ovn-ic-nb.xml

<?xml version="1.0" encoding="utf-8"?>
<database name="ovn-ic-nb" title="OVN Interconnection Northbound Database">
  <p>
    This database is the interface for cloud management system (CMS), such as
    OpenStack, to configure OVN interconnection settings.  The CMS produces
    almost all of the contents of the database.  The <code>ovn-ic</code>
    program monitors the database contents, transforms it, and stores it into
    the <ref db="OVN_IC_Southbound"/> database.
  </p>

  <p>
    We generally speak of ``the'' CMS, but one can imagine scenarios in
    which multiple CMSes manage different parts of OVN interconnection.
  </p>

  <h2>External IDs</h2>

  <p>
    Each of the tables in this database contains a special column, named
    <code>external_ids</code>.  This column has the same form and purpose each
    place it appears.
  </p>

  <dl>
    <dt><code>external_ids</code>: map of string-string pairs</dt>
    <dd>
      Key-value pairs for use by the CMS.  The CMS might use certain pairs, for
      example, to identify entities in its own configuration that correspond to
      those in this database.
    </dd>
  </dl>

  <table name="IC_NB_Global" title="IC Northbound configuration">
    <p>
      Northbound configuration for OVN interconnection.  This table must have exactly
      one row.
    </p>

    <group title="Status">
      These columns allow a client to track the overall configuration state of
      the system.

      <column name="nb_ic_cfg">
        Sequence number for client to increment. When a client modifies the
        interconnect northbound database configuration and wishes to wait for
        <code>OVN-ICs</code> to handle this change and update the Interconnect
        southbound database, it may increment this sequence number.
      </column>
      <column name="sb_ic_cfg">
        Sequence number that one <code>OVN-IC</code> sets to the value of
        <ref column="nb_ic_cfg"/> after waiting to all the <code>OVN-ICs</code>
        finish applying their changes to interconnect southbound database.
      </column>
    </group>

    <group title="Common Columns">
      <column name="external_ids">
        See <em>External IDs</em> at the beginning of this document.
      </column>
    </group>

    <group title="Common options">
      <column name="options">
        This column provides general key/value settings. The supported
        options are described individually below.
      </column>

      <column name="options" key="ic_probe_interval">
        <p>
          The inactivity probe interval of the connection to the OVN IC
          Northbound and Southbound databases from <code>ovn-ic</code>, in
          milliseconds.  If the value is zero, it disables the connection
          keepalive feature.
        </p>

        <p>
          If the value is nonzero, then it will be forced to a value of
          at least 1000 ms.
        </p>
      </column>
    </group>

    <group title="Connection Options">
      <column name="connections">
        Database clients to which the Open vSwitch database server should
        connect or on which it should listen, along with options for how these
        connections should be configured.  See the <ref table="Connection"/>
        table for more information.
      </column>
      <column name="ssl">
        Global SSL/TLS configuration.
      </column>
    </group>
  </table>

  <table name="Transit_Switch" title="Transit logical switch">
    <p>
      Each row represents one transit logical switch for interconnection between
      different OVN deployments (availability zones).
    </p>

    <group title="Naming">
      <column name="name">
        A name that uniquely identifies the transit logical switch.
      </column>
    </group>

    <group title="Common Columns">
      <column name="other_config"/>
      <column name="external_ids">
        See <em>External IDs</em> at the beginning of this document.
      </column>
    </group>
  </table>

  <table name="SSL">
    SSL/TLS configuration for ovn-nb database access.

    <column name="private_key">
      Name of a PEM file containing the private key used as the switch's
      identity for SSL/TLS connections to the controller.
    </column>

    <column name="certificate">
      Name of a PEM file containing a certificate, signed by the
      certificate authority (CA) used by the controller and manager,
      that certifies the switch's private key, identifying a trustworthy
      switch.
    </column>

    <column name="ca_cert">
      Name of a PEM file containing the CA certificate used to verify
      that the switch is connected to a trustworthy controller.
    </column>

    <column name="bootstrap_ca_cert">
      If set to <code>true</code>, then Open vSwitch will attempt to
      obtain the CA certificate from the controller on its first SSL/TLS
      connection and save it to the named PEM file. If it is successful,
      it will immediately drop the connection and reconnect, and from then
      on all SSL/TLS connections must be authenticated by a certificate signed
      by the CA certificate thus obtained.  <em>This option exposes the
      SSL/TLS connection to a man-in-the-middle attack obtaining the initial
      CA certificate.</em>  It may still be useful for bootstrapping.
    </column>

    <column name="ssl_protocols">
      <p>
        Range or a comma- or space-delimited list of the SSL/TLS protocols to
        enable for SSL/TLS connections.
      </p>
      <p>
        Supported protocols include <code>TLSv1</code> (deprecated),
        <code>TLSv1.1</code> (deprecated), <code>TLSv1.2</code> and
        <code>TLSv1.3</code>.  Ranges can be provided in a form of two protocol
        names separated with a dash (<code>TLSv1.1-TLSv1.2</code>), or as a
        single protocol name with a plus sign (<code>TLSv1.2+</code>).  The
        value can be a list of protocols or exactly one range.  The range is a
        preferred way of specifying protocols and the configuration always
        behaves as if the range between the minimum and the maximum specified
        version is provided, i.e., if the value is set to
        <code>TLSv1.1,TLSv1.3</code>, the <code>TLSv1.2</code> will also be
        enabled as if it was a range.
        Regardless of order, the highest protocol supported by both sides will
        be chosen when making the connection.
      </p>
      <p>
        The default when this option is omitted is <code>TLSv1.2+</code>.
      </p>
    </column>

    <column name="ssl_ciphers">
      List of ciphers (in OpenSSL cipher string format) to be supported
      for SSL/TLS connections with TLSv1.2 and earlier.  The default when this
      option is omitted is <code>DEFAULT:@SECLEVEL=2</code>.
    </column>

    <column name="ssl_ciphersuites">
      List of ciphersuites (in OpenSSL ciphersuites string format) to be
      supported for SSL/TLS connections with TLSv1.3 and later.  Default value
      from OpenSSL will be used when this option is omitted.
    </column>

    <group title="Common Columns">
      The overall purpose of these columns is described under <code>Common
      Columns</code> at the beginning of this document.

      <column name="external_ids"/>
    </group>
  </table>

  <table name="Connection" title="OVSDB client connections.">
    <p>
      Configuration for a database connection to an Open vSwitch database
      (OVSDB) client.
    </p>

    <p>
      This table primarily configures the Open vSwitch database server
      (<code>ovsdb-server</code>).
    </p>

    <p>
      The Open vSwitch database server can initiate and maintain active
      connections to remote clients.  It can also listen for database
      connections.
    </p>

    <group title="Core Features">
      <column name="target">
        <p>Connection methods for clients.</p>
        <p>
          The following connection methods are currently supported:
        </p>
        <dl>
          <dt><code>ssl:<var>host</var></code>[<code>:<var>port</var></code>]</dt>
          <dd>
            <p>
              The specified SSL/TLS <var>port</var> on the host at the given
              <var>host</var>, which can either be a DNS name (if built with
              unbound library) or an IP address. A valid SSL/TLS configