--- name: "ovn-ic-nb" section: "5" platform: "linux" package: "ovn-common" version: "25.03.0-1" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/ovn-ic-nb" --- # ovn-ic-nb(5) OVN\_IC\_Northbound database schema This database is the interface for cloud management system (CMS), such as OpenStack, to configure OVN interconnection settings. The CMS produces almost all of the contents of the database. The ovn-ic program monitors the database contents, transforms it, and stores it into the OVN\_IC\_Southbound database. We generally speak of \`\`the’’ CMS, but one can imagine scenarios in which multiple CMSes manage different parts of OVN interconnection. ## NAME ovn-ic-nb - OVN\_IC\_Northbound database schema This database is the interface for cloud management system (CMS), such as OpenStack, to configure OVN interconnection settings. The CMS produces almost all of the contents of the database. The **ovn-ic** program monitors the database contents, transforms it, and stores it into the **OVN\_IC\_Southbound** database. We generally speak of \`\`the’’ CMS, but one can imagine scenarios in which multiple CMSes manage different parts of OVN interconnection. ### External IDs Each of the tables in this database contains a special column, named **external\_ids**. This column has the same form and purpose each place it appears. - **external\_ids**: map of string-string pairs Key-value pairs for use by the CMS. The CMS might use certain pairs, for example, to identify entities in its own configuration that correspond to those in this database. ## TABLE SUMMARY The following list summarizes the purpose of each of the tables in the **OVN\_IC\_Northbound** database. Each table is described in more detail on a later page. - Table Purpose\ - **IC\_NB\_Global** IC Northbound configuration\ - **Transit\_Switch** Transit logical switch\ - **SSL** SSL configuration.\ - **Connection** OVSDB client connections. ## IC\_NB\_Global TABLE Northbound configuration for OVN interconnection. This table must have exactly one row. ### Summary: - *Status:* - **nb\_ic\_cfg** integer\ - **sb\_ic\_cfg** integer - *Common Columns:* - **external\_ids** map of string-string pairs - *Common options:* - **options** map of string-string pairs\ - **options : ic\_probe\_interval** optional string\ - **options : vxlan\_mode** optional string - *Connection Options:* - **connections** set of **Connection**s\ - **ssl** optional **SSL** ### Details: *Status:* These columns allow a client to track the overall configuration state of the system. - **nb\_ic\_cfg**: integer Sequence number for client to increment. When a client modifies the interconnect northbound database configuration and wishes to wait for **OVN-ICs** to handle this change and update the Interconnect southbound database, it may increment this sequence number. - **sb\_ic\_cfg**: integer Sequence number that one **OVN-IC** sets to the value of **nb\_ic\_cfg** after waiting to all the **OVN-ICs** finish applying their changes to interconnect southbound database. *Common Columns:* - **external\_ids**: map of string-string pairs See **External IDs** at the beginning of this document. *Common options:* - **options**: map of string-string pairs This column provides general key/value settings. The supported options are described individually below. - **options : ic\_probe\_interval**: optional string The inactivity probe interval of the connection to the OVN IC Northbound and Southbound databases from **ovn-ic**, in milliseconds. If the value is zero, it disables the connection keepalive feature. - If the value is nonzero, then it will be forced to a value of at least 1000 ms. - **options : vxlan\_mode**: optional string This field allows the client to enable VXLAN as encapsulation protocol for for cross-AZ traffic. Default value is false. *Connection Options:* - **connections**: set of **Connection**s Database clients to which the Open vSwitch database server should connect or on which it should listen, along with options for how these connections should be configured. See the **Connection** table for more information. - **ssl**: optional **SSL** Global SSL/TLS configuration. ## Transit\_Switch TABLE Each row represents one transit logical switch for interconnection between different OVN deployments (availability zones). ### Summary: - *Naming:* - **name** string (must be unique within table) - *Common Columns:* - **other\_config** map of string-string pairs\ - **external\_ids** map of string-string pairs ### Details: *Naming:* - **name**: string (must be unique within table) A name that uniquely identifies the transit logical switch. *Common Columns:* - **other\_config**: map of string-string pairs - **external\_ids**: map of string-string pairs See **External IDs** at the beginning of this document. ## SSL TABLE SSL/TLS configuration for ovn-nb database access. ### Summary: - **private\_key** string\ - **certificate** string\ - **ca\_cert** string\ - **bootstrap\_ca\_cert** boolean\ - **ssl\_protocols** string\ - **ssl\_ciphers** string\ - **ssl\_ciphersuites** string\ - *Common Columns:* - **external\_ids** map of string-string pairs ### Details: - **private\_key**: string Name of a PEM file containing the private key used as the switch’s identity for SSL/TLS connections to the controller. - **certificate**: string Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch’s private key, identifying a trustworthy switch. - **ca\_cert**: string Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller. - **bootstrap\_ca\_cert**: boolean If set to **true**, then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL/TLS connection and save it to the named PEM file. If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL/TLS connections must be authenticated by a certificate signed by the CA certificate thus obtained. **This option exposes the** **SSL/TLS connection to a man-in-the-middle attack obtaining the initial** **CA certificate.** It may still be useful for bootstrapping. - **ssl\_protocols**: string Range or a comma- or space-delimited list of the SSL/TLS protocols to enable for SSL/TLS connections. - Supported protocols include **TLSv1** (deprecated), **TLSv1.1** (deprecated), **TLSv1.2** and **TLSv1.3**. Ranges can be provided in a form of two protocol names separated with a dash (**TLSv1.1-TLSv1.2**), or as a single protocol name with a plus sign (**TLSv1.2+**). The value can be a list of protocols or exactly one range. The range is a preferred way of specifying protocols and the configuration always behaves as if the range between the minimum and the maximum specified version is provided, i.e., if the value is set to **TLSv1.1,TLSv1.3**, the **TLSv1.2** will also be enabled as if it was a range. Regardless of order, the highest protocol supported by both sides will be chosen when making the connection. - The default when this option is omitted is **TLSv1.2+**. - **ssl\_ciphers**: string List of ciphers (in OpenSSL cipher string format) to be supported for SSL/TLS connections with TLSv1.2 and earlier. The default when this option is omitted is **DEFAULT:@SECLEVEL=2**. - **ssl\_ciphersuites**: string List of ciphersuites (in OpenSSL ciphersuites string format) to be supported for SSL/TLS connections with TLSv1.3 and later. Default value from OpenSSL will be used when this option is omitted. *Common Columns:* The overall purpose of these columns is described under **Common** **Columns** at the beginning of this document. - **external\_ids**: map of string-string pairs ## Connection TABLE Configuration for a database connection to an Open vSwitch database (OVSDB) client. This table primarily configures the Open vSwitch database server (**ovsdb-server**). The Open vSwitch database server can initiate and maintain active connections to remote clients. It can also listen for database connections. ### Summary: - *Core Features:* - **target** string (must be unique within table) - *Client Failure Detection and Handling:* - **max\_backoff** optional integer, at least 1,000\ - **inactivity\_probe** optional integer - *Status:* - **is\_connected** boolean\ - **status : last\_error** optional string\ - **status : state** optional string, one of **ACTIVE**, **BACKOFF**, **CONNECTING**, **IDLE**, or **VOID**\ - **status : sec\_since\_connect** optional string, containing an integer, at least 0\ - **status : sec\_since\_disconnect** optional string, containing an integer, at least 0\ - **status : locks\_held** optional string\ - **status : locks\_waiting** optional string\ - **status : locks\_lost** optional string\ - **status : n\_connections** optional string, containing an integer, at least 2\ - **status : bound\_port** optional string, containing an integer - *Common Columns:* - **external\_ids** map of string-string pairs\ - **other\_config** map of string-string pairs ### Details: *Core Features:* - **target**: string (must be unique within table) Connection methods for clients. - The following connection methods are currently supported: - **ssl:***host*\[**:***port*\] The specified SSL/TLS *port* on the host at the given *host*, which can either be a DNS name (if built with unbound library) or an IP address. A valid SSL/TLS configuration must be provided when this form is used, this configuration can be specified via command-line options or the **SSL** table. - If *port* is not specified, it defaults to 6640. - SSL/TLS support is an optional feature that is not always built as part of OVN or Open vSwitch. - **tcp:***host*\[**:***port*\] The specified TCP *port* on the host at the given *host*, which can either be a DNS name (if built with unbound library) or an IP address. If *host* is an IPv6 address, wrap it in square brackets, e.g. **tcp:\[::1\]:6640**. - If *port* is not specified, it defaults to 6640. - **pssl:**\[*port*\]\[**:***host*\] Listens for SSL/TLS connections on the specified TCP *port*. Specify 0 for *port* to have the kernel automatically choose an available port. If *host*, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IPaddress (either IPv4 or IPv6 address). If *host* is an IPv6 address, wrap in square brackets, e.g. **pssl:6640:\[::1\]**. If *host* is not specified then it listens only on IPv4 (but not IPv6) addresses. A valid SSL/TLS configuration must be provided when this form is used, this can be specified either via command-line options or the **SSL** table. - If *port* is not specified, it defaults to 6640. - SSL/TLS support is an optional feature that is not always built as part of OVN or Open vSwitch. - **ptcp:**\[*port*\]\[**:***host*\] Listens for connections on the specified TCP *port*. Specify 0 for *port* to have the kernel automatically choose an available port. If *host*, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address). If *host* is an IPv6 address, wrap it in square brackets, e.g. **ptcp:6640:\[::1\]**. If *host* is not specified then it listens only on IPv4 addresses. - If *port* is not specified, it defaults to 6640. - When multiple clients are configured, the **target** values must be unique. Duplicate **target** values yield unspecified results. *Client Failure Detection and Handling:* - **max\_backoff**: optional integer, at least 1,000 Maximum number of milliseconds to wait between connection attempts. Default is implementation-specific. - **inactivity\_probe**: optional integer Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message. If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe. If a response is not received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect. Default is implementation-specific. A value of 0 disables inactivity probes. *Status:* Key-value pair of **is\_connected** is always updated. Other key-value pairs in the status columns may be updated depends on the **target** type. When **target** specifies a connection method that listens for inbound connections (e.g. **ptcp:** or **punix:**), both **n\_connections** and **is\_connected** may also be updated while the remaining key-value pairs are omitted. On the other hand, when **target** specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets. They are omitted. - **is\_connected**: boolean **true** if currently connected to this client, **false** otherwise. - **status : last\_error**: optional string A human-readable description of the last error on the connection to the manager; i.e. **strerror(errno)**. This key will exist only if an error has occurred. - **status : state**: optional string, one of **ACTIVE**, **BACKOFF**, **CONNECTING**, **IDLE**, or **VOID** The state of the connection to the manager: - **VOID** Connection is disabled. - **BACKOFF** Attempting to reconnect at an increasing period. - **CONNECTING** Attempting to connect. - **ACTIVE** Connected, remote host responsive. - **IDLE** Connection is idle. Waiting for response to keep-alive. - These values may change in the future. They are provided only for human consumption. - **status : sec\_since\_connect**: optional string, containing an integer, at least 0 The amount of time since this client last successfully connected to the database (in seconds). Value is empty if client has never successfully been connected. - **status : sec\_since\_disconnect**: optional string, containing an integer, at least 0 The amount of time since this client last disconnected from the database (in seconds). Value is empty if client has never disconnected. - **status : locks\_held**: optional string Space-separated list of the names of OVSDB locks that the connection holds. Omitted if the connection does not hold any locks. - **status : locks\_waiting**: optional string Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire. Omitted if the connection is not waiting for any locks. - **status : locks\_lost**: optional string Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client. Omitted if no locks have been stolen from this connection. - **status : n\_connections**: optional string, containing an integer, at least 2 When **target** specifies a connection method that listens for inbound connections (e.g. **ptcp:** or **pssl:**) and more than one connection is actually active, the value is the number of active connections. Otherwise, this key-value pair is omitted. - **status : bound\_port**: optional string, containing an integer When **target** is **ptcp:** or **pssl:**, this is the TCP port on which the OVSDB server is listening. (This is particularly useful when **target** specifies a port of 0, allowing the kernel to choose any available port.) *Common Columns:* The overall purpose of these columns is described under **Common** **Columns** at the beginning of this document. - **external\_ids**: map of string-string pairs - **other\_config**: map of string-string pairs