port’s subnet (if other_config:subnet is set in the port’s Logical_Switch), and generate an IPv6 address from - the MAC address (if other_config:ipv6_prefix is set in - the port’s Logical_Switch) and store them in the port’s + the MAC address (if other_config:ipv6_prefix is set in + the port’s Logical_Switch) and store them in the port’s dynamic_addresses column. - Only one element containing dynamic may appear in ad‐ + Only one element containing dynamic may appear in ad‐ dresses. dynamic ip dynamic ipv6 dynamic ip ipv6 These act like dynamic alone but specify particular IPv4 or - IPv6 addresses to use. OVN IPAM will still automatically + IPv6 addresses to use. OVN IPAM will still automatically allocate the other address if configured appropriately. Ex‐ ample: dynamic 192.168.0.1 2001::1. mac dynamic This acts like dynamic alone but specifies a particular MAC - address to use. OVN IPAM will still automatically allocate - IPv4 or IPv6 addresses, or both, if configured appropri‐ + address to use. OVN IPAM will still automatically allocate + IPv4 or IPv6 addresses, or both, if configured appropri‐ ately. Example: 80:fa:5b:06:72:b7 dynamic router - Accepted only when type is router. This indicates that the - Ethernet, IPv4, and IPv6 addresses for this logical switch - port should be obtained from the connected logical router + Accepted only when type is router. This indicates that the + Ethernet, IPv4, and IPv6 addresses for this logical switch + port should be obtained from the connected logical router port, as specified by router-port in options. - The resulting addresses are used to populate the logical - switch’s destination lookup, and also for the logical + The resulting addresses are used to populate the logical + switch’s destination lookup, and also for the logical switch to generate ARP and ND replies. - If the connected logical router port has a distributed - gateway port specified and the logical router has rules - specified in nat with external_mac, then those addresses + If the connected logical router port has a distributed + gateway port specified and the logical router has rules + specified in nat with external_mac, then those addresses are also used to populate the switch’s destination lookup. - Supported only in OVN 2.7 and later. Earlier versions re‐ + Supported only in OVN 2.7 and later. Earlier versions re‐ quired router addresses to be manually synchronized. dynamic_addresses: optional string Addresses assigned to the logical port by ovn-northd, if dynamic - is specified in addresses. Addresses will be of the same format - as those that populate the addresses column. Note that dynami‐ - cally assigned addresses are constructed and managed locally in - ovn-northd, so they cannot be reconstructed in the event that + is specified in addresses. Addresses will be of the same format + as those that populate the addresses column. Note that dynami‐ + cally assigned addresses are constructed and managed locally in + ovn-northd, so they cannot be reconstructed in the event that the database is lost. port_security: set of strings - This column controls the addresses from which the host attached - to the logical port (``the host’’) is allowed to send packets + This column controls the addresses from which the host attached + to the logical port (``the host’’) is allowed to send packets and to which it is allowed to receive packets. If this column is empty, all addresses are permitted. - Each element in the set must begin with one Ethernet address. + Each element in the set must begin with one Ethernet address. This would restrict the host to sending packets from and receiv‐ - ing packets to the ethernet addresses defined in the logical - port’s port_security column. It also restricts the inner source - MAC addresses that the host may send in ARP and IPv6 Neighbor + ing packets to the ethernet addresses defined in the logical + port’s port_security column. It also restricts the inner source + MAC addresses that the host may send in ARP and IPv6 Neighbor Discovery packets. The host is always allowed to receive packets to multicast and broadcast Ethernet addresses. - Each element in the set may additionally contain one or more + Each element in the set may additionally contain one or more IPv4 or IPv6 addresses (or both), with optional masks. If a mask - is given, it must be a CIDR mask. In addition to the restric‐ - tions described for Ethernet addresses above, such an element - restricts the IPv4 or IPv6 addresses from which the host may - send and to which it may receive packets to the specified ad‐ - dresses. A masked address, if the host part is zero, indicates - that the host is allowed to use any address in the subnet; if - the host part is nonzero, the mask simply indicates the size of + is given, it must be a CIDR mask. In addition to the restric‐ + tions described for Ethernet addresses above, such an element + restricts the IPv4 or IPv6 addresses from which the host may + send and to which it may receive packets to the specified ad‐ + dresses. A masked address, if the host part is zero, indicates + that the host is allowed to use any address in the subnet; if + the host part is nonzero, the mask simply indicates the size of the subnet. In addition: • If any IPv4 address is given, the host is also allowed to - receive packets to the IPv4 local broadcast address + receive packets to the IPv4 local broadcast address 255.255.255.255 and to IPv4 multicast addresses - (224.0.0.0/4). If an IPv4 address with a mask is given, + (224.0.0.0/4). If an IPv4 address with a mask is given, the host is also allowed to receive packets to the broad‐ cast address in that specified subnet. - If any IPv4 address is given, the host is additionally - restricted to sending ARP packets with the specified + If any IPv4 address is given, the host is additionally + restricted to sending ARP packets with the specified source IPv4 address. (RARP is not restricted.) • If any IPv6 address is given, the host is also allowed to receive packets to IPv6 multicast addresses (ff00::/8). - If any IPv6 address is given, the host is additionally - restricted to sending IPv6 Neighbor Discovery Solicita‐ - tion or Advertisement packets with the specified source + If any IPv6 address is given, the host is additionally + restricted to sending IPv6 Neighbor Discovery Solicita‐ + tion or Advertisement packets with the specified source address or, for solicitations, the unspecified address. - If an element includes an IPv4 address, but no IPv6 addresses, + If an element includes an IPv4 address, but no IPv6 addresses, then IPv6 traffic is not allowed. If an element includes an IPv6 - address, but no IPv4 address, then IPv4 and ARP traffic is not + address, but no IPv4 address, then IPv4 and ARP traffic is not allowed. - This column uses the same lexical syntax as the match column in + This column uses the same lexical syntax as the match column in the OVN Southbound database’s Pipeline table. Multiple addresses within an element may be space or comma separated. - This column is provided as a convenience to cloud management - systems, but all of the features that it implements can be im‐ + This column is provided as a convenience to cloud management + systems, but all of the features that it implements can be im‐ plemented as ACLs using the ACL table. Examples: @@ -1523,52 +1528,52 @@ Logical_Switch_Port TABLE The host may send traffic from and receive traffic to the specified MAC address, and to receive traffic to Ethernet multicast and broadcast addresses, but not otherwise. The - host may not send ARP or IPv6 Neighbor Discovery packets - with inner source Ethernet addresses other than the one + host may not send ARP or IPv6 Neighbor Discovery packets + with inner source Ethernet addresses other than the one specified. 80:fa:5b:06:72:b7 192.168.1.10/24 - This adds further restrictions to the first example. The - host may send IPv4 packets from or receive IPv4 packets - to only 192.168.1.10, except that it may also receive + This adds further restrictions to the first example. The + host may send IPv4 packets from or receive IPv4 packets + to only 192.168.1.10, except that it may also receive IPv4 packets to 192.168.1.255 (based on the subnet mask), 255.255.255.255, and any address in 224.0.0.0/4. The host - may not send ARPs with a source Ethernet address other - than 80:fa:5b:06:72:b7 or source IPv4 address other than - 192.168.1.10. The host may not send or receive any IPv6 + may not send ARPs with a source Ethernet address other + than 80:fa:5b:06:72:b7 or source IPv4 address other than + 192.168.1.10. The host may not send or receive any IPv6 (including IPv6 Neighbor Discovery) traffic. "80:fa:5b:12:42:ba", "80:fa:5b:06:72:b7 192.168.1.10/24" The host may send traffic from and receive traffic to the specified MAC addresses, and to receive traffic to Ether‐ net multicast and broadcast addresses, but not otherwise. - With MAC 80:fa:5b:12:42:ba, the host may send traffic - from and receive traffic to any L3 address. With MAC + With MAC 80:fa:5b:12:42:ba, the host may send traffic + from and receive traffic to any L3 address. With MAC 80:fa:5b:06:72:b7, the host may send IPv4 packets from or receive IPv4 packets to only 192.168.1.10, except that it - may also receive IPv4 packets to 192.168.1.255 (based on - the subnet mask), 255.255.255.255, and any address in - 224.0.0.0/4. The host may not send or receive any IPv6 + may also receive IPv4 packets to 192.168.1.255 (based on + the subnet mask), 255.255.255.255, and any address in + 224.0.0.0/4. The host may not send or receive any IPv6 (including IPv6 Neighbor Discovery) traffic. DHCP: dhcpv4_options: optional weak reference to DHCP_Options - This column defines the DHCPv4 Options to be included by the - ovn-controller when it replies to the DHCPv4 requests. Please + This column defines the DHCPv4 Options to be included by the + ovn-controller when it replies to the DHCPv4 requests. Please see the DHCP_Options table. dhcpv6_options: optional weak reference to DHCP_Options - This column defines the DHCPv6 Options to be included by the - ovn-controller when it replies to the DHCPv6 requests. Please + This column defines the DHCPv6 Options to be included by the + ovn-controller when it replies to the DHCPv6 requests. Please see the DHCP_Options table. mirror_rules: set of weak reference to Mirrors - Mirror rules that apply to logical switch port which is the + Mirror rules that apply to logical switch port which is the source. Please see the Mirror table. ha_chassis_group: optional HA_Chassis_Group - References a row in the OVN Northbound database’s HA_Chas‐ + References a row in the OVN Northbound database’s HA_Chas‐ sis_Group table. It indicates the HA chassis group to use if the type is set to external. If type is not external, this column is ignored. @@ -1576,12 +1581,12 @@ Logical_Switch_Port TABLE Naming: external_ids : neutron:port_name: optional string - This column gives an optional human-friendly name for the port. - This name has no special meaning or purpose other than to pro‐ + This column gives an optional human-friendly name for the port. + This name has no special meaning or purpose other than to pro‐ vide convenience for human interaction with the northbound data‐ base. - Neutron copies this from its own port object’s name. (Neutron + Neutron copies this from its own port object’s name. (Neutron ports do are not assigned human-friendly names by default, so it will often be empty.) @@ -1589,13 +1594,13 @@ Logical_Switch_Port TABLE options : requested-tnl-key: optional string, containing an integer, in range 1 to 32,767 - Configures the port binding tunnel key for the port. Usually - this is not needed because ovn-northd will assign an unique key - for each port by itself. However, if it is configured, - ovn-northd honors the configured value. The typical use case is - for interconnection: the tunnel keys for ports on transit - switches need to be unique globally, so they are maintained in - the global OVN_IC_Southbound database, and ovn-ic simply syncs + Configures the port binding tunnel key for the port. Usually + this is not needed because ovn-northd will assign an unique key + for each port by itself. However, if it is configured, + ovn-northd honors the configured value. The typical use case is + for interconnection: the tunnel keys for ports on transit + switches need to be unique globally, so they are maintained in + the global OVN_IC_Southbound database, and ovn-ic simply syncs the value from OVN_IC_Southbound through this config. Common Columns: @@ -1603,7 +1608,7 @@ Logical_Switch_Port TABLE external_ids: map of string-string pairs See External IDs at the beginning of this document. - The ovn-northd program copies all these pairs into the exter‐ + The ovn-northd program copies all these pairs into the exter‐ nal_ids column of the Port_Binding table in OVN_Southbound data‐ base. @@ -1621,8 +1626,8 @@ Forwarding_Group TABLE Details: name: string - A name for the forwarding group. This name has no special mean‐ - ing or purpose other than to provide convenience for human in‐ + A name for the forwarding group. This name has no special mean‐ + ing or purpose other than to provide convenience for human in‐ teraction with the ovn-nb database. vip: string @@ -1645,19 +1650,19 @@ Forwarding_Group TABLE See External IDs at the beginning of this document. Address_Set TABLE - Each row in this table represents a named set of addresses. An address + Each row in this table represents a named set of addresses. An address set may contain Ethernet, IPv4, or IPv6 addresses with optional bitwise - or CIDR masks. Address set may ultimately be used in ACLs to compare - against fields such as ip4.src or ip6.src. A single address set must - contain addresses of the same type. As an example, the following would + or CIDR masks. Address set may ultimately be used in ACLs to compare + against fields such as ip4.src or ip6.src. A single address set must + contain addresses of the same type. As an example, the following would create an address set with three IP addresses: ovn-nbctl create Address_Set name=set1 addresses=’10.0.0.1 10.0.0.2 10.0.0.3’ Address sets may be used in the match column of the ACL table. For syn‐ - tax information, see the details of the expression language used for - the match column in the Logical_Flow table of the OVN_Southbound data‐ + tax information, see the details of the expression language used for + the match column in the Logical_Flow table of the OVN_Southbound data‐ base. Summary: @@ -1668,7 +1673,7 @@ Address_Set TABLE Details: name: string (must be unique within table) - A name for the address set. Names are ASCII and must match + A name for the address set. Names are ASCII and must match [a-zA-Z_.][a-zA-Z_.0-9]*. addresses: set of strings @@ -1680,27 +1685,27 @@ Address_Set TABLE See External IDs at the beginning of this document. Port_Group TABLE - Each row in this table represents a named group of logical switch + Each row in this table represents a named group of logical switch ports. - Port groups may be used in the match column of the ACL table. For syn‐ - tax information, see the details of the expression language used for - the match column in the Logical_Flow table of the OVN_Southbound data‐ + Port groups may be used in the match column of the ACL table. For syn‐ + tax information, see the details of the expression language used for + the match column in the Logical_Flow table of the OVN_Southbound data‐ base. - For each port group, there are two address sets generated to the Ad‐ - dress_Set table of the OVN_Southbound database, containing the IP ad‐ - dresses of the group of ports, one for IPv4, and the other for IPv6, - with name being the name of the Port_Group followed by a suffix _ip4 - for IPv4 and _ip6 for IPv6. The generated address sets can be used in + For each port group, there are two address sets generated to the Ad‐ + dress_Set table of the OVN_Southbound database, containing the IP ad‐ + dresses of the group of ports, one for IPv4, and the other for IPv6, + with name being the name of the Port_Group followed by a suffix _ip4 + for IPv4 and _ip6 for IPv6. The generated address sets can be used in the same way as regular address sets in the match column of the ACL ta‐ ble. For syntax information, see the details of the expression language - used for the match column in the Logical_Flow table of the OVN_South‐ + used for the match column in the Logical_Flow table of the OVN_South‐ bound database. Summary: name string (must be unique within table) - ports set of weak reference to Logi‐ + ports set of weak reference to Logi‐ cal_Switch_Ports acls set of ACLs Common Columns: @@ -1708,16 +1713,16 @@ Port_Group TABLE Details: name: string (must be unique within table) - A name for the port group. Names are ASCII and must match + A name for the port group. Names are ASCII and must match [a-zA-Z_.][a-zA-Z_.0-9]*. ports: set of weak reference to Logical_Switch_Ports The logical switch ports belonging to the group in uuids. acls: set of ACLs - Access control rules that apply to the port group. Applying an - ACL to a port group has the same effect as applying the ACL to - all logical lswitches that the ports of the port group belong + Access control rules that apply to the port group. Applying an + ACL to a port group has the same effect as applying the ACL to + all logical lswitches that the ports of the port group belong to. Common Columns: @@ -1735,7 +1740,7 @@ Load_Balancer TABLE Health Checks: health_check set of Load_Balancer_Health_Checks ip_port_mappings map of string-string pairs - selection_fields set of strings, one of eth_dst, eth_src, + selection_fields set of strings, one of eth_dst, eth_src, ip_dst, ip_src, tp_dst, or tp_src Common Columns: external_ids map of string-string pairs @@ -1753,89 +1758,89 @@ Load_Balancer TABLE Details: name: string - A name for the load balancer. This name has no special meaning - or purpose other than to provide convenience for human interac‐ + A name for the load balancer. This name has no special meaning + or purpose other than to provide convenience for human interac‐ tion with the ovn-nb database. vips: map of string-string pairs - A map of virtual IP addresses (and an optional port number with - : as a separator) associated with this load balancer and their - corresponding endpoint IP addresses (and optional port numbers + A map of virtual IP addresses (and an optional port number with + : as a separator) associated with this load balancer and their + corresponding endpoint IP addresses (and optional port numbers with : as separators) separated by commas. If the destination IP - address (and port number) of a packet leaving a container or a - VM matches the virtual IP address (and port number) provided - here as a key, then OVN will statefully replace the destination - IP address by one of the provided IP address (and port number) - in this map as a value. IPv4 and IPv6 addresses are supported - for load balancing; however a VIP of one address family may not - be mapped to a destination IP address of a different family. If + address (and port number) of a packet leaving a container or a + VM matches the virtual IP address (and port number) provided + here as a key, then OVN will statefully replace the destination + IP address by one of the provided IP address (and port number) + in this map as a value. IPv4 and IPv6 addresses are supported + for load balancing; however a VIP of one address family may not + be mapped to a destination IP address of a different family. If specifying an IPv6 address with a port, the address portion must - be enclosed in square brackets. Examples for keys are + be enclosed in square brackets. Examples for keys are "192.168.1.4" and "[fd0f::1]:8800". Examples for value are "10.0.0.1, 10.0.0.2" and "20.0.0.10:8800, 20.0.0.11:8800". - When the Load_Balancer is added to the logical_switch, the VIP - has to be in a different subnet than the one used for the logi‐ - cal_switch. Since VIP is in a different subnet, you should con‐ - nect your logical switch to either a OVN logical router or a - real router (this is because the client can now send a packet - with VIP as the destination IP address and router’s mac address + When the Load_Balancer is added to the logical_switch, the VIP + has to be in a different subnet than the one used for the logi‐ + cal_switch. Since VIP is in a different subnet, you should con‐ + nect your logical switch to either a OVN logical router or a + real router (this is because the client can now send a packet + with VIP as the destination IP address and router’s mac address as the destination MAC address). protocol: optional string, one of sctp, tcp, or udp - Valid protocols are tcp, udp, or sctp. This column is useful - when a port number is provided as part of the vips column. If - this column is empty and a port number is provided as part of + Valid protocols are tcp, udp, or sctp. This column is useful + when a port number is provided as part of the vips column. If + this column is empty and a port number is provided as part of vips column, OVN assumes the protocol to be tcp. Health Checks: - OVN supports health checks for load balancer endpoints. When health + OVN supports health checks for load balancer endpoints. When health checks are enabled, the load balancer uses only healthy endpoints. - Suppose that vips contains a key-value pair - 10.0.0.10:80=10.0.0.4:8080,20.0.0.4:8080. To enable health checks for - this virtual’s endpoints, add two key-value pairs to ip_port_mappings, + Suppose that vips contains a key-value pair + 10.0.0.10:80=10.0.0.4:8080,20.0.0.4:8080. To enable health checks for + this virtual’s endpoints, add two key-value pairs to ip_port_mappings, with keys 10.0.0.4 and 20.0.0.4, and add to health_check a reference to - a Load_Balancer_Health_Check row whose vip is set to 10.0.0.10. The + a Load_Balancer_Health_Check row whose vip is set to 10.0.0.10. The same approach can be used for IPv6 as well. health_check: set of Load_Balancer_Health_Checks Load balancer health checks associated with this load balancer. ip_port_mappings: map of string-string pairs - Maps from endpoint IP to a colon-separated pair of logical port - name and source IP, e.g. port_name:sourc_ip for IPv4. Health - checks are sent to this port with the specified source IP. For - IPv6 square brackets must be used around IP address, e.g: + Maps from endpoint IP to a colon-separated pair of logical port + name and source IP, e.g. port_name:sourc_ip for IPv4. Health + checks are sent to this port with the specified source IP. For + IPv6 square brackets must be used around IP address, e.g: port_name:[sourc_ip] - For example, in the example above, IP to port mappings might be - defined as 10.0.0.4=sw0-p1:10.0.0.2 and - 20.0.0.4=sw1-p1:20.0.0.2, if the values given were suitable + For example, in the example above, IP to port mappings might be + defined as 10.0.0.4=sw0-p1:10.0.0.2 and + 20.0.0.4=sw1-p1:20.0.0.2, if the values given were suitable ports and IP addresses. - For IPv6 IP to port mappings might be defined as + For IPv6 IP to port mappings might be defined as [2001::1]=sw0-p1:[2002::1]. selection_fields: set of strings, one of eth_dst, eth_src, ip_dst, ip_src, tp_dst, or tp_src - OVN native load balancers are supported using the OpenFlow - groups of type select. OVS supports two selection methods: - dp_hash and hash (with optional fields specified) in selecting - the buckets of a group. Please see the OVS documentation (man - ovs-ofctl) for more details on the selection methods. Each end‐ - point IP (and port if set) is mapped to a bucket in the group + OVN native load balancers are supported using the OpenFlow + groups of type select. OVS supports two selection methods: + dp_hash and hash (with optional fields specified) in selecting + the buckets of a group. Please see the OVS documentation (man + ovs-ofctl) for more details on the selection methods. Each end‐ + point IP (and port if set) is mapped to a bucket in the group flow. - CMS can choose the hash selection method by setting the selec‐ - tion fields in this column. ovs-vswitchd uses the specified + CMS can choose the hash selection method by setting the selec‐ + tion fields in this column. ovs-vswitchd uses the specified fields in generating the hash. dp_hash selection method uses the assistance of datapath to cal‐ culate the hash and it is expected to be faster than hash selec‐ - tion method. So CMS should take this into consideration before - using the hash method. Please consult the OVS documentation and + tion method. So CMS should take this into consideration before + using the hash method. Please consult the OVS documentation and OVS sources for the implementation details. Common Columns: @@ -1846,53 +1851,53 @@ Load_Balancer TABLE Load_Balancer options: options : reject: optional string, either true or false - If the load balancer is created with --reject option and it has - no active backends, a TCP reset segment (for tcp) or an ICMP - port unreachable packet (for all other kind of traffic) will be - sent whenever an incoming packet is received for this load-bal‐ - ancer. Please note using --reject option will disable empty_lb + If the load balancer is created with --reject option and it has + no active backends, a TCP reset segment (for tcp) or an ICMP + port unreachable packet (for all other kind of traffic) will be + sent whenever an incoming packet is received for this load-bal‐ + ancer. Please note using --reject option will disable empty_lb SB controller event for this load balancer. options : hairpin_snat_ip: optional string - IP to be used as source IP for packets that have been hair- - pinned after load balancing. The default behavior when the op‐ - tion is not set is to use the load balancer VIP as source IP. + IP to be used as source IP for packets that have been hair- + pinned after load balancing. The default behavior when the op‐ + tion is not set is to use the load balancer VIP as source IP. This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a space character. options : skip_snat: optional string - If the load balancing rule is configured with skip_snat option, - the option lb_force_snat_ip configured for the logical router - that references this load balancer will not be applied for this + If the load balancing rule is configured with skip_snat option, + the option lb_force_snat_ip configured for the logical router + that references this load balancer will not be applied for this load balancer. options : add_route: optional string - If set to true, then neighbor routers will have logical flows - added that will allow for routing to the VIP IP. It also will + If set to true, then neighbor routers will have logical flows + added that will allow for routing to the VIP IP. It also will have ARP resolution logical flows added. By setting this option, - it means there is no reason to create a Logical_Router_Sta‐ - tic_Route from neighbor routers to this NAT address. It also - means that no ARP request is required for neighbor routers to - learn the IP-MAC mapping for this VIP IP. For more information - about what flows are added for IP routes, please see the + it means there is no reason to create a Logical_Router_Sta‐ + tic_Route from neighbor routers to this NAT address. It also + means that no ARP request is required for neighbor routers to + learn the IP-MAC mapping for this VIP IP. For more information + about what flows are added for IP routes, please see the ovn-northd manpage section on IP Routing. options : neighbor_responder: optional string - If set to all, then routers on which the load balancer is ap‐ - plied reply to ARP/neighbor discovery requests for all VIPs of - the load balancer. If set to reachable, then routers on which + If set to all, then routers on which the load balancer is ap‐ + plied reply to ARP/neighbor discovery requests for all VIPs of + the load balancer. If set to reachable, then routers on which the load balancer is applied reply to ARP/neighbor discovery re‐ - quests only for VIPs that are part of a router’s subnet. If set - to none, then routers on which the load balancer is applied - never reply to ARP/neighbor discovery requests for any of the + quests only for VIPs that are part of a router’s subnet. If set + to none, then routers on which the load balancer is applied + never reply to ARP/neighbor discovery requests for any of the load balancer VIPs. Load balancers with options:template=true do not support reachable as a valid mode. The default value of this - option, if not specified, is reachable for regular load bal‐ + option, if not specified, is reachable for regular load bal‐ ancers and none for template load balancers. options : template: optional string - Option to be set to true, if the load balancer is a template. - The load balancer VIPs and backends must be using Chassis_Tem‐ + Option to be set to true, if the load balancer is a template. + The load balancer VIPs and backends must be using Chassis_Tem‐ plate_Var in their definitions. Load balancer template VIP supported formats are: @@ -1900,7 +1905,7 @@ Load_Balancer TABLE ^VIP_VAR[:^PORT_VAR|:port] - where VIP_VAR and PORT_VAR are keys of the Chassis_Template_Var + where VIP_VAR and PORT_VAR are keys of the Chassis_Template_Var variables records. Note: The VIP and PORT cannot be combined into a single template @@ -1914,34 +1919,34 @@ Load_Balancer TABLE ^BACKENDS_VAR1,^BACKENDS_VAR2 - where BACKEND_VAR1, PORT_VAR1, BACKEND_VAR2, PORT_VAR2, BACK‐ + where BACKEND_VAR1, PORT_VAR1, BACKEND_VAR2, PORT_VAR2, BACK‐ ENDS_VAR1 and BACKENDS_VAR2 are keys of the Chassis_Template_Var variables records. options : address-family: optional string - Address family used by the load balancer. Supported values are - ipv4 and ipv6. The address-family is only used for load bal‐ - ancers with options:template=true. For explicit load balancers, + Address family used by the load balancer. Supported values are + ipv4 and ipv6. The address-family is only used for load bal‐ + ancers with options:template=true. For explicit load balancers, setting the address-family has no effect. options : affinity_timeout: optional string - If the CMS provides a positive value (in seconds) for affin‐ - ity_timeout, OVN will dnat connections received from the same - client to this lb to the same backend if received in the affin‐ + If the CMS provides a positive value (in seconds) for affin‐ + ity_timeout, OVN will dnat connections received from the same + client to this lb to the same backend if received in the affin‐ ity timeslot. Max supported affinity_timeout is 65535 seconds. options : ct_flush: optional string, either true or false - The value indicates whether ovn-controller should flush CT en‐ - tries that are related to this LB. The flush happens if the LB - is removed, any of the backends is updated/removed or the LB is - not considered local anymore by the ovn-controller. This option + The value indicates whether ovn-controller should flush CT en‐ + tries that are related to this LB. The flush happens if the LB + is removed, any of the backends is updated/removed or the LB is + not considered local anymore by the ovn-controller. This option is set to false by default. Load_Balancer_Group TABLE - Each row represents a logical grouping of load balancers. It is up to - the CMS to decide the criteria on which load balancers are grouped to‐ - gether. To simplify configuration and to optimize its processing load - balancers that must be associated to the same set of logical switches + Each row represents a logical grouping of load balancers. It is up to + the CMS to decide the criteria on which load balancers are grouped to‐ + gether. To simplify configuration and to optimize its processing load + balancers that must be associated to the same set of logical switches and/or logical routers should be grouped together. Summary: @@ -1950,8 +1955,8 @@ Load_Balancer_Group TABLE Details: name: string (must be unique within table) - A name for the load balancer group. This name has no special - meaning or purpose other than to provide convenience for human + A name for the load balancer group. This name has no special + meaning or purpose other than to provide convenience for human interaction with the ovn-nb database. load_balancer: set of weak reference to Load_Balancers @@ -1996,11 +2001,11 @@ Load_Balancer_Health_Check TABLE See External IDs at the beginning of this document. ACL TABLE - Each row in this table represents one ACL rule for a logical switch or + Each row in this table represents one ACL rule for a logical switch or a port group that points to it through its acls column. The action col‐ - umn for the highest-priority matching row in this table determines a - packet’s treatment. If no row matches, packets are allowed by default. - (Default-deny treatment is possible: add a rule with priority 0, 1 as + umn for the highest-priority matching row in this table determines a + packet’s treatment. If no row matches, packets are allowed by default. + (Default-deny treatment is possible: add a rule with priority 0, 1 as match, and deny as action.) Summary: @@ -2009,16 +2014,16 @@ ACL TABLE direction string, either from-lport or to-lport match string action string, one of allow-related, al‐ - low-stateless, allow, drop, pass, or re‐ + low-stateless, allow, drop, pass, or re‐ ject tier integer, in range 0 to 3 options: options : apply-after-lb optional string Logging: log boolean - name optional string, at most 63 characters + name optional string, at most 63 characters long - severity optional string, one of alert, debug, + severity optional string, one of alert, debug, info, notice, or warning meter optional string Common Columns: @@ -2029,26 +2034,26 @@ ACL TABLE Details: label: integer, in range 0 to 4,294,967,295 - Associates an identifier with the ACL. The same value will be - written to corresponding connection tracker entry. The value - should be a valid 32-bit unsigned integer. This value can help - in debugging from connection tracker side. For example, through + Associates an identifier with the ACL. The same value will be + written to corresponding connection tracker entry. The value + should be a valid 32-bit unsigned integer. This value can help + in debugging from connection tracker side. For example, through this "label" we can backtrack to the ACL rule which is causing a "leaked" connection. Connection tracker entries are created only for allowed connections so the label is valid only for allow and allow-related actions. priority: integer, in range 0 to 32,767 - The ACL rule’s priority. Rules with numerically higher priority + The ACL rule’s priority. Rules with numerically higher priority take precedence over those with lower. If two ACL rules with the - same priority both match, then the one actually applied to a + same priority both match, then the one actually applied to a packet is undefined. - Return traffic from an allow-related flow is always allowed and + Return traffic from an allow-related flow is always allowed and cannot be changed through an ACL. - allow-stateless flows always take precedence before stateful - ACLs, regardless of their priority. (Both allow and allow-re‐ + allow-stateless flows always take precedence before stateful + ACLs, regardless of their priority. (Both allow and allow-re‐ lated ACLs can be stateful.) direction: string, either from-lport or to-lport @@ -2058,74 +2063,74 @@ ACL TABLE from a logical port. These rules are applied to the logi‐ cal switch’s ingress pipeline. - • to-lport: Used to implement filters on traffic forwarded + • to-lport: Used to implement filters on traffic forwarded to a logical port. These rules are applied to the logical switch’s egress pipeline. match: string - The packets that the ACL should match, in the same expression - language used for the match column in the OVN Southbound data‐ - base’s Logical_Flow table. The outport logical port is only - available in the to-lport direction (the inport is available in + The packets that the ACL should match, in the same expression + language used for the match column in the OVN Southbound data‐ + base’s Logical_Flow table. The outport logical port is only + available in the to-lport direction (the inport is available in both directions). - By default all traffic is allowed. When writing a more restric‐ - tive policy, it is important to remember to allow flows such as + By default all traffic is allowed. When writing a more restric‐ + tive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets. - Note that you can not create an ACL matching on a port with + Note that you can not create an ACL matching on a port with type=router or type=localnet. action: string, one of allow-related, allow-stateless, allow, drop, pass, or reject The action to take when the ACL rule matches: - • allow-stateless: Always forward the packet in stateless - manner, omitting connection tracking mechanism, regard‐ - less of other rules defined for the switch. May require - defining additional rules for inbound replies. For exam‐ - ple, if you define a rule to allow outgoing TCP traffic + • allow-stateless: Always forward the packet in stateless + manner, omitting connection tracking mechanism, regard‐ + less of other rules defined for the switch. May require + defining additional rules for inbound replies. For exam‐ + ple, if you define a rule to allow outgoing TCP traffic directed to an IP address, then you probably also want to - define another rule to allow incoming TCP traffic coming - from this same IP address. In addition, traffic that + define another rule to allow incoming TCP traffic coming + from this same IP address. In addition, traffic that matches stateless ACLs will bypass load-balancer DNAT/un- - DNAT processing. Stateful ACLs should be used instead if + DNAT processing. Stateful ACLs should be used instead if the traffic is supposed to be load-balanced. - • allow: Forward the packet. It will also send the packets - through connection tracking when allow-related rules ex‐ - ist on the logical switch. Otherwise, it’s equivalent to + • allow: Forward the packet. It will also send the packets + through connection tracking when allow-related rules ex‐ + ist on the logical switch. Otherwise, it’s equivalent to allow-stateless. - • allow-related: Forward the packet and related traffic + • allow-related: Forward the packet and related traffic (e.g. inbound replies to an outbound connection). • drop: Silently drop the packet. - • reject: Drop the packet, replying with a RST for TCP or - ICMPv4/ICMPv6 unreachable message for other + • reject: Drop the packet, replying with a RST for TCP or + ICMPv4/ICMPv6 unreachable message for other IPv4/IPv6-based protocols. - • pass: Pass to the next ACL tier. If using multiple ACL - tiers, a match on this ACL will stop evaluating ACLs at - the current tier and move to the next one. If not using - ACL tiers or if a pass ACL is matched at the final tier, - then the options:default_acl_drop option from the + • pass: Pass to the next ACL tier. If using multiple ACL + tiers, a match on this ACL will stop evaluating ACLs at + the current tier and move to the next one. If not using + ACL tiers or if a pass ACL is matched at the final tier, + then the options:default_acl_drop option from the NB_Global table is used to determine how to proceed. tier: integer, in range 0 to 3 The hierarchical tier that this ACL belongs to. - ACLs can be assigned to numerical tiers. When evaluating ACLs, - an internal counter is used to determine which tier of ACLs + ACLs can be assigned to numerical tiers. When evaluating ACLs, + an internal counter is used to determine which tier of ACLs should be evaluated. Tier 0 ACLs are evaluated first. If no ver‐ - dict can be determined, then tier 1 ACLs are evaluated next. - This continues until the maximum tier value is reached. If all - tiers of ACLs are evaluated and no verdict is reached, then the - options:default_acl_drop option from table NB_Global is used to + dict can be determined, then tier 1 ACLs are evaluated next. + This continues until the maximum tier value is reached. If all + tiers of ACLs are evaluated and no verdict is reached, then the + options:default_acl_drop option from table NB_Global is used to determine how to proceed. - In this version of OVN, the maximum tier value for ACLs is 3, + In this version of OVN, the maximum tier value for ACLs is 3, meaning there are 4 tiers of ACLs allowed (0-3). options: @@ -2133,70 +2138,70 @@ ACL TABLE ACLs options. options : apply-after-lb: optional string - If set to true, the ACL will be applied after load balancing + If set to true, the ACL will be applied after load balancing stage. Supported only for from-lport direction. - The main use case of this option is to support ACLs matching on - the destination IP address of the packet for the backend IPs of + The main use case of this option is to support ACLs matching on + the destination IP address of the packet for the backend IPs of load balancers. - OVN will apply the from-lport ACLs in two stages. ACLs without - this option apply-after-lb set, will be applied before the load + OVN will apply the from-lport ACLs in two stages. ACLs without + this option apply-after-lb set, will be applied before the load balancer stage and ACLs with this option set will be applied af‐ - ter the load balancer stage. The priorities are indepedent be‐ - tween these stages and may not be obvious to the CMS. Hence CMS - should be extra careful when using this option and should care‐ - fully evaluate the priorities of all the ACLs and the default + ter the load balancer stage. The priorities are indepedent be‐ + tween these stages and may not be obvious to the CMS. Hence CMS + should be extra careful when using this option and should care‐ + fully evaluate the priorities of all the ACLs and the default deny/allow ACLs if any. Logging: - These columns control whether and how OVN logs packets that match an + These columns control whether and how OVN logs packets that match an ACL. log: boolean - If set to true, packets that match the ACL will trigger a log + If set to true, packets that match the ACL will trigger a log message on the transport node or nodes that perform ACL process‐ ing. Logging may be combined with any action. - If set to false, the remaining columns in this group have no + If set to false, the remaining columns in this group have no significance. name: optional string, at most 63 characters long - This name, if it is provided, is included in log records. It + This name, if it is provided, is included in log records. It provides the administrator and the cloud management system a way to associate a log record with a particular ACL. severity: optional string, one of alert, debug, info, notice, or warn‐ ing The severity of the ACL. The severity levels match those of sys‐ - log, in decreasing level of severity: alert, warning, notice, + log, in decreasing level of severity: alert, warning, notice, info, or debug. When the column is empty, the default is info. meter: optional string - The name of a meter to rate-limit log messages for the ACL. The - string must match the name column of a row in the Meter table. - By default, log messages are not rate-limited. In order to en‐ - sure that the same Meter rate limits multiple ACL logs sepa‐ + The name of a meter to rate-limit log messages for the ACL. The + string must match the name column of a row in the Meter table. + By default, log messages are not rate-limited. In order to en‐ + sure that the same Meter rate limits multiple ACL logs sepa‐ rately, set the fair column. Common Columns: options: map of string-string pairs - This column provides general key/value settings. The supported + This column provides general key/value settings. The supported options are described individually below. ACL configuration options: options : log-related: optional string If set to true, then log when reply or related traffic is admit‐ - ted from a stateful ACL. In order for this option to function, - the log option must be set to true and a label must be set, and - it must be unique to the ACL. The label is necessary as it is - the only means to associate the reply traffic with the ACL to + ted from a stateful ACL. In order for this option to function, + the log option must be set to true and a label must be set, and + it must be unique to the ACL. The label is necessary as it is + the only means to associate the reply traffic with the ACL to which it belongs. It must be unique, because otherwise it is am‐ - biguous which ACL will be matched. Note: If this option is en‐ - abled, an extra flow is installed in order to log the related + biguous which ACL will be matched. Note: If this option is en‐ + abled, an extra flow is installed in order to log the related traffic. Therefore, if this is enabled on all ACLs, then the to‐ tal number of flows necessary to log the ACL traffic is doubled, compared to if this option is not enabled. @@ -2231,9 +2236,9 @@ Logical_Router TABLE options : always_learn_from_arp_request optional string, either true or false options : requested-tnl-key - optional string, containing an integer, + optional string, containing an integer, in range 1 to 16,777,215 - options : snat-ct-zone optional string, containing an integer, + options : snat-ct-zone optional string, containing an integer, in range 0 to 65,535 options : mac_binding_age_threshold optional string @@ -2251,18 +2256,18 @@ Logical_Router TABLE Zero or more routing policies for the router. enabled: optional boolean - This column is used to administratively set router state. If - this column is empty or is set to true, the router is enabled. - If this column is set to false, the router is disabled. A dis‐ + This column is used to administratively set router state. If + this column is empty or is set to true, the router is enabled. + If this column is set to false, the router is disabled. A dis‐ abled router has all ingress and egress traffic dropped. nat: set of NATs - One or more NAT rules for the router. NAT rules only work on - Gateway routers, and on distributed routers with one and only + One or more NAT rules for the router. NAT rules only work on + Gateway routers, and on distributed routers with one and only one distributed gateway port. load_balancer: set of weak reference to Load_Balancers - Set of load balancers associated to this logical router. Load + Set of load balancers associated to this logical router. Load balancer Load balancer rules only work on the Gateway routers or routers with one and only one distributed gateway port. @@ -2273,14 +2278,14 @@ Logical_Router TABLE These columns provide names for the logical router. From OVN’s perspec‐ tive, these names have no special meaning or purpose other than to pro‐ - vide convenience for human interaction with the northbound database. - There is no requirement for the name to be unique. (For a unique iden‐ + vide convenience for human interaction with the northbound database. + There is no requirement for the name to be unique. (For a unique iden‐ tifier for a logical router, use its row UUID.) (Originally, name was intended to serve the purpose of a human-friendly - name, but the Neutron integration used it to uniquely identify its own - router object, in the format neutron-uuid. Later on, Neutron started - propagating the friendly name of a router as external_ids:neu‐ + name, but the Neutron integration used it to uniquely identify its own + router object, in the format neutron-uuid. Later on, Neutron started + propagating the friendly name of a router as external_ids:neu‐ tron:router_name. Perhaps this can be cleaned up someday.) name: string @@ -2300,25 +2305,25 @@ Logical_Router TABLE options : chassis: optional string If set, indicates that the logical router in question is a Gate‐ - way router (which is centralized) and resides in the set chas‐ - sis. The same value is also used by ovn-controller to uniquely + way router (which is centralized) and resides in the set chas‐ + sis. The same value is also used by ovn-controller to uniquely identify the chassis in the OVN deployment and comes from exter‐ - nal_ids:system-id in the Open_vSwitch table of Open_vSwitch + nal_ids:system-id in the Open_vSwitch table of Open_vSwitch database. The Gateway router can only be connected to a distributed router - via a switch if SNAT and DNAT are to be configured in the Gate‐ + via a switch if SNAT and DNAT are to be configured in the Gate‐ way router. options : dnat_force_snat_ip: optional string - If set, indicates a set of IP addresses to use to force SNAT a - packet that has already been DNATed in the gateway router. When - multiple gateway routers are configured, a packet can poten‐ - tially enter any of the gateway router, get DNATted and eventu‐ + If set, indicates a set of IP addresses to use to force SNAT a + packet that has already been DNATed in the gateway router. When + multiple gateway routers are configured, a packet can poten‐ + tially enter any of the gateway router, get DNATted and eventu‐ ally reach the logical switch port. For the return traffic to go - back to the same gateway router (for unDNATing), the packet + back to the same gateway router (for unDNATing), the packet needs a SNAT in the first place. This can be achieved by setting - the above option with a gateway specific set of IP addresses. + the above option with a gateway specific set of IP addresses. This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a a space. @@ -2326,113 +2331,113 @@ Logical_Router TABLE If set, this option can take two possible type of values. Either a set of IP addresses or the string value - router_ip. - If a set of IP addresses are configured, it indicates to use to - force SNAT a packet that has already been load-balanced in the - gateway router. When multiple gateway routers are configured, a - packet can potentially enter any of the gateway routers, get - DNATted as part of the load-balancing and eventually reach the - logical switch port. For the return traffic to go back to the - same gateway router (for unDNATing), the packet needs a SNAT in - the first place. This can be achieved by setting the above op‐ - tion with a gateway specific set of IP addresses. This option - may have exactly one IPv4 and/or one IPv6 address on it, sepa‐ + If a set of IP addresses are configured, it indicates to use to + force SNAT a packet that has already been load-balanced in the + gateway router. When multiple gateway routers are configured, a + packet can potentially enter any of the gateway routers, get + DNATted as part of the load-balancing and eventually reach the + logical switch port. For the return traffic to go back to the + same gateway router (for unDNATing), the packet needs a SNAT in + the first place. This can be achieved by setting the above op‐ + tion with a gateway specific set of IP addresses. This option + may have exactly one IPv4 and/or one IPv6 address on it, sepa‐ rated by a space character. If it is configured with the value router_ip, then the load bal‐ - anced packet is SNATed with the IP of router port (attached to + anced packet is SNATed with the IP of router port (attached to the gateway router) selected as the destination after taking the routing decision. options : mcast_relay: optional string, either true or false - Enables/disables IP multicast relay between logical switches + Enables/disables IP multicast relay between logical switches connected to the logical router. Default: False. options : dynamic_neigh_routers: optional string, either true or false - If set to true, the router will resolve neighbor routers’ MAC - addresses only by dynamic ARP/ND, instead of prepopulating sta‐ - tic mappings for all neighbor routers in the ARP/ND Resolution - stage. This reduces number of flows, but requires ARP/ND mes‐ + If set to true, the router will resolve neighbor routers’ MAC + addresses only by dynamic ARP/ND, instead of prepopulating sta‐ + tic mappings for all neighbor routers in the ARP/ND Resolution + stage. This reduces number of flows, but requires ARP/ND mes‐ sages to resolve the IP-MAC bindings when needed. It is false by default. It is recommended to set to true when a large number of - logical routers are connected to the same logical switch but - most of them never need to send traffic between each other. By - default, ovn-northd does not create mappings to NAT and load + logical routers are connected to the same logical switch but + most of them never need to send traffic between each other. By + default, ovn-northd does not create mappings to NAT and load balancer addresess. However, for NAT and load balancer addresses - that have the add_route option added, ovn-northd will create + that have the add_route option added, ovn-northd will create logical flows that map NAT and load balancer IP addresses to the - appropriate MAC address. Setting dynamic_neigh_routers to true + appropriate MAC address. Setting dynamic_neigh_routers to true will prevent the automatic creation of these logical flows. options : always_learn_from_arp_request: optional string, either true or false - This option controls the behavior when handling IPv4 ARP re‐ - quests or IPv6 ND-NS packets - whether a dynamic neighbor (MAC + This option controls the behavior when handling IPv4 ARP re‐ + quests or IPv6 ND-NS packets - whether a dynamic neighbor (MAC binding) entry is added/updated. - true - Always learn the MAC-IP binding, and add/update the MAC + true - Always learn the MAC-IP binding, and add/update the MAC binding entry. - false - If there is a MAC binding for that IP and the MAC is - different, or, if TPA of ARP request belongs to any router port - on this router, then update/add that MAC-IP binding. Otherwise, + false - If there is a MAC binding for that IP and the MAC is + different, or, if TPA of ARP request belongs to any router port + on this router, then update/add that MAC-IP binding. Otherwise, don’t update/add entries. - It is true by default. It is recommended to set to false when a - large number of logical routers are connected to the same logi‐ - cal switch but most of them never need to send traffic between + It is true by default. It is recommended to set to false when a + large number of logical routers are connected to the same logi‐ + cal switch but most of them never need to send traffic between each other, to reduce the size of the MAC binding table. options : requested-tnl-key: optional string, containing an integer, in range 1 to 16,777,215 - Configures the datapath tunnel key for the logical router. This - is not needed because ovn-northd will assign an unique key for - each datapath by itself. However, if it is configured, + Configures the datapath tunnel key for the logical router. This + is not needed because ovn-northd will assign an unique key for + each datapath by itself. However, if it is configured, ovn-northd honors the configured value. options : snat-ct-zone: optional string, containing an integer, in range 0 to 65,535 Use the requested conntrack zone for SNAT with this router. This - can be useful if egress traffic from the host running OVN comes - from both OVN and other sources. This way, OVN and the other + can be useful if egress traffic from the host running OVN comes + from both OVN and other sources. This way, OVN and the other sources can make use of the same conntrack zone. options : mac_binding_age_threshold: optional string - Specifies the MAC binding aging thresholds based on CIDRs, with + Specifies the MAC binding aging thresholds based on CIDRs, with the format: entry[;entry[...]], where each entry has the format: [cidr:]threshold • cidr: Can be either an IPv4 or IPv6 CIDR. - • threshold: Threshold value in seconds. MAC bindings with + • threshold: Threshold value in seconds. MAC bindings with IP addresses matching the specified CIDR that exceed this timeout will be automatically removed. - If an entry is provided without an CIDR (just the threshold + If an entry is provided without an CIDR (just the threshold value), it specifies the default threshold for MAC bindings that - don’t match any of the given CIDRs. If there are multiple de‐ - fault threshold entries in the option, the behavior is unde‐ + don’t match any of the given CIDRs. If there are multiple de‐ + fault threshold entries in the option, the behavior is unde‐ fined. - If there are multiple CIDRs matching a MAC binding IP, the one + If there are multiple CIDRs matching a MAC binding IP, the one with the longest prefix length takes effect. If there are multi‐ - ple entries with the same CIDR in the option, the behavior is + ple entries with the same CIDR in the option, the behavior is undefined. - If no matching CIDR is found for a MAC binding IP, and no de‐ + If no matching CIDR is found for a MAC binding IP, and no de‐ fault threshold is specified, the behavior defaults to the orig‐ inal: the binding will not be removed based on age. - The value can also default to an empty string, which means that - the aging threshold is disabled. Any string not in the above + The value can also default to an empty string, which means that + the aging threshold is disabled. Any string not in the above format is regarded as invalid and the aging is disabled. Example: 192.168.0.0/16:300;192.168.10.0/24:0;fe80::/10:600;1200 - This sets a threshold of 300 seconds for MAC bindings with IP + This sets a threshold of 300 seconds for MAC bindings with IP addresses in the 192.168.0.0/16 range, excluding the - 192.168.1.0/24 range (for which the aging is disabled), a - threshold of 600 seconds for MAC bindings with IP addresses in - the fe80::/10 IPv6 range, and a default threshold of 1200 sec‐ + 192.168.1.0/24 range (for which the aging is disabled), a + threshold of 600 seconds for MAC bindings with IP addresses in + the fe80::/10 IPv6 range, and a default threshold of 1200 sec‐ onds for all other MAC bindings. Common Columns: @@ -2441,53 +2446,53 @@ Logical_Router TABLE See External IDs at the beginning of this document. QoS TABLE - Each row in this table represents one QoS rule for a logical switch - that points to it through its qos_rules column. Two types of QoS are + Each row in this table represents one QoS rule for a logical switch + that points to it through its qos_rules column. Two types of QoS are supported: DSCP marking and metering. A match with the highest-priority - will have QoS applied to it. If the action column is specified, then - matching packets will have DSCP marking applied. If the bandwidth col‐ + will have QoS applied to it. If the action column is specified, then + matching packets will have DSCP marking applied. If the bandwidth col‐ umn is specified, then matching packets will have metering applied. ac‐ - tion and bandwidth are not exclusive, so both marking and metering by - defined for the same QoS entry. If no row matches, packets will not + tion and bandwidth are not exclusive, so both marking and metering by + defined for the same QoS entry. If no row matches, packets will not have any QoS applied. Summary: priority integer, in range 0 to 32,767 direction string, either from-lport or to-lport match string - action map of string-integer pairs, key either - dscp or mark, value in range 0 to + action map of string-integer pairs, key either + dscp or mark, value in range 0 to 4,294,967,295 - bandwidth map of string-integer pairs, key either + bandwidth map of string-integer pairs, key either burst or rate, value in range 1 to 4,294,967,295 external_ids map of string-string pairs Details: priority: integer, in range 0 to 32,767 - The QoS rule’s priority. Rules with numerically higher priority + The QoS rule’s priority. Rules with numerically higher priority take precedence over those with lower. If two QoS rules with the - same priority both match, then the one actually applied to a + same priority both match, then the one actually applied to a packet is undefined. direction: string, either from-lport or to-lport - The value of this field is similar to ACL column in the OVN + The value of this field is similar to ACL column in the OVN Northbound database’s ACL table. match: string The packets that the QoS rules should match, in the same expres‐ - sion language used for the match column in the OVN Southbound - database’s Logical_Flow table. The outport logical port is only - available in the to-lport direction (the inport is available in + sion language used for the match column in the OVN Southbound + database’s Logical_Flow table. The outport logical port is only + available in the to-lport direction (the inport is available in both directions). action: map of string-integer pairs, key either dscp or mark, value in range 0 to 4,294,967,295 - When dscp action is specified, matching flows will have have - DSCP marking applied. When mark action is specified, matching + When dscp action is specified, matching flows will have have + DSCP marking applied. When mark action is specified, matching flows will have packet marking applied. - • dscp: The value of this action should be in the range of + • dscp: The value of this action should be in the range of 0 to 63 (inclusive). • mark: The value of this action should be a positive inte‐ @@ -2495,7 +2500,7 @@ QoS TABLE bandwidth: map of string-integer pairs, key either burst or rate, value in range 1 to 4,294,967,295 - When specified, matching packets will have bandwidth metering + When specified, matching packets will have bandwidth metering applied. Traffic over the limit will be dropped. • rate: The value of rate limit in kbps. @@ -2507,13 +2512,13 @@ QoS TABLE See External IDs at the beginning of this document. Mirror TABLE - Each row in this table represents a mirror that can be used for port - mirroring. These mirrors are referenced by the mirror_rules column in + Each row in this table represents a mirror that can be used for port + mirroring. These mirrors are referenced by the mirror_rules column in the Logical_Switch_Port table. Summary: name string (must be unique within table) - filter string, one of both, from-lport, or + filter string, one of both, from-lport, or to-lport sink string type string, one of erspan, gre, or local @@ -2525,34 +2530,34 @@ Mirror TABLE Represents the name of the mirror. filter: string, one of both, from-lport, or to-lport - The value of this field represents selection criteria of the - mirror. to-lport mirrors the packets coming into logical port. - from-lport mirrors the packets going out of logical port. both + The value of this field represents selection criteria of the + mirror. to-lport mirrors the packets coming into logical port. + from-lport mirrors the packets going out of logical port. both mirrors for both directions. sink: string - The value of this field represents the destination/sink of the - mirror. If the type is gre or erspan, the value indicates the - tunnel remote IP (either IPv4 or IPv6). For a type of local, - this field defines a local interface on the OVS integration - bridge to be used as the mirror destination. The interface must + The value of this field represents the destination/sink of the + mirror. If the type is gre or erspan, the value indicates the + tunnel remote IP (either IPv4 or IPv6). For a type of local, + this field defines a local interface on the OVS integration + bridge to be used as the mirror destination. The interface must possess external-ids:mirror-id that matches this string. type: string, one of erspan, gre, or local - The value of this field specifies the mirror type - gre, erspan + The value of this field specifies the mirror type - gre, erspan or local. index: integer The value of this field represents the tunnel ID. If the config‐ ured tunnel type is gre, this field represents the GRE key value - and if the configured tunnel type is erspan it represents the + and if the configured tunnel type is erspan it represents the erspan_idx value. It is ignored if the type is local. external_ids: map of string-string pairs See External IDs at the beginning of this document. Meter TABLE - Each row in this table represents a meter that can be used for QoS or + Each row in this table represents a meter that can be used for QoS or rate-limiting. Summary: @@ -2566,26 +2571,26 @@ Meter TABLE name: string (must be unique within table) A name for this meter. - Names that begin with "__" (two underscores) are reserved for + Names that begin with "__" (two underscores) are reserved for OVN internal use and should not be added manually. unit: string, either kbps or pktps - The unit for rate and burst_rate parameters in the bands entry. - kbps specifies kilobits per second, and pktps specifies packets + The unit for rate and burst_rate parameters in the bands entry. + kbps specifies kilobits per second, and pktps specifies packets per second. bands: set of 1 or more Meter_Bands The bands associated with this meter. Each band specifies a rate - above which the band is to take the action action. If multiple - bands’ rates are exceeded, then the band with the highest rate + above which the band is to take the action action. If multiple + bands’ rates are exceeded, then the band with the highest rate among the exceeded bands is selected. fair: optional boolean - This column is used to further describe the desired behavior of + This column is used to further describe the desired behavior of the meter when there are multiple references to it. If this col‐ - umn is empty or is set to false, the rate will be shared across - all rows that refer to the same Meter name. Conversely, when - this column is set to true, each user of the same Meter will be + umn is empty or is set to false, the rate will be shared across + all rows that refer to the same Meter name. Conversely, when + this column is set to true, each user of the same Meter will be rate-limited on its own. external_ids: map of string-string pairs @@ -2593,7 +2598,7 @@ Meter TABLE Meter_Band TABLE Each row in this table represents a meter band which specifies the rate - above which the configured action should be applied. These bands are + above which the configured action should be applied. These bands are referenced by the bands column in the Meter table. Summary: @@ -2609,13 +2614,13 @@ Meter_Band TABLE rate: integer, in range 1 to 4,294,967,295 The rate limit for this band, in kilobits per second or bits per - second, depending on whether the parent Meter entry’s unit col‐ + second, depending on whether the parent Meter entry’s unit col‐ umn specified kbps or pktps. burst_size: integer, in range 0 to 4,294,967,295 - The maximum burst allowed for the band in kilobits or packets, - depending on whether kbps or pktps was selected in the parent - Meter entry’s unit column. If the size is zero, the switch is + The maximum burst allowed for the band in kilobits or packets, + depending on whether kbps or pktps was selected in the parent + Meter entry’s unit column. If the size is zero, the switch is free to select some reasonable value depending on its configura‐ tion. @@ -2625,7 +2630,7 @@ Meter_Band TABLE Logical_Router_Port TABLE A port within an L3 logical router. - Exactly one Logical_Router row must reference a given logical router + Exactly one Logical_Router row must reference a given logical router port. Summary: @@ -2639,7 +2644,7 @@ Logical_Router_Port TABLE Options for Physical VLAN MTU Issues: options : reside-on-redirect-chassis optional string, either true or false - options : redirect-type optional string, either bridged or over‐ + options : redirect-type optional string, either bridged or over‐ lay ipv6_prefix set of strings ipv6_ra_configs: @@ -2661,13 +2666,13 @@ Logical_Router_Port TABLE Options: options : mcast_flood optional string, either true or false options : requested-tnl-key - optional string, containing an integer, + optional string, containing an integer, in range 1 to 32,767 options : prefix_delegation optional string, either true or false options : prefix optional string, either true or false options : route_table optional string - options : gateway_mtu optional string, containing an integer, + options : gateway_mtu optional string, containing an integer, in range 68 to 65,535 options : gateway_mtu_bypass optional string @@ -2682,21 +2687,21 @@ Logical_Router_Port TABLE name: string (must be unique within table) A name for the logical router port. - In addition to provide convenience for human interaction with + In addition to provide convenience for human interaction with the northbound database, this column is used as reference by its patch port in Logical_Switch_Port or another logical router port in Logical_Router_Port. - A logical router port may not have the same name as a logical + A logical router port may not have the same name as a logical switch port, but the database schema cannot enforce this. networks: set of 1 or more strings - The IP addresses and netmasks of the router. For example, - 192.168.0.1/24 indicates that the router’s IP address is - 192.168.0.1 and that packets destined to 192.168.0.x should be + The IP addresses and netmasks of the router. For example, + 192.168.0.1/24 indicates that the router’s IP address is + 192.168.0.1 and that packets destined to 192.168.0.x should be routed to this port. - A logical router port always adds a link-local IPv6 address + A logical router port always adds a link-local IPv6 address (fe80::/64) automatically generated from the interface’s MAC ad‐ dress using the modified EUI-64 format. @@ -2704,129 +2709,129 @@ Logical_Router_Port TABLE The Ethernet address that belongs to this router port. enabled: optional boolean - This column is used to administratively set port state. If this - column is empty or is set to true, the port is enabled. If this - column is set to false, the port is disabled. A disabled port + This column is used to administratively set port state. If this + column is empty or is set to true, the port is enabled. If this + column is set to false, the port is disabled. A disabled port has all ingress and egress traffic dropped. Distributed Gateway Ports: - Gateways, as documented under Gateways in the OVN architecture guide, - provide limited connectivity between logical networks and physical - ones. OVN support multiple kinds of gateways. The Logical_Router_Port - table can be used two different ways to configure distributed gateway - ports, which are one kind of gateway. These two forms of configuration + Gateways, as documented under Gateways in the OVN architecture guide, + provide limited connectivity between logical networks and physical + ones. OVN support multiple kinds of gateways. The Logical_Router_Port + table can be used two different ways to configure distributed gateway + ports, which are one kind of gateway. These two forms of configuration exist for historical reasons. Both of them produce the same kind of OVN southbound records and the same behavior in practice. - If either of these are set, this logical router port represents a dis‐ - tributed gateway port that connects this router to a logical switch + If either of these are set, this logical router port represents a dis‐ + tributed gateway port that connects this router to a logical switch with a localnet port or a connection to another OVN deployment. Also mentioned in the OVN architecture guide, distributed gateway ports - can also be used for scalability reasons in deployments where logical + can also be used for scalability reasons in deployments where logical switches are dedicated to chassises rather than distributed. The preferred way to configure a gateway is ha_chassis_group, but gate‐ - way_chassis is also supported for backward compatibility. Only one of - these should be set at a time on a given LRP, since they configure the + way_chassis is also supported for backward compatibility. Only one of + these should be set at a time on a given LRP, since they configure the same features. Even when a gateway is configured, the logical router port still effec‐ tively resides on each chassis. However, due to the implications of the use of L2 learning in the physical network, as well as the need to sup‐ port advanced features such as one-to-many NAT (aka IP masquerading), a - subset of the logical router processing is handled in a centralized + subset of the logical router processing is handled in a centralized manner on the gateway chassis. There can be more than one distributed gateway ports configured on each - logical router, each connecting to different L2 segments. Load-balanc‐ + logical router, each connecting to different L2 segments. Load-balanc‐ ing is not yet supported on logical routers with more than one distrib‐ uted gateway ports. - For each distributed gateway port, it may have more than one gateway - chassises. When more than one gateway chassis is specified, OVN only - uses one at a time. OVN can rely on OVS BFD implementation to monitor - gateway connectivity, preferring the highest-priority gateway that is - online. Priorities are specified in the priority column of Gate‐ + For each distributed gateway port, it may have more than one gateway + chassises. When more than one gateway chassis is specified, OVN only + uses one at a time. OVN can rely on OVS BFD implementation to monitor + gateway connectivity, preferring the highest-priority gateway that is + online. Priorities are specified in the priority column of Gate‐ way_Chassis or HA_Chassis. - ovn-northd programs the external_mac rules specified in the LRP’s LR - into the peer logical switch’s destination lookup on the chassis where + ovn-northd programs the external_mac rules specified in the LRP’s LR + into the peer logical switch’s destination lookup on the chassis where the logical_port resides. In addition, the logical router’s MAC address - is automatically programmed in the peer logical switch’s destination - lookup flow on the gateway chasssis. If it is desired to generate gra‐ + is automatically programmed in the peer logical switch’s destination + lookup flow on the gateway chasssis. If it is desired to generate gra‐ tuitous ARPs for NAT addresses, then set the peer LSP’s options:nat-ad‐ dresses to router. - OVN 20.03 and earlier supported a third way to configure distributed - gateway ports using options:redirect-chassis to specify the gateway + OVN 20.03 and earlier supported a third way to configure distributed + gateway ports using options:redirect-chassis to specify the gateway chassis. This method is no longer supported. Any remaining users should - switch to one of the newer methods instead. A gateway_chassis may be - easily configured from the command line, e.g. ovn-nbctl lrp-set-gate‐ + switch to one of the newer methods instead. A gateway_chassis may be + easily configured from the command line, e.g. ovn-nbctl lrp-set-gate‐ way-chassis lrp chassis. ha_chassis_group: optional HA_Chassis_Group - Designates an HA_Chassis_Group to provide gateway high avail‐ + Designates an HA_Chassis_Group to provide gateway high avail‐ ability. gateway_chassis: set of Gateway_Chassises - Designates one or more Gateway_Chassis for the logical router + Designates one or more Gateway_Chassis for the logical router port. Options for Physical VLAN MTU Issues: - MTU issues arise in mixing tunnels with logical networks that are - bridged to a physical VLAN. For an explanation of the MTU issues, see - Physical VLAN MTU Issues in the OVN architecture document. The follow‐ - ing options, which are alternatives, provide solutions. Both of them - cause packets to be sent over localnet instead of tunnels, but they - differ in whether some or all packets are sent this way. The most + MTU issues arise in mixing tunnels with logical networks that are + bridged to a physical VLAN. For an explanation of the MTU issues, see + Physical VLAN MTU Issues in the OVN architecture document. The follow‐ + ing options, which are alternatives, provide solutions. Both of them + cause packets to be sent over localnet instead of tunnels, but they + differ in whether some or all packets are sent this way. The most prominent tradeoff between these options is that reside-on-redi‐ - rect-chassis is easier to configure and that redirect-type performs + rect-chassis is easier to configure and that redirect-type performs better for east-west traffic. options : reside-on-redirect-chassis: optional string, either true or false - If set to true, this option forces all traffic across the logi‐ - cal router port to pass through the gateway chassis using a hop + If set to true, this option forces all traffic across the logi‐ + cal router port to pass through the gateway chassis using a hop across a localnet port. This changes behavior in two ways: - • Without this option, east-west traffic passes directly - between source and destination chassis (or even within a - single chassis, for co-located VMs). With this option, + • Without this option, east-west traffic passes directly + between source and destination chassis (or even within a + single chassis, for co-located VMs). With this option, all east-west traffic passes through the gateway chassis. - • Without this option, traffic between the gateway chassis - and other chassis is encapsulated in tunnels. With this + • Without this option, traffic between the gateway chassis + and other chassis is encapsulated in tunnels. With this option, traffic passes over a localnet interface. - This option may usefully be set only on logical router ports - that connect a distributed logical router to a logical switch + This option may usefully be set only on logical router ports + that connect a distributed logical router to a logical switch with VIFs. It should not be set on a distributed gateway port. - OVN honors this option only if the logical router has one and - only one distributed gateway port and if the LRP’s peer switch + OVN honors this option only if the logical router has one and + only one distributed gateway port and if the LRP’s peer switch has a localnet port. options : redirect-type: optional string, either bridged or overlay - If set to bridged on a distributed gateway port, this option + If set to bridged on a distributed gateway port, this option causes OVN to redirect packets to the gateway chassis over a lo‐ calnet port instead of a tunnel. The relevant chassis must share a localnet port. - This feature requires the administrator or the CMS to configure - each participating chassis with a unique Ethernet address for - the logical router by setting ovn-chassis-mac-mappings in the + This feature requires the administrator or the CMS to configure + each participating chassis with a unique Ethernet address for + the logical router by setting ovn-chassis-mac-mappings in the Open vSwitch database, for use by ovn-controller. - Setting this option to overlay or leaving it unset has no ef‐ - fect. This option may usefully be set only on a distributed - gateway port when there is one and only one distributed gateway + Setting this option to overlay or leaving it unset has no ef‐ + fect. This option may usefully be set only on a distributed + gateway port when there is one and only one distributed gateway port on the logical router. It is otherwise ignored. ipv6_prefix: set of strings - This column contains IPv6 prefix obtained by prefix delegation + This column contains IPv6 prefix obtained by prefix delegation router according to RFC 3633 ipv6_ra_configs: @@ -2836,23 +2841,23 @@ Logical_Router_Port TABLE tion requests. ipv6_ra_configs : address_mode: optional string - The address mode to be used for IPv6 address configuration. The + The address mode to be used for IPv6 address configuration. The supported values are: - • slaac: Address configuration using Router Advertisement - (RA) packet. The IPv6 prefixes defined in the Logi‐ - cal_Router_Port table’s networks column will be included + • slaac: Address configuration using Router Advertisement + (RA) packet. The IPv6 prefixes defined in the Logi‐ + cal_Router_Port table’s networks column will be included in the RA’s ICMPv6 option - Prefix information. • dhcpv6_stateful: Address configuration using DHCPv6. - • dhcpv6_stateless: Address configuration using Router Ad‐ - vertisement (RA) packet. Other IPv6 options are provided + • dhcpv6_stateless: Address configuration using Router Ad‐ + vertisement (RA) packet. Other IPv6 options are provided by DHCPv6. ipv6_ra_configs : router_preference: optional string Default Router Preference (PRF) indicates whether to prefer this - router over other default routers (RFC 4191). Possible values + router over other default routers (RFC 4191). Possible values are: • HIGH: mapped to 0x01 in RA PRF field @@ -2864,7 +2869,7 @@ Logical_Router_Port TABLE ipv6_ra_configs : route_info: optional string Route Info is used to configure Route Info Option sent in Router Advertisement according to RFC 4191. Route Info is a comma sepa‐ - rated string where each field provides PRF and prefix for a + rated string where each field provides PRF and prefix for a given route (e.g: HIGH-aef1::11/48,LOW-aef2::11/96) Possible PRF values are: @@ -2875,26 +2880,26 @@ Logical_Router_Port TABLE • LOW: mapped to 0x11 in RA PRF field ipv6_ra_configs : mtu: optional string - The recommended MTU for the link. Default is 0, which means no - MTU Option will be included in RA packet replied by ovn-con‐ + The recommended MTU for the link. Default is 0, which means no + MTU Option will be included in RA packet replied by ovn-con‐ troller. Per RFC 2460, the mtu value is recommended no less than - 1280, so any mtu value less than 1280 will be considered as no + 1280, so any mtu value less than 1280 will be considered as no MTU Option. ipv6_ra_configs : send_periodic: optional string - If set to true, then this router interface will send router ad‐ + If set to true, then this router interface will send router ad‐ vertisements periodically. The default is false. ipv6_ra_configs : max_interval: optional string - The maximum number of seconds to wait between sending periodic + The maximum number of seconds to wait between sending periodic router advertisements. This option has no effect if ipv6_ra_con‐ figs:send_periodic is false. The default is 600. ipv6_ra_configs : min_interval: optional string - The minimum number of seconds to wait between sending periodic + The minimum number of seconds to wait between sending periodic router advertisements. This option has no effect if ipv6_ra_con‐ - figs:send_periodic is false. The default is one-third of - ipv6_ra_configs:max_interval, i.e. 200 seconds if that key is + figs:send_periodic is false. The default is one-third of + ipv6_ra_configs:max_interval, i.e. 200 seconds if that key is unset. ipv6_ra_configs : rdnss: optional string @@ -2902,7 +2907,7 @@ Logical_Router_Port TABLE ment OVN supports just one RDNSS server. ipv6_ra_configs : dnssl: optional string - DNS Search List announced in RA packets. Multiple DNS Search + DNS Search List announced in RA packets. Multiple DNS Search List must be ’comma’ separated (e.g. "a.b.c, d.e.f") Options: @@ -2913,46 +2918,46 @@ Logical_Router_Port TABLE If set to true, multicast traffic (including reports) are uncon‐ ditionally forwarded to the specific port. - This option applies when the port is part of a logical router + This option applies when the port is part of a logical router which has options:mcast_relay set to true. Default: false. options : requested-tnl-key: optional string, containing an integer, in range 1 to 32,767 - Configures the port binding tunnel key for the port. Usually - this is not needed because ovn-northd will assign an unique key - for each port by itself. However, if it is configured, + Configures the port binding tunnel key for the port. Usually + this is not needed because ovn-northd will assign an unique key + for each port by itself. However, if it is configured, ovn-northd honors the configured value. options : prefix_delegation: optional string, either true or false - If set to true, enable IPv6 prefix delegation state machine on - this logical router port (RFC3633). IPv6 prefix delegation is + If set to true, enable IPv6 prefix delegation state machine on + this logical router port (RFC3633). IPv6 prefix delegation is available just on a gateway router or on a gateway router port. options : prefix: optional string, either true or false - If set to true, this interface will receive an IPv6 prefix ac‐ + If set to true, this interface will receive an IPv6 prefix ac‐ cording to RFC3663 options : route_table: optional string - Designates lookup Logical_Router_Static_Routes with specified - route_table value. Routes to directly connected networks from - same Logical Router and routes without route_table option set + Designates lookup Logical_Router_Static_Routes with specified + route_table value. Routes to directly connected networks from + same Logical Router and routes without route_table option set have higher priority than routes with route_table option set. options : gateway_mtu: optional string, containing an integer, in range 68 to 65,535 - If set, logical flows will be added to router pipeline to check - packet length. If packet length is greater than the value set, - ICMPv4 type 3 (Destination Unreachable) code 4 (Fragmentation - Needed and Don’t Fragment was Set) or ICMPv6 type 2 (Packet Too + If set, logical flows will be added to router pipeline to check + packet length. If packet length is greater than the value set, + ICMPv4 type 3 (Destination Unreachable) code 4 (Fragmentation + Needed and Don’t Fragment was Set) or ICMPv6 type 2 (Packet Too Big) code 0 (no route to destination) packets will be generated. This allows for Path MTU Discovery. options : gateway_mtu_bypass: optional string - When configured, represents a match expression, in the same ex‐ - pression language used for the match column in the OVN South‐ - bound database’s Logical_Flow table. Packets matching this ex‐ + When configured, represents a match expression, in the same ex‐ + pression language used for the match column in the OVN South‐ + bound database’s Logical_Flow table. Packets matching this ex‐ pression will bypass the length check configured through the op‐ tions:gateway_mtu option. @@ -2961,22 +2966,22 @@ Logical_Router_Port TABLE A given router port serves one of two purposes: • To attach a logical switch to a logical router. A logical - router port of this type is referenced by exactly one - Logical_Switch_Port of type router. The value of name is - set as router-port in column options of Logi‐ + router port of this type is referenced by exactly one + Logical_Switch_Port of type router. The value of name is + set as router-port in column options of Logi‐ cal_Switch_Port. In this case peer column is empty. • To connect one logical router to another. This requires a pair of logical router ports, each connected to a differ‐ - ent router. Each router port in the pair specifies the + ent router. Each router port in the pair specifies the other in its peer column. No Logical_Switch refers to the router port. peer: optional string - For a router port used to connect two logical routers, this + For a router port used to connect two logical routers, this identifies the other router port in the pair by name. - For a router port attached to a logical switch, this column is + For a router port attached to a logical switch, this column is empty. Common Columns: @@ -2984,7 +2989,7 @@ Logical_Router_Port TABLE external_ids: map of string-string pairs See External IDs at the beginning of this document. - The ovn-northd program copies all these pairs into the exter‐ + The ovn-northd program copies all these pairs into the exter‐ nal_ids column of the Port_Binding table in OVN_Southbound data‐ base. @@ -2995,20 +3000,20 @@ Logical_Router_Port TABLE status : hosting-chassis: optional string This option is populated by ovn-northd. - When a distributed gateway port is bound to a location in the - OVN Southbound database Port_Binding ovn-northd will populate - this key with the name of the Chassis that is currently hosting + When a distributed gateway port is bound to a location in the + OVN Southbound database Port_Binding ovn-northd will populate + this key with the name of the Chassis that is currently hosting this port. Logical_Router_Static_Route TABLE Each record represents a static route. - When multiple routes match a packet, the longest-prefix match is cho‐ - sen. For a given prefix length, a dst-ip route is preferred over a + When multiple routes match a packet, the longest-prefix match is cho‐ + sen. For a given prefix length, a dst-ip route is preferred over a src-ip route. - When there are ECMP routes, i.e. multiple routes with same prefix and - policy, one of them will be selected based on the 5-tuple hashing of + When there are ECMP routes, i.e. multiple routes with same prefix and + policy, one of them will be selected based on the 5-tuple hashing of the packet header. Summary: @@ -3033,54 +3038,54 @@ Logical_Router_Static_Route TABLE IP prefix of this route (e.g. 192.168.100.0/24). policy: optional string, either dst-ip or src-ip - If it is specified, this setting describes the policy used to - make routing decisions. This setting must be one of the follow‐ + If it is specified, this setting describes the policy used to + make routing decisions. This setting must be one of the follow‐ ing strings: - • src-ip: This policy sends the packet to the nexthop when + • src-ip: This policy sends the packet to the nexthop when the packet’s source IP address matches ip_prefix. - • dst-ip: This policy sends the packet to the nexthop when + • dst-ip: This policy sends the packet to the nexthop when the packet’s destination IP address matches ip_prefix. If not specified, the default is dst-ip. nexthop: string - Nexthop IP address for this route. Nexthop IP address should be + Nexthop IP address for this route. Nexthop IP address should be the IP address of a connected router port or the IP address of a logical port or can be set to discard for dropping packets which match the given route. output_port: optional string - The name of the Logical_Router_Port via which the packet needs - to be sent out. This is optional and when not specified, OVN - will automatically figure this out based on the nexthop. When - this is specified and there are multiple IP addresses on the - router port and none of them are in the same subnet of nexthop, - OVN chooses the first IP address as the one via which the nex‐ + The name of the Logical_Router_Port via which the packet needs + to be sent out. This is optional and when not specified, OVN + will automatically figure this out based on the nexthop. When + this is specified and there are multiple IP addresses on the + router port and none of them are in the same subnet of nexthop, + OVN chooses the first IP address as the one via which the nex‐ thop is reachable. bfd: optional weak reference to BFD Reference to BFD row if the route has associated a BFD session route_table: string - Any string to place route to separate routing table. If Logical - Router Port has configured value in options:route_table other + Any string to place route to separate routing table. If Logical + Router Port has configured value in options:route_table other than empty string, OVN performs route lookup for all packets en‐ - tering Logical Router ingress pipeline from this port in the + tering Logical Router ingress pipeline from this port in the following manner: - • 1. First lookup among "global" routes: routes without - route_table value set and routes to directly connected + • 1. First lookup among "global" routes: routes without + route_table value set and routes to directly connected networks. - • 2. Next lookup among routes with same route_table value + • 2. Next lookup among routes with same route_table value as specified in LRP’s options:route_table field. external_ids : ic-learned-route: optional string - ovn-ic populates this key if the route is learned from the - global OVN_IC_Southbound database. In this case the value will - be set to the uuid of the row in Route table of the + ovn-ic populates this key if the route is learned from the + global OVN_IC_Southbound database. In this case the value will + be set to the uuid of the row in Route table of the OVN_IC_Southbound database. Common Columns: @@ -3091,35 +3096,35 @@ Logical_Router_Static_Route TABLE Common options: options: map of string-string pairs - This column provides general key/value settings. The supported + This column provides general key/value settings. The supported options are described individually below. options : ecmp_symmetric_reply: optional string If true, then new traffic that arrives over this route will have - its reply traffic bypass ECMP route selection and will be sent - out this route instead. Note that this option overrides any - rules set in the Logical_Router_policy table. This option only - works on gateway routers (routers that have options:chassis + its reply traffic bypass ECMP route selection and will be sent + out this route instead. Note that this option overrides any + rules set in the Logical_Router_policy table. This option only + works on gateway routers (routers that have options:chassis set). options : origin: optional string In case ovn-interconnection has been learned this route, it will have its origin set: either "connected" or "static". This key is - supposed to be written only by ovn-ic daemon. ovn-northd then - checks this value when generating Logical Flows. Logi‐ - cal_Router_Static_Route records with same ip_prefix within same - Logical Router will have next lookup order based on origin key + supposed to be written only by ovn-ic daemon. ovn-northd then + checks this value when generating Logical Flows. Logi‐ + cal_Router_Static_Route records with same ip_prefix within same + Logical Router will have next lookup order based on origin key value: 1. connected 2. static Logical_Router_Policy TABLE - Each row in this table represents one routing policy for a logical + Each row in this table represents one routing policy for a logical router that points to it through its policies column. The action column - for the highest-priority matching row in this table determines a - packet’s treatment. If no row matches, packets are allowed by default. - (Default-deny treatment is possible: add a rule with priority 0, 1 as + for the highest-priority matching row in this table determines a + packet’s treatment. If no row matches, packets are allowed by default. + (Default-deny treatment is possible: add a rule with priority 0, 1 as match, and drop as action.) Summary: @@ -3135,17 +3140,17 @@ Logical_Router_Policy TABLE Details: priority: integer, in range 0 to 32,767 - The routing policy’s priority. Rules with numerically higher - priority take precedence over those with lower. A rule is + The routing policy’s priority. Rules with numerically higher + priority take precedence over those with lower. A rule is uniquely identified by the priority and match string. match: string - The packets that the routing policy should match, in the same - expression language used for the match column in the OVN South‐ + The packets that the routing policy should match, in the same + expression language used for the match column in the OVN South‐ bound database’s Logical_Flow table. - By default all traffic is allowed. When writing a more restric‐ - tive policy, it is important to remember to allow flows such as + By default all traffic is allowed. When writing a more restric‐ + tive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets. action: string, one of allow, drop, or reroute @@ -3160,13 +3165,13 @@ Logical_Router_Policy TABLE nexthop: optional string Note: This column is deprecated in favor of nexthops. - Next-hop IP address for this route, which should be the IP ad‐ - dress of a connected router port or the IP address of a logical + Next-hop IP address for this route, which should be the IP ad‐ + dress of a connected router port or the IP address of a logical port. nexthops: set of strings - Next-hop ECMP IP addresses for this route. Each IP in the list - should be the IP address of a connected router port or the IP + Next-hop ECMP IP addresses for this route. Each IP in the list + should be the IP address of a connected router port or the IP address of a logical port. One IP from the list is selected as next hop. @@ -3178,7 +3183,7 @@ Logical_Router_Policy TABLE options : pkt_mark: optional string Marks the packet with the value specified when the router policy is applied. CMS can inspect this packet marker and take some de‐ - cisions if desired. This value is not preserved when the packet + cisions if desired. This value is not preserved when the packet goes out on the wire. Common Columns: @@ -3190,7 +3195,7 @@ NAT TABLE Each record represents a NAT rule. Summary: - type string, one of dnat, dnat_and_snat, or + type string, one of dnat, dnat_and_snat, or snat external_ip string external_mac optional string @@ -3199,7 +3204,7 @@ NAT TABLE logical_port optional string allowed_ext_ips optional Address_Set exempted_ext_ips optional Address_Set - gateway_port optional weak reference to Logi‐ + gateway_port optional weak reference to Logi‐ cal_Router_Port options : stateless optional string options : add_route optional string @@ -3210,19 +3215,19 @@ NAT TABLE type: string, one of dnat, dnat_and_snat, or snat Type of the NAT rule. - • When type is dnat, the externally visible IP address ex‐ - ternal_ip is DNATted to the IP address logical_ip in the + • When type is dnat, the externally visible IP address ex‐ + ternal_ip is DNATted to the IP address logical_ip in the logical space. - • When type is snat, IP packets with their source IP ad‐ + • When type is snat, IP packets with their source IP ad‐ dress that either matches the IP address in logical_ip or - is in the network provided by logical_ip is SNATed into + is in the network provided by logical_ip is SNATed into the IP address in external_ip. • When type is dnat_and_snat, the externally visible IP ad‐ dress external_ip is DNATted to the IP address logical_ip - in the logical space. In addition, IP packets with the - source IP address that matches logical_ip is SNATed into + in the logical space. In addition, IP packets with the + source IP address that matches logical_ip is SNATed into the IP address in external_ip. external_ip: string @@ -3231,14 +3236,14 @@ NAT TABLE external_mac: optional string A MAC address. - This is only used on the gateway port on distributed routers. + This is only used on the gateway port on distributed routers. This must be specified in order for the NAT rule to be processed in a distributed manner on all chassis. If this is not specified - for a NAT rule on a distributed router, then this NAT rule will - be processed in a centralized manner on the gateway port in‐ + for a NAT rule on a distributed router, then this NAT rule will + be processed in a centralized manner on the gateway port in‐ stance on the gateway chassis. - This MAC address must be unique on the logical switch that the + This MAC address must be unique on the logical switch that the gateway port is attached to. If the MAC address used on the log‐ ical_port is globally unique, then that MAC address can be spec‐ ified as this external_mac. @@ -3246,8 +3251,8 @@ NAT TABLE external_port_range: string L4 source port range - Range of ports, from which a port number will be picked that - will replace the source port of to be NATed packet. This is ba‐ + Range of ports, from which a port number will be picked that + will replace the source port of to be NATed packet. This is ba‐ sically PAT (port address translation). Value of the column is in the format, port_lo-port_hi. For exam‐ @@ -3262,88 +3267,88 @@ NAT TABLE The name of the logical port where the logical_ip resides. This is only used on distributed routers. This must be specified - in order for the NAT rule to be processed in a distributed man‐ + in order for the NAT rule to be processed in a distributed man‐ ner on all chassis. If this is not specified for a NAT rule on a - distributed router, then this NAT rule will be processed in a - centralized manner on the gateway port instance on the gateway + distributed router, then this NAT rule will be processed in a + centralized manner on the gateway port instance on the gateway chassis. allowed_ext_ips: optional Address_Set - It represents Address Set of external ips that NAT rule is ap‐ + It represents Address Set of external ips that NAT rule is ap‐ plicable to. For SNAT type NAT rules, this refers to destination - addresses. For DNAT type NAT rules, this refers to source ad‐ + addresses. For DNAT type NAT rules, this refers to source ad‐ dresses. - This configuration overrides the default NAT behavior of apply‐ - ing a rule solely based on internal IP. Without this configura‐ - tion, NAT happens without considering the external IP (i.e - dest/source for snat/dnat type rule). With this configuration - NAT rule is applied ONLY if external ip is in the input Address + This configuration overrides the default NAT behavior of apply‐ + ing a rule solely based on internal IP. Without this configura‐ + tion, NAT happens without considering the external IP (i.e + dest/source for snat/dnat type rule). With this configuration + NAT rule is applied ONLY if external ip is in the input Address Set. exempted_ext_ips: optional Address_Set - It represents Address Set of external ips that NAT rule is NOT - applicable to. For SNAT type NAT rules, this refers to destina‐ - tion addresses. For DNAT type NAT rules, this refers to source + It represents Address Set of external ips that NAT rule is NOT + applicable to. For SNAT type NAT rules, this refers to destina‐ + tion addresses. For DNAT type NAT rules, this refers to source addresses. - This configuration overrides the default NAT behavior of apply‐ - ing a rule solely based on internal IP. Without this configura‐ - tion, NAT happens without considering the external IP (i.e - dest/source for snat/dnat type rule). With this configuration - NAT rule is NOT applied if external ip is in the input Address + This configuration overrides the default NAT behavior of apply‐ + ing a rule solely based on internal IP. Without this configura‐ + tion, NAT happens without considering the external IP (i.e + dest/source for snat/dnat type rule). With this configuration + NAT rule is NOT applied if external ip is in the input Address Set. - If there are NAT rules in a logical router with overlapping IP - prefixes (including /32), then usage of exempted_ext_ips should - be avoided in following scenario. a. SNAT rule (let us say - RULE1) with logical_ip PREFIX/MASK (let us say 50.0.0.0/24). b. - SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1 (let - us say 50.0.0.0/25). c. Now, if exempted_ext_ips is associated + If there are NAT rules in a logical router with overlapping IP + prefixes (including /32), then usage of exempted_ext_ips should + be avoided in following scenario. a. SNAT rule (let us say + RULE1) with logical_ip PREFIX/MASK (let us say 50.0.0.0/24). b. + SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1 (let + us say 50.0.0.0/25). c. Now, if exempted_ext_ips is associated with RULE2, then a logical ip which matches both 50.0.0.0/24 and 50.0.0.0/25 may get the RULE2 applied to it instead of RULE1. - allowed_ext_ips and exempted_ext_ips are mutually exclusive to - each other. If both Address Sets are set for a rule, then the + allowed_ext_ips and exempted_ext_ips are mutually exclusive to + each other. If both Address Sets are set for a rule, then the NAT rule is not considered. gateway_port: optional weak reference to Logical_Router_Port - A distributed gateway port in the Logical_Router_Port table + A distributed gateway port in the Logical_Router_Port table where the NAT rule needs to be applied. When multiple distributed gateway ports are configured on a Log‐ - ical_Router, applying a NAT rule at each of the distributed - gateway ports might not be desired. Consider the case where a + ical_Router, applying a NAT rule at each of the distributed + gateway ports might not be desired. Consider the case where a logical router has 2 distributed gateway port, one with networks - 50.0.0.10/24 and the other with networks 60.0.0.10/24. If the - logical router has a NAT rule of type snat, logical_ip - 10.1.1.0/24 and external_ip 50.1.1.20/24, the rule needs to be + 50.0.0.10/24 and the other with networks 60.0.0.10/24. If the + logical router has a NAT rule of type snat, logical_ip + 10.1.1.0/24 and external_ip 50.1.1.20/24, the rule needs to be selectively applied on matching packets entering/leaving through the distributed gateway port with networks 50.0.0.10/24. When a logical router has multiple distributed gateway ports and this column is not set for a NAT rule, then the rule will be ap‐ - plied at the distributed gateway port which is in the same net‐ - work as the external_ip of the NAT rule, if such a router port - exists. If logical router has a single distributed gateway port - and this column is not set for a NAT rule, the rule will be ap‐ + plied at the distributed gateway port which is in the same net‐ + work as the external_ip of the NAT rule, if such a router port + exists. If logical router has a single distributed gateway port + and this column is not set for a NAT rule, the rule will be ap‐ plied at the distributed gateway port even if the router port is not in the same network as the external_ip of the NAT rule. options : stateless: optional string - Indicates if a dnat_and_snat rule should lead to connection + Indicates if a dnat_and_snat rule should lead to connection tracking state or not. options : add_route: optional string - If set to true, then neighbor routers will have logical flows - added that will allow for routing to the NAT address. It also - will have ARP resolution logical flows added. By setting this - option, it means there is no reason to create a Logi‐ - cal_Router_Static_Route from neighbor routers to this NAT ad‐ - dress. It also means that no ARP request is required for neigh‐ - bor routers to learn the IP-MAC mapping for this NAT address. + If set to true, then neighbor routers will have logical flows + added that will allow for routing to the NAT address. It also + will have ARP resolution logical flows added. By setting this + option, it means there is no reason to create a Logi‐ + cal_Router_Static_Route from neighbor routers to this NAT ad‐ + dress. It also means that no ARP request is required for neigh‐ + bor routers to learn the IP-MAC mapping for this NAT address. This option only applies to NATs of type dnat and dnat_and_snat. - For more information about what flows are added for IP routes, + For more information about what flows are added for IP routes, please see the ovn-northd manpage section on IP Routing. Common Columns: @@ -3352,13 +3357,13 @@ NAT TABLE See External IDs at the beginning of this document. DHCP_Options TABLE - OVN implements native DHCPv4 support which caters to the common use - case of providing an IPv4 address to a booting instance by providing + OVN implements native DHCPv4 support which caters to the common use + case of providing an IPv4 address to a booting instance by providing stateless replies to DHCPv4 requests based on statically configured ad‐ - dress mappings. To do this it allows a short list of DHCPv4 options to + dress mappings. To do this it allows a short list of DHCPv4 options to be configured and applied at each compute host running ovn-controller. - OVN also implements native DHCPv6 support which provides stateless + OVN also implements native DHCPv6 support which provides stateless replies to DHCPv6 requests. Summary: @@ -3367,7 +3372,7 @@ DHCP_Options TABLE Mandatory DHCPv4 options: options : server_id optional string options : server_mac optional string - options : lease_time optional string, containing an integer, + options : lease_time optional string, containing an integer, in range 0 to 4,294,967,295 IPv4 DHCP Options: options : router optional string @@ -3395,24 +3400,24 @@ DHCP_Options TABLE optional string, either 0 or 1 options : ethernet_encap optional string, either 0 or 1 Integer DHCP Options: - options : default_ttl optional string, containing an integer, + options : default_ttl optional string, containing an integer, in range 0 to 255 - options : tcp_ttl optional string, containing an integer, + options : tcp_ttl optional string, containing an integer, in range 0 to 255 - options : mtu optional string, containing an integer, + options : mtu optional string, containing an integer, in range 68 to 65,535 - options : T1 optional string, containing an integer, + options : T1 optional string, containing an integer, in range 68 to 4,294,967,295 - options : T2 optional string, containing an integer, + options : T2 optional string, containing an integer, in range 68 to 4,294,967,295 options : arp_cache_timeout - optional string, containing an integer, + optional string, containing an integer, in range 0 to 255 options : tcp_keepalive_interval - optional string, containing an integer, + optional string, containing an integer, in range 0 to 255 options : netbios_node_type - optional string, containing an integer, + optional string, containing an integer, in range 0 to 255 String DHCP Options: options : wpad optional string @@ -3446,14 +3451,14 @@ DHCP_Options TABLE Details: cidr: string - The DHCPv4/DHCPv6 options will be included if the logical port + The DHCPv4/DHCPv6 options will be included if the logical port has its IP address in this cidr. DHCPv4 options: - The CMS should define the set of DHCPv4 options as key/value pairs in - the options column of this table. For ovn-controller to include these - DHCPv4 options, the dhcpv4_options of Logical_Switch_Port should refer + The CMS should define the set of DHCPv4 options as key/value pairs in + the options column of this table. For ovn-controller to include these + DHCPv4 options, the dhcpv4_options of Logical_Switch_Port should refer to an entry in this table. Mandatory DHCPv4 options: @@ -3462,7 +3467,7 @@ DHCP_Options TABLE options : server_id: optional string The IP address for the DHCP server to use. This should be in the - subnet of the offered IP. This is also included in the DHCP of‐ + subnet of the offered IP. This is also included in the DHCP of‐ fer as option 54, ``server identifier.’’ options : server_mac: optional string @@ -3476,14 +3481,14 @@ DHCP_Options TABLE IPv4 DHCP Options: - Below are the supported DHCPv4 options whose values are an IPv4 ad‐ - dress, e.g. 192.168.1.1. Some options accept multiple IPv4 addresses - enclosed within curly braces, e.g. {192.168.1.2, 192.168.1.3}. Please + Below are the supported DHCPv4 options whose values are an IPv4 ad‐ + dress, e.g. 192.168.1.1. Some options accept multiple IPv4 addresses + enclosed within curly braces, e.g. {192.168.1.2, 192.168.1.3}. Please refer to RFC 2132 for more details on DHCPv4 options and their codes. options : router: optional string - The IP address of a gateway for the client to use. This should - be in the subnet of the offered IP. The DHCPv4 option code for + The IP address of a gateway for the client to use. This should + be in the subnet of the offered IP. The DHCPv4 option code for this option is 3. options : netmask: optional string @@ -3520,19 +3525,19 @@ DHCP_Options TABLE The DHCPv4 option code for this option is 121. This option can contain one or more static routes, each of which - consists of a destination descriptor and the IP address of the + consists of a destination descriptor and the IP address of the router that should be used to reach that destination. Please see RFC 3442 for more details. Example: {30.0.0.0/24,10.0.0.10, 0.0.0.0/0,10.0.0.1} options : ms_classless_static_route: optional string - The DHCPv4 option code for this option is 249. This option is + The DHCPv4 option code for this option is 249. This option is similar to classless_static_route supported by Microsoft Windows DHCPv4 clients. options : next_server: optional string - The DHCPv4 option code for setting the "Next server IP address" + The DHCPv4 option code for setting the "Next server IP address" field in the DHCP header. Boolean DHCP Options: @@ -3567,14 +3572,14 @@ DHCP_Options TABLE options : T1: optional string, containing an integer, in range 68 to 4,294,967,295 - This specifies the time interval from address assignment until + This specifies the time interval from address assignment until the client begins trying to renew its address. The DHCPv4 option code for this option is 58. options : T2: optional string, containing an integer, in range 68 to 4,294,967,295 - This specifies the time interval from address assignment until - the client begins trying to rebind its address. The DHCPv4 op‐ + This specifies the time interval from address assignment until + the client begins trying to rebind its address. The DHCPv4 op‐ tion code for this option is 59. options : arp_cache_timeout: optional string, containing an integer, in @@ -3597,30 +3602,30 @@ DHCP_Options TABLE These options accept a string value. options : wpad: optional string - The DHCPv4 option code for this option is 252. This option is - used as part of web proxy auto discovery to provide a URL for a + The DHCPv4 option code for this option is 252. This option is + used as part of web proxy auto discovery to provide a URL for a web proxy. options : bootfile_name: optional string - The DHCPv4 option code for this option is 67. This option is + The DHCPv4 option code for this option is 67. This option is used to identify a bootfile. options : path_prefix: optional string The DHCPv4 option code for this option is 210. In PXELINUX’ case - this option is used to set a common path prefix, instead of de‐ + this option is used to set a common path prefix, instead of de‐ riving it from the bootfile name. options : tftp_server_address: optional string - The DHCPv4 option code for this option is 150. The option con‐ - tains one or more IPv4 addresses that the client MAY use. This + The DHCPv4 option code for this option is 150. The option con‐ + tains one or more IPv4 addresses that the client MAY use. This option is Cisco proprietary, the IEEE standard that matches with this requirement is option 66 (tftp_server). options : hostname: optional string - The DHCPv4 option code for this option is 12. If set, indicates - the DHCPv4 option "Hostname". Alternatively, this option can be + The DHCPv4 option code for this option is 12. If set, indicates + the DHCPv4 option "Hostname". Alternatively, this option can be configured in options:hostname column in table Logi‐ - cal_Switch_Port. If Hostname option value is set in both con‐ + cal_Switch_Port. If Hostname option value is set in both con‐ flicting Logical_Switch_Port and DHCP_Options tables, Logi‐ cal_Switch_Port takes precedence. @@ -3630,10 +3635,10 @@ DHCP_Options TABLE names via the Domain Name System. options : bootfile_name_alt: optional string - "bootfile_name_alt" option is used to support iPXE. When both + "bootfile_name_alt" option is used to support iPXE. When both "bootfile_name" and "bootfile_name_alt" are provided by the CMS, - "bootfile_name" will be used for option 67 if the dhcp request - contains etherboot option (175), otherwise "bootfile_name_alt" + "bootfile_name" will be used for option 67 if the dhcp request + contains etherboot option (175), otherwise "bootfile_name_alt" will be used. options : broadcast_address: optional string @@ -3649,7 +3654,7 @@ DHCP_Options TABLE DHCP Options of type domains: - These options accept string value which is a comma separated list of + These options accept string value which is a comma separated list of domain names. The domain names are encoded based on RFC 1035. options : domain_search_list: optional string @@ -3657,10 +3662,10 @@ DHCP_Options TABLE DHCPv6 options: - OVN also implements native DHCPv6 support. The CMS should define the - set of DHCPv6 options as key/value pairs. The define DHCPv6 options - will be included in the DHCPv6 response to the DHCPv6 Solicit/Re‐ - quest/Confirm packet from the logical ports having the IPv6 addresses + OVN also implements native DHCPv6 support. The CMS should define the + set of DHCPv6 options as key/value pairs. The define DHCPv6 options + will be included in the DHCPv6 response to the DHCPv6 Solicit/Re‐ + quest/Confirm packet from the logical ports having the IPv6 addresses in the cidr. Mandatory DHCPv6 options: @@ -3668,17 +3673,17 @@ DHCP_Options TABLE The following options must be defined. options : server_id: optional string - The Ethernet address for the DHCP server to use. This is also - included in the DHCPv6 reply as option 2, ``Server Identifier’’ - to carry a DUID identifying a server between a client and a - server. ovn-controller defines DUID based on Link-layer Address + The Ethernet address for the DHCP server to use. This is also + included in the DHCPv6 reply as option 2, ``Server Identifier’’ + to carry a DUID identifying a server between a client and a + server. ovn-controller defines DUID based on Link-layer Address [DUID-LL]. IPv6 DHCPv6 options: - Below are the supported DHCPv6 options whose values are an IPv6 ad‐ - dress, e.g. aef0::4. Some options accept multiple IPv6 addresses en‐ - closed within curly braces, e.g. {aef0::4, aef0::5}. Please refer to + Below are the supported DHCPv6 options whose values are an IPv6 ad‐ + dress, e.g. aef0::4. Some options accept multiple IPv6 addresses en‐ + closed within curly braces, e.g. {aef0::4, aef0::5}. Please refer to RFC 3315 for more details on DHCPv6 options and their codes. options : dns_server: optional string @@ -3691,21 +3696,21 @@ DHCP_Options TABLE options : domain_search: optional string The DHCPv6 option code for this option is 24. This option speci‐ - fies the domain search list the client should use to resolve + fies the domain search list the client should use to resolve hostnames with DNS. Example: "ovn.org". options : dhcpv6_stateless: optional string - This option specifies the OVN native DHCPv6 will work in state‐ + This option specifies the OVN native DHCPv6 will work in state‐ less mode, which means OVN native DHCPv6 will not offer IPv6 ad‐ - dresses for VM/VIF ports, but only reply other configurations, - such as DNS and domain search list. When setting this option - with string value "true", VM/VIF will configure IPv6 addresses + dresses for VM/VIF ports, but only reply other configurations, + such as DNS and domain search list. When setting this option + with string value "true", VM/VIF will configure IPv6 addresses by stateless way. Default value for this option is false. options : fqdn: optional string - The DHCPv6 option code for this option is 39. If set, indicates + The DHCPv6 option code for this option is 39. If set, indicates the DHCPv6 option "FQDN". Common Columns: @@ -3714,14 +3719,14 @@ DHCP_Options TABLE See External IDs at the beginning of this document. Connection TABLE - Configuration for a database connection to an Open vSwitch database + Configuration for a database connection to an Open vSwitch database (OVSDB) client. - This table primarily configures the Open vSwitch database server + This table primarily configures the Open vSwitch database server (ovsdb-server). - The Open vSwitch database server can initiate and maintain active con‐ - nections to remote clients. It can also listen for database connec‐ + The Open vSwitch database server can initiate and maintain active con‐ + nections to remote clients. It can also listen for database connec‐ tions. Summary: @@ -3733,17 +3738,17 @@ Connection TABLE Status: is_connected boolean status : last_error optional string - status : state optional string, one of ACTIVE, BACKOFF, + status : state optional string, one of ACTIVE, BACKOFF, CONNECTING, IDLE, or VOID - status : sec_since_connect optional string, containing an integer, + status : sec_since_connect optional string, containing an integer, at least 0 status : sec_since_disconnect - optional string, containing an integer, + optional string, containing an integer, at least 0 status : locks_held optional string status : locks_waiting optional string status : locks_lost optional string - status : n_connections optional string, containing an integer, + status : n_connections optional string, containing an integer, at least 2 status : bound_port optional string, containing an integer Common Columns: @@ -3759,20 +3764,20 @@ Connection TABLE The following connection methods are currently supported: ssl:host[:port] - The specified SSL port on the host at the given host, + The specified SSL port on the host at the given host, which can either be a DNS name (if built with unbound li‐ - brary) or an IP address. A valid SSL configuration must - be provided when this form is used, this configuration - can be specified via command-line options or the SSL ta‐ + brary) or an IP address. A valid SSL configuration must + be provided when this form is used, this configuration + can be specified via command-line options or the SSL ta‐ ble. If port is not specified, it defaults to 6640. - SSL support is an optional feature that is not always + SSL support is an optional feature that is not always built as part of Open vSwitch. tcp:host[:port] - The specified TCP port on the host at the given host, + The specified TCP port on the host at the given host, which can either be a DNS name (if built with unbound li‐ brary) or an IP address. If host is an IPv6 address, wrap it in square brackets, e.g. tcp:[::1]:6640. @@ -3780,54 +3785,54 @@ Connection TABLE If port is not specified, it defaults to 6640. pssl:[port][:host] - Listens for SSL connections on the specified TCP port. - Specify 0 for port to have the kernel automatically - choose an available port. If host, which can either be a - DNS name (if built with unbound library) or an IP ad‐ - dress, is specified, then connections are restricted to + Listens for SSL connections on the specified TCP port. + Specify 0 for port to have the kernel automatically + choose an available port. If host, which can either be a + DNS name (if built with unbound library) or an IP ad‐ + dress, is specified, then connections are restricted to the resolved or specified local IPaddress (either IPv4 or IPv6 address). If host is an IPv6 address, wrap in square - brackets, e.g. pssl:6640:[::1]. If host is not specified - then it listens only on IPv4 (but not IPv6) addresses. A - valid SSL configuration must be provided when this form - is used, this can be specified either via command-line + brackets, e.g. pssl:6640:[::1]. If host is not specified + then it listens only on IPv4 (but not IPv6) addresses. A + valid SSL configuration must be provided when this form + is used, this can be specified either via command-line options or the SSL table. If port is not specified, it defaults to 6640. - SSL support is an optional feature that is not always + SSL support is an optional feature that is not always built as part of Open vSwitch. ptcp:[port][:host] - Listens for connections on the specified TCP port. Spec‐ + Listens for connections on the specified TCP port. Spec‐ ify 0 for port to have the kernel automatically choose an - available port. If host, which can either be a DNS name - (if built with unbound library) or an IP address, is - specified, then connections are restricted to the re‐ + available port. If host, which can either be a DNS name + (if built with unbound library) or an IP address, is + specified, then connections are restricted to the re‐ solved or specified local IP address (either IPv4 or IPv6 - address). If host is an IPv6 address, wrap it in square - brackets, e.g. ptcp:6640:[::1]. If host is not specified + address). If host is an IPv6 address, wrap it in square + brackets, e.g. ptcp:6640:[::1]. If host is not specified then it listens only on IPv4 addresses. If port is not specified, it defaults to 6640. - When multiple clients are configured, the target values must be + When multiple clients are configured, the target values must be unique. Duplicate target values yield unspecified results. Client Failure Detection and Handling: max_backoff: optional integer, at least 1,000 - Maximum number of milliseconds to wait between connection at‐ + Maximum number of milliseconds to wait between connection at‐ tempts. Default is implementation-specific. inactivity_probe: optional integer Maximum number of milliseconds of idle time on connection to the - client before sending an inactivity probe message. If Open - vSwitch does not communicate with the client for the specified - number of seconds, it will send a probe. If a response is not - received for the same additional amount of time, Open vSwitch - assumes the connection has been broken and attempts to recon‐ - nect. Default is implementation-specific. A value of 0 disables + client before sending an inactivity probe message. If Open + vSwitch does not communicate with the client for the specified + number of seconds, it will send a probe. If a response is not + received for the same additional amount of time, Open vSwitch + assumes the connection has been broken and attempts to recon‐ + nect. Default is implementation-specific. A value of 0 disables inactivity probes. Status: @@ -3836,12 +3841,12 @@ Connection TABLE in the status columns may be updated depends on the target type. When target specifies a connection method that listens for inbound con‐ - nections (e.g. ptcp: or punix:), both n_connections and is_connected + nections (e.g. ptcp: or punix:), both n_connections and is_connected may also be updated while the remaining key-value pairs are omitted. - On the other hand, when target specifies an outbound connection, all - key-value pairs may be updated, except the above-mentioned two key- - value pairs associated with inbound connection targets. They are omit‐ + On the other hand, when target specifies an outbound connection, all + key-value pairs may be updated, except the above-mentioned two key- + value pairs associated with inbound connection targets. They are omit‐ ted. is_connected: boolean @@ -3849,7 +3854,7 @@ Connection TABLE status : last_error: optional string A human-readable description of the last error on the connection - to the manager; i.e. strerror(errno). This key will exist only + to the manager; i.e. strerror(errno). This key will exist only if an error has occurred. status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, @@ -3868,7 +3873,7 @@ Connection TABLE IDLE Connection is idle. Waiting for response to keep-alive. - These values may change in the future. They are provided only + These values may change in the future. They are provided only for human consumption. status : sec_since_connect: optional string, containing an integer, at @@ -3879,48 +3884,48 @@ Connection TABLE status : sec_since_disconnect: optional string, containing an integer, at least 0 - The amount of time since this client last disconnected from the - database (in seconds). Value is empty if client has never dis‐ + The amount of time since this client last disconnected from the + database (in seconds). Value is empty if client has never dis‐ connected. status : locks_held: optional string - Space-separated list of the names of OVSDB locks that the con‐ - nection holds. Omitted if the connection does not hold any + Space-separated list of the names of OVSDB locks that the con‐ + nection holds. Omitted if the connection does not hold any locks. status : locks_waiting: optional string - Space-separated list of the names of OVSDB locks that the con‐ - nection is currently waiting to acquire. Omitted if the connec‐ + Space-separated list of the names of OVSDB locks that the con‐ + nection is currently waiting to acquire. Omitted if the connec‐ tion is not waiting for any locks. status : locks_lost: optional string - Space-separated list of the names of OVSDB locks that the con‐ - nection has had stolen by another OVSDB client. Omitted if no + Space-separated list of the names of OVSDB locks that the con‐ + nection has had stolen by another OVSDB client. Omitted if no locks have been stolen from this connection. status : n_connections: optional string, containing an integer, at least 2 - When target specifies a connection method that listens for in‐ - bound connections (e.g. ptcp: or pssl:) and more than one con‐ - nection is actually active, the value is the number of active + When target specifies a connection method that listens for in‐ + bound connections (e.g. ptcp: or pssl:) and more than one con‐ + nection is actually active, the value is the number of active connections. Otherwise, this key-value pair is omitted. status : bound_port: optional string, containing an integer When target is ptcp: or pssl:, this is the TCP port on which the - OVSDB server is listening. (This is particularly useful when - target specifies a port of 0, allowing the kernel to choose any + OVSDB server is listening. (This is particularly useful when + target specifies a port of 0, allowing the kernel to choose any available port.) Common Columns: - The overall purpose of these columns is described under Common Columns + The overall purpose of these columns is described under Common Columns at the beginning of this document. external_ids: map of string-string pairs other_config: map of string-string pairs DNS TABLE - Each row in this table stores the DNS records. The Logical_Switch ta‐ + Each row in this table stores the DNS records. The Logical_Switch ta‐ ble’s dns_records references these records. Summary: @@ -3932,8 +3937,8 @@ DNS TABLE records: map of string-string pairs Key-value pair of DNS records with DNS query name as the key and value as a string of IP address(es) separated by comma or space. - For PTR requests, the key-value pair can be Reverse IPv4 ad‐ - dress.in-addr.arpa and the value DNS domain name. For IPv6 ad‐ + For PTR requests, the key-value pair can be Reverse IPv4 ad‐ + dress.in-addr.arpa and the value DNS domain name. For IPv6 ad‐ dresses, the key has to be Reverse IPv6 address.ip6.arpa. Example: "vm1.ovn.org" = "10.0.0.4 aef0::4" @@ -3941,13 +3946,13 @@ DNS TABLE Example: "4.0.0.10.in-addr.arpa" = "vm1.ovn.org" options : ovn-owned: optional string - If set to true, then the OVN will be the main responsible for + If set to true, then the OVN will be the main responsible for DNS Records within this row. - A DNS row with this option set to true can be created for do‐ - mains that the user needs to configure locally and don’t care - about IPv6 only interested in IPv4 or vice versa. This will let - ovn send IPv4 DNS reply and reject/ignore IPv6 queries to save + A DNS row with this option set to true can be created for do‐ + mains that the user needs to configure locally and don’t care + about IPv6 only interested in IPv4 or vice versa. This will let + ovn send IPv4 DNS reply and reject/ignore IPv6 queries to save the waiting for a timeout on those uninteresting queries. external_ids: map of string-string pairs @@ -3968,28 +3973,28 @@ SSL TABLE Details: private_key: string - Name of a PEM file containing the private key used as the + Name of a PEM file containing the private key used as the switch’s identity for SSL connections to the controller. certificate: string - Name of a PEM file containing a certificate, signed by the cer‐ + Name of a PEM file containing a certificate, signed by the cer‐ tificate authority (CA) used by the controller and manager, that - certifies the switch’s private key, identifying a trustworthy + certifies the switch’s private key, identifying a trustworthy switch. ca_cert: string - Name of a PEM file containing the CA certificate used to verify + Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller. bootstrap_ca_cert: boolean - If set to true, then Open vSwitch will attempt to obtain the CA - certificate from the controller on its first SSL connection and - save it to the named PEM file. If it is successful, it will im‐ - mediately drop the connection and reconnect, and from then on - all SSL connections must be authenticated by a certificate - signed by the CA certificate thus obtained. This option exposes - the SSL connection to a man-in-the-middle attack obtaining the - initial CA certificate. It may still be useful for bootstrap‐ + If set to true, then Open vSwitch will attempt to obtain the CA + certificate from the controller on its first SSL connection and + save it to the named PEM file. If it is successful, it will im‐ + mediately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certificate + signed by the CA certificate thus obtained. This option exposes + the SSL connection to a man-in-the-middle attack obtaining the + initial CA certificate. It may still be useful for bootstrap‐ ping. ssl_protocols: string @@ -3997,18 +4002,18 @@ SSL TABLE fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2. ssl_ciphers: string - List of ciphers (in OpenSSL cipher string format) to be sup‐ - ported for SSL connections. The default when this option is + List of ciphers (in OpenSSL cipher string format) to be sup‐ + ported for SSL connections. The default when this option is omitted is HIGH:!aNULL:!MD5. Common Columns: - The overall purpose of these columns is described under Common Columns + The overall purpose of these columns is described under Common Columns at the beginning of this document. external_ids: map of string-string pairs Gateway_Chassis TABLE - Association of a chassis to a logical router port. The traffic going + Association of a chassis to a logical router port. The traffic going out through an specific router port will be redirected to a chassis, or a set of them in high availability configurations. @@ -4029,11 +4034,11 @@ Gateway_Chassis TABLE chassis_name: string Name of the chassis that we want to redirect traffic through for - the associated logical router port. The value must match the + the associated logical router port. The value must match the name column of the Chassis table in the OVN_Southbound database. priority: integer, in range 0 to 32,767 - This is the priority of a chassis among all Gateway_Chassis be‐ + This is the priority of a chassis among all Gateway_Chassis be‐ longing to the same logical router port. options: map of string-string pairs @@ -4046,11 +4051,11 @@ Gateway_Chassis TABLE HA_Chassis_Group TABLE Table representing a group of chassis which can provide high availabil‐ - ity services. Each chassis in the group is represented by the table - HA_Chassis. The HA chassis with highest priority will be the master of - this group. If the master chassis failover is detected, the HA chassis - with the next higher priority takes over the responsibility of provid‐ - ing the HA. If a distributed gateway router port references a row in + ity services. Each chassis in the group is represented by the table + HA_Chassis. The HA chassis with highest priority will be the master of + this group. If the master chassis failover is detected, the HA chassis + with the next higher priority takes over the responsibility of provid‐ + ing the HA. If a distributed gateway router port references a row in this table, then the master HA chassis in this group provides the gate‐ way functionality. @@ -4081,12 +4086,12 @@ HA_Chassis TABLE Details: chassis_name: string - Name of the chassis which is part of the HA chassis group. The - value must match the name column of the Chassis table in the + Name of the chassis which is part of the HA chassis group. The + value must match the name column of the Chassis table in the OVN_Southbound database. priority: integer, in range 0 to 32,767 - Priority of the chassis. Chassis with highest priority will be + Priority of the chassis. Chassis with highest priority will be the master. Common Columns: @@ -4095,13 +4100,13 @@ HA_Chassis TABLE See External IDs at the beginning of this document. BFD TABLE - Contains BFD parameter for ovn-controller BFD configuration. OVN BFD + Contains BFD parameter for ovn-controller BFD configuration. OVN BFD implementation is used to provide detection of failures in the path be‐ - tween adjacent forwarding engines, including the OVN interfaces. OVN - BFD provides link status info to OVN northd in order to update logical - flows according to the status of BFD endpoints. In the current imple‐ - mentation OVN BFD is used to check next-hop status for ECMP routes. - Please note BFD table refers to OVN BFD implementation and not to OVS + tween adjacent forwarding engines, including the OVN interfaces. OVN + BFD provides link status info to OVN northd in order to update logical + flows according to the status of BFD endpoints. In the current imple‐ + mentation OVN BFD is used to check next-hop status for ECMP routes. + Please note BFD table refers to OVN BFD implementation and not to OVS legacy one. Summary: @@ -4129,21 +4134,21 @@ BFD TABLE BFD peer IP address. min_tx: optional integer, at least 1 - This is the minimum interval, in milliseconds, that the local - system would like to use when transmitting BFD Control packets, - less any jitter applied. The value zero is reserved. Default + This is the minimum interval, in milliseconds, that the local + system would like to use when transmitting BFD Control packets, + less any jitter applied. The value zero is reserved. Default value is 1000 ms. min_rx: optional integer - This is the minimum interval, in milliseconds, between received - BFD Control packets that this system is capable of supporting, - less any jitter applied by the sender. If this value is zero, - the transmitting system does not want the remote system to send + This is the minimum interval, in milliseconds, between received + BFD Control packets that this system is capable of supporting, + less any jitter applied by the sender. If this value is zero, + the transmitting system does not want the remote system to send any periodic BFD Control packets. detect_mult: optional integer, at least 1 - Detection time multiplier. The negotiated transmit interval, - multiplied by this value, provides the Detection Time for the + Detection time multiplier. The negotiated transmit interval, + multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode. Default value is 5. options: map of string-string pairs @@ -4179,7 +4184,7 @@ Static_MAC_Binding TABLE Details: Configuration: - ovn-northd reads configuration from these columns and propagates the + ovn-northd reads configuration from these columns and propagates the value to SBDB. logical_port: string @@ -4195,19 +4200,19 @@ Static_MAC_Binding TABLE Override dynamically learnt MACs. Chassis_Template_Var TABLE - One record per chassis, each containing a map, variables, between tem‐ - plate variable names and their value for that specific chassis. A tem‐ + One record per chassis, each containing a map, variables, between tem‐ + plate variable names and their value for that specific chassis. A tem‐ plate variable has a name and potentially different values on different - hypervisors in the OVN cluster. For example, two rows, R1 = (.chas‐ - sis=C1, variables={(N: V1)} and R2 = (.chassis=C2, variables={(N: V2)} + hypervisors in the OVN cluster. For example, two rows, R1 = (.chas‐ + sis=C1, variables={(N: V1)} and R2 = (.chassis=C2, variables={(N: V2)} will make ovn-controller running on chassis C1 and C2 interpret the to‐ - ken N either as V1 (on C1) or as V2 (on C2). Users can refer to tem‐ + ken N either as V1 (on C1) or as V2 (on C2). Users can refer to tem‐ plate variables from within other logical components, e.g., within ACL, - QoS or Logical_Router_Policy matches or from Load_Balancer VIP and + QoS or Logical_Router_Policy matches or from Load_Balancer VIP and backend definitions. - If a template variable is referenced on a chassis for which that vari‐ - able is not defined then ovn-controller running on that chassis will + If a template variable is referenced on a chassis for which that vari‐ + able is not defined then ovn-controller running on that chassis will just interpret it as a raw string literal. Summary: diff --git a/src/static/support/dist-docs/ovn-nbctl.8.pdf b/src/static/support/dist-docs/ovn-nbctl.8.pdf index fb8a42ed..41f16e40 100644 Binary files a/src/static/support/dist-docs/ovn-nbctl.8.pdf and b/src/static/support/dist-docs/ovn-nbctl.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-northd.8 b/src/static/support/dist-docs/ovn-northd.8 index 1e910156..dde9c2ac 100644 --- a/src/static/support/dist-docs/ovn-northd.8 +++ b/src/static/support/dist-docs/ovn-northd.8 @@ -739,7 +739,7 @@ Priority\-50 flows that match ARP requests to each known IP address \fIA\fR of e .fi .IP These flows are omitted for logical ports (other than router ports or \fBlocalport\fR ports) that are down (unless \fB -ignore_lsp_down\fR is configured as true in \fBoptions\fR column of \fBNB_Global\fR table of the \fBNorthbound\fR database), for logical ports of type \fBvirtual\fR, for logical ports with \(cqunknown\(cq address set and for logical ports of a logical switch configured with \fBother_config:vlan\-passthru=true\fR\[char46] +ignore_lsp_down\fR is configured as true in \fBoptions\fR column of \fBNB_Global\fR table of the \fBNorthbound\fR database), for logical ports of type \fBvirtual\fR, for logical ports with \(cqunknown\(cq address set, for logical ports with the \fBoptions:disable_arp_nd_rsp=true\fR and for logical ports of a logical switch configured with \fBother_config:vlan\-passthru=true\fR\[char46] .IP The above ARP responder flows are added for the list of IPv4 addresses if defined in \fBoptions:arp_proxy\fR column of \fBLogical_Switch_Port\fR table for logical switch ports of type \fBrouter\fR\[char46] .IP \(bu @@ -1100,7 +1100,7 @@ A priority\-72 flow that outputs all ARP requests and ND packets with an Etherne .IP \(bu A priority\-70 flow that outputs all packets with an Ethernet broadcast or multicast \fBeth\[char46]dst\fR to the \fBMC_FLOOD\fR multicast group\[char46] .IP \(bu -One priority\-50 flow that matches each known Ethernet address against \fBeth\[char46]dst\fR\[char46] Action of this flow outputs the packet to the single associated output port if it is enabled\[char46] \fBdrop;\fR action is applied if LSP is disabled\[char46] +One priority\-50 flow that matches each known Ethernet address against \fBeth\[char46]dst\fR\[char46] Action of this flow outputs the packet to the single associated output port if it is enabled\[char46] \fBdrop;\fR action is applied if LSP is disabled\[char46] If the logical switch port of type VIF has the option \fBoptions:pkt_clone_type\fR is set to the value \fBmc_unknown\fR, then the packet is also forwarded to the \fBMC_UNKNOWN\fR multicast group\[char46] .IP For the Ethernet address on a logical switch port of type \fBrouter\fR, when that logical switch port\(cqs \fBaddresses\fR column is set to \fBrouter\fR and the connected logical router port has a gateway chassis: .RS diff --git a/src/static/support/dist-docs/ovn-northd.8.html b/src/static/support/dist-docs/ovn-northd.8.html index db2e0ca3..b827d1fb 100644 --- a/src/static/support/dist-docs/ovn-northd.8.html +++ b/src/static/support/dist-docs/ovn-northd.8.html @@ -1251,8 +1251,10 @@ ignore_lsp_down is configured as true in options column of NB_Global table of the Northbound database), for logi‐ cal ports of type virtual, for logical ports with ’un‐ - known’ address set and for logical ports of a logical - switch configured with other_config:vlan-passthru=true. + known’ address set, for logical ports with the op‐‐ + tions:disable_arp_nd_rsp=true and for logical ports of a + logical switch configured with other_con‐‐ + fig:vlan-passthru=true. The above ARP responder flows are added for the list of IPv4 addresses if defined in options:arp_proxy column of @@ -1644,7 +1646,11 @@ • One priority-50 flow that matches each known Ethernet ad‐ dress against eth.dst. Action of this flow outputs the packet to the single associated output port if it is en‐ - abled. drop; action is applied if LSP is disabled. + abled. drop; action is applied if LSP is disabled. If the + logical switch port of type VIF has the option op‐‐ + tions:pkt_clone_type is set to the value mc_unknown, then + the packet is also forwarded to the MC_UNKNOWN multicast + group. For the Ethernet address on a logical switch port of type router, when that logical switch port’s addresses column diff --git a/src/static/support/dist-docs/ovn-northd.8.pdf b/src/static/support/dist-docs/ovn-northd.8.pdf index 5d45a078..25584a02 100644 Binary files a/src/static/support/dist-docs/ovn-northd.8.pdf and b/src/static/support/dist-docs/ovn-northd.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-northd.8.txt b/src/static/support/dist-docs/ovn-northd.8.txt index 8e9148df..3c42c6c7 100644 --- a/src/static/support/dist-docs/ovn-northd.8.txt +++ b/src/static/support/dist-docs/ovn-northd.8.txt @@ -1250,8 +1250,10 @@ LOGICAL FLOW TABLE STRUCTURE ignore_lsp_down is configured as true in options column of NB_Global table of the Northbound database), for logi‐ cal ports of type virtual, for logical ports with ’un‐ - known’ address set and for logical ports of a logical - switch configured with other_config:vlan-passthru=true. + known’ address set, for logical ports with the op‐ + tions:disable_arp_nd_rsp=true and for logical ports of a + logical switch configured with other_con‐ + fig:vlan-passthru=true. The above ARP responder flows are added for the list of IPv4 addresses if defined in options:arp_proxy column of @@ -1643,7 +1645,11 @@ LOGICAL FLOW TABLE STRUCTURE • One priority-50 flow that matches each known Ethernet ad‐ dress against eth.dst. Action of this flow outputs the packet to the single associated output port if it is en‐ - abled. drop; action is applied if LSP is disabled. + abled. drop; action is applied if LSP is disabled. If the + logical switch port of type VIF has the option op‐ + tions:pkt_clone_type is set to the value mc_unknown, then + the packet is also forwarded to the MC_UNKNOWN multicast + group. For the Ethernet address on a logical switch port of type router, when that logical switch port’s addresses column diff --git a/src/static/support/dist-docs/ovn-sb.5 b/src/static/support/dist-docs/ovn-sb.5 index a19c1ea2..83e0bd80 100644 --- a/src/static/support/dist-docs/ovn-sb.5 +++ b/src/static/support/dist-docs/ovn-sb.5 @@ -3225,7 +3225,7 @@ The chassis that inserted this record\[char46] This column is used for RBAC purp .PP .PP .PP -Each row in this table configures monitoring a service for its liveness\[char46] The service can be an IPv4 TCP or UDP service\[char46] \fBovn\-controller\fR periodically sends out service monitor packets and updates the status of the service\[char46] Service monitoring for IPv6 services is not supported\[char46] +Each row in this table configures monitoring a service for its liveness\[char46] The service can be an IPv4 TCP or UDP service\[char46] \fBovn\-controller\fR periodically sends out service monitor packets and updates the status of the service\[char46] .PP .PP \fBovn\-northd\fR uses this feature to implement the load balancer health check feature offered to the CMS through the northbound database\[char46] @@ -3298,7 +3298,7 @@ The VIF of the logical port on which the service is running\[char46] The \fBovn\ .IP "\fBsrc_mac\fR: string" Source Ethernet address to use in the service monitor packet\[char46] .IP "\fBsrc_ip\fR: string" -Source IPv4 address to use in the service monitor packet\[char46] +Source IPv4 or IPv6 address to use in the service monitor packet\[char46] .IP "\fBchassis_name\fR: string" The name of the chassis where the logical port is bound\[char46] .IP "\fBoptions : interval\fR: optional string, containing an integer" diff --git a/src/static/support/dist-docs/ovn-sb.5.html b/src/static/support/dist-docs/ovn-sb.5.html index df8ae710..04db3fec 100644 --- a/src/static/support/dist-docs/ovn-sb.5.html +++ b/src/static/support/dist-docs/ovn-sb.5.html @@ -3708,7 +3708,7 @@ Each row in this table configures monitoring a service for its live‐ ness. The service can be an IPv4 TCP or UDP service. ovn-controller pe‐ riodically sends out service monitor packets and updates the status of - the service. Service monitoring for IPv6 services is not supported. + the service. ovn-northd uses this feature to implement the load balancer health check feature offered to the CMS through the northbound database. @@ -3756,7 +3756,8 @@ Source Ethernet address to use in the service monitor packet. src_ip: string - Source IPv4 address to use in the service monitor packet. + Source IPv4 or IPv6 address to use in the service monitor + packet. chassis_name: string The name of the chassis where the logical port is bound. @@ -3765,27 +3766,27 @@ The interval, in seconds, between service monitor checks. options : timeout: optional string, containing an integer - The time, in seconds, after which the service monitor check + The time, in seconds, after which the service monitor check times out. options : success_count: optional string, containing an integer - The number of successful checks after which the service is con‐ + The number of successful checks after which the service is con‐ sidered online. options : failure_count: optional string, containing an integer - The number of failure checks after which the service is consid‐ + The number of failure checks after which the service is consid‐ ered offline. Status Reporting: - The ovn-controller on the chassis that hosts the logical_port updates + The ovn-controller on the chassis that hosts the logical_port updates this column to report the service’s status. status: optional string, one of error, offline, or online - For TCP service, ovn-controller sends a SYN to the service and + For TCP service, ovn-controller sends a SYN to the service and expects an ACK response to consider the service to be online. - For UDP service, ovn-controller sends a UDP packet to the ser‐ + For UDP service, ovn-controller sends a UDP packet to the ser‐ vice and doesn’t expect any reply. If it receives an ICMP reply, then it considers the service to be offline. @@ -3814,50 +3815,50 @@ Details: name: string - A name for the load balancer. This name has no special meaning - or purpose other than to provide convenience for human interac‐ + A name for the load balancer. This name has no special meaning + or purpose other than to provide convenience for human interac‐ tion with the ovn-nb database. vips: map of string-string pairs - A map of virtual IP addresses (and an optional port number with - : as a separator) associated with this load balancer and their - corresponding endpoint IP addresses (and optional port numbers + A map of virtual IP addresses (and an optional port number with + : as a separator) associated with this load balancer and their + corresponding endpoint IP addresses (and optional port numbers with : as separators) separated by commas. protocol: optional string, one of sctp, tcp, or udp - Valid protocols are tcp, udp, or sctp. This column is useful - when a port number is provided as part of the vips column. If - this column is empty and a port number is provided as part of + Valid protocols are tcp, udp, or sctp. This column is useful + when a port number is provided as part of the vips column. If + this column is empty and a port number is provided as part of vips column, OVN assumes the protocol to be tcp. datapaths: set of Datapath_Bindings Datapaths to which this load balancer applies to. datapath_group: optional Logical_DP_Group - Deprecated. The group of datapaths to which this load balancer - applies to. This means that the same load balancer applies to + Deprecated. The group of datapaths to which this load balancer + applies to. This means that the same load balancer applies to all datapaths in a group. ls_datapath_group: optional Logical_DP_Group - The group of datapaths to which this load balancer applies to. - This means that the same load balancer applies to all datapaths + The group of datapaths to which this load balancer applies to. + This means that the same load balancer applies to all datapaths in a group. lr_datapath_group: optional Logical_DP_Group - The group of logical router datapaths to which this load bal‐ + The group of logical router datapaths to which this load bal‐ ancer applies to. This means that the same load balancer applies to all datapaths in a group. Load_Balancer options: options : hairpin_snat_ip: optional string - IP to be used as source IP for packets that have been hair- - pinned after load balancing. This value is automatically popu‐ + IP to be used as source IP for packets that have been hair- + pinned after load balancing. This value is automatically popu‐ lated by ovn-northd. options : hairpin_orig_tuple: optional string, either true or false This value is automatically set to true by ovn-northd when orig‐ - inal destination IP and transport port of the load balanced + inal destination IP and transport port of the load balanced packets are stored in registers reg1, reg2, xxreg1. Common Columns: @@ -3888,12 +3889,12 @@ Configuration: src_port: integer, in range 49,152 to 65,535 - udp source port used in bfd control packets. The source port + udp source port used in bfd control packets. The source port MUST be in the range 49152 through 65535 (RFC5881 section 4). disc: integer A unique, nonzero discriminator value generated by the transmit‐ - ting system, used to demultiplex multiple BFD sessions between + ting system, used to demultiplex multiple BFD sessions between the same pair of systems. logical_port: string @@ -3903,20 +3904,20 @@ BFD peer IP address. min_tx: integer - This is the minimum interval, in milliseconds, that the local - system would like to use when transmitting BFD Control packets, + This is the minimum interval, in milliseconds, that the local + system would like to use when transmitting BFD Control packets, less any jitter applied. The value zero is reserved. min_rx: integer - This is the minimum interval, in milliseconds, between received - BFD Control packets that this system is capable of supporting, - less any jitter applied by the sender. If this value is zero, - the transmitting system does not want the remote system to send + This is the minimum interval, in milliseconds, between received + BFD Control packets that this system is capable of supporting, + less any jitter applied by the sender. If this value is zero, + the transmitting system does not want the remote system to send any periodic BFD Control packets. detect_mult: integer - Detection time multiplier. The negotiated transmit interval, - multiplied by this value, provides the Detection Time for the + Detection time multiplier. The negotiated transmit interval, + multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode. chassis_name: string @@ -3941,12 +3942,12 @@ • up FDB TABLE - This table is primarily used to learn the MACs observed on a VIF (or a - localnet port with ’localnet_learn_fdb’ enabled) which belongs to a - Logical_Switch_Port record in OVN_Northbound whose port security is - disabled and ’unknown’ address set. If port security is disabled on a - Logical_Switch_Port record, OVN should allow traffic with any source - mac from the VIF. This table will be used to deliver a packet to the + This table is primarily used to learn the MACs observed on a VIF (or a + localnet port with ’localnet_learn_fdb’ enabled) which belongs to a + Logical_Switch_Port record in OVN_Northbound whose port security is + disabled and ’unknown’ address set. If port security is disabled on a + Logical_Switch_Port record, OVN should allow traffic with any source + mac from the VIF. This table will be used to deliver a packet to the VIF, If a packet’s eth.dst is learnt. Summary: @@ -3996,7 +3997,7 @@ The logical datapath to which the logical router port belongs. Chassis_Template_Var TABLE - Each record represents the set of template variable instantiations for + Each record represents the set of template variable instantiations for a given chassis and is populated by ovn-northd from the contents of the OVN_Northbound.Chassis_Template_Var table. diff --git a/src/static/support/dist-docs/ovn-sb.5.pdf b/src/static/support/dist-docs/ovn-sb.5.pdf index 1536217b..e7c7c550 100644 Binary files a/src/static/support/dist-docs/ovn-sb.5.pdf and b/src/static/support/dist-docs/ovn-sb.5.pdf differ diff --git a/src/static/support/dist-docs/ovn-sb.5.txt b/src/static/support/dist-docs/ovn-sb.5.txt index b184dbde..dab4abc3 100644 --- a/src/static/support/dist-docs/ovn-sb.5.txt +++ b/src/static/support/dist-docs/ovn-sb.5.txt @@ -3707,7 +3707,7 @@ Service_Monitor TABLE Each row in this table configures monitoring a service for its live‐ ness. The service can be an IPv4 TCP or UDP service. ovn-controller pe‐ riodically sends out service monitor packets and updates the status of - the service. Service monitoring for IPv6 services is not supported. + the service. ovn-northd uses this feature to implement the load balancer health check feature offered to the CMS through the northbound database. @@ -3755,7 +3755,8 @@ Service_Monitor TABLE Source Ethernet address to use in the service monitor packet. src_ip: string - Source IPv4 address to use in the service monitor packet. + Source IPv4 or IPv6 address to use in the service monitor + packet. chassis_name: string The name of the chassis where the logical port is bound. @@ -3764,27 +3765,27 @@ Service_Monitor TABLE The interval, in seconds, between service monitor checks. options : timeout: optional string, containing an integer - The time, in seconds, after which the service monitor check + The time, in seconds, after which the service monitor check times out. options : success_count: optional string, containing an integer - The number of successful checks after which the service is con‐ + The number of successful checks after which the service is con‐ sidered online. options : failure_count: optional string, containing an integer - The number of failure checks after which the service is consid‐ + The number of failure checks after which the service is consid‐ ered offline. Status Reporting: - The ovn-controller on the chassis that hosts the logical_port updates + The ovn-controller on the chassis that hosts the logical_port updates this column to report the service’s status. status: optional string, one of error, offline, or online - For TCP service, ovn-controller sends a SYN to the service and + For TCP service, ovn-controller sends a SYN to the service and expects an ACK response to consider the service to be online. - For UDP service, ovn-controller sends a UDP packet to the ser‐ + For UDP service, ovn-controller sends a UDP packet to the ser‐ vice and doesn’t expect any reply. If it receives an ICMP reply, then it considers the service to be offline. @@ -3813,50 +3814,50 @@ Load_Balancer TABLE Details: name: string - A name for the load balancer. This name has no special meaning - or purpose other than to provide convenience for human interac‐ + A name for the load balancer. This name has no special meaning + or purpose other than to provide convenience for human interac‐ tion with the ovn-nb database. vips: map of string-string pairs - A map of virtual IP addresses (and an optional port number with - : as a separator) associated with this load balancer and their - corresponding endpoint IP addresses (and optional port numbers + A map of virtual IP addresses (and an optional port number with + : as a separator) associated with this load balancer and their + corresponding endpoint IP addresses (and optional port numbers with : as separators) separated by commas. protocol: optional string, one of sctp, tcp, or udp - Valid protocols are tcp, udp, or sctp. This column is useful - when a port number is provided as part of the vips column. If - this column is empty and a port number is provided as part of + Valid protocols are tcp, udp, or sctp. This column is useful + when a port number is provided as part of the vips column. If + this column is empty and a port number is provided as part of vips column, OVN assumes the protocol to be tcp. datapaths: set of Datapath_Bindings Datapaths to which this load balancer applies to. datapath_group: optional Logical_DP_Group - Deprecated. The group of datapaths to which this load balancer - applies to. This means that the same load balancer applies to + Deprecated. The group of datapaths to which this load balancer + applies to. This means that the same load balancer applies to all datapaths in a group. ls_datapath_group: optional Logical_DP_Group - The group of datapaths to which this load balancer applies to. - This means that the same load balancer applies to all datapaths + The group of datapaths to which this load balancer applies to. + This means that the same load balancer applies to all datapaths in a group. lr_datapath_group: optional Logical_DP_Group - The group of logical router datapaths to which this load bal‐ + The group of logical router datapaths to which this load bal‐ ancer applies to. This means that the same load balancer applies to all datapaths in a group. Load_Balancer options: options : hairpin_snat_ip: optional string - IP to be used as source IP for packets that have been hair- - pinned after load balancing. This value is automatically popu‐ + IP to be used as source IP for packets that have been hair- + pinned after load balancing. This value is automatically popu‐ lated by ovn-northd. options : hairpin_orig_tuple: optional string, either true or false This value is automatically set to true by ovn-northd when orig‐ - inal destination IP and transport port of the load balanced + inal destination IP and transport port of the load balanced packets are stored in registers reg1, reg2, xxreg1. Common Columns: @@ -3887,12 +3888,12 @@ BFD TABLE Configuration: src_port: integer, in range 49,152 to 65,535 - udp source port used in bfd control packets. The source port + udp source port used in bfd control packets. The source port MUST be in the range 49152 through 65535 (RFC5881 section 4). disc: integer A unique, nonzero discriminator value generated by the transmit‐ - ting system, used to demultiplex multiple BFD sessions between + ting system, used to demultiplex multiple BFD sessions between the same pair of systems. logical_port: string @@ -3902,20 +3903,20 @@ BFD TABLE BFD peer IP address. min_tx: integer - This is the minimum interval, in milliseconds, that the local - system would like to use when transmitting BFD Control packets, + This is the minimum interval, in milliseconds, that the local + system would like to use when transmitting BFD Control packets, less any jitter applied. The value zero is reserved. min_rx: integer - This is the minimum interval, in milliseconds, between received - BFD Control packets that this system is capable of supporting, - less any jitter applied by the sender. If this value is zero, - the transmitting system does not want the remote system to send + This is the minimum interval, in milliseconds, between received + BFD Control packets that this system is capable of supporting, + less any jitter applied by the sender. If this value is zero, + the transmitting system does not want the remote system to send any periodic BFD Control packets. detect_mult: integer - Detection time multiplier. The negotiated transmit interval, - multiplied by this value, provides the Detection Time for the + Detection time multiplier. The negotiated transmit interval, + multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode. chassis_name: string @@ -3940,12 +3941,12 @@ BFD TABLE • up FDB TABLE - This table is primarily used to learn the MACs observed on a VIF (or a - localnet port with ’localnet_learn_fdb’ enabled) which belongs to a - Logical_Switch_Port record in OVN_Northbound whose port security is - disabled and ’unknown’ address set. If port security is disabled on a - Logical_Switch_Port record, OVN should allow traffic with any source - mac from the VIF. This table will be used to deliver a packet to the + This table is primarily used to learn the MACs observed on a VIF (or a + localnet port with ’localnet_learn_fdb’ enabled) which belongs to a + Logical_Switch_Port record in OVN_Northbound whose port security is + disabled and ’unknown’ address set. If port security is disabled on a + Logical_Switch_Port record, OVN should allow traffic with any source + mac from the VIF. This table will be used to deliver a packet to the VIF, If a packet’s eth.dst is learnt. Summary: @@ -3995,7 +3996,7 @@ Static_MAC_Binding TABLE The logical datapath to which the logical router port belongs. Chassis_Template_Var TABLE - Each record represents the set of template variable instantiations for + Each record represents the set of template variable instantiations for a given chassis and is populated by ovn-northd from the contents of the OVN_Northbound.Chassis_Template_Var table. diff --git a/src/static/support/dist-docs/ovn-sbctl.8.pdf b/src/static/support/dist-docs/ovn-sbctl.8.pdf index 6106b95f..95d72002 100644 Binary files a/src/static/support/dist-docs/ovn-sbctl.8.pdf and b/src/static/support/dist-docs/ovn-sbctl.8.pdf differ diff --git a/src/static/support/dist-docs/ovn-trace.8.pdf b/src/static/support/dist-docs/ovn-trace.8.pdf index 11ae9c29..f51aaf1e 100644 Binary files a/src/static/support/dist-docs/ovn-trace.8.pdf and b/src/static/support/dist-docs/ovn-trace.8.pdf differ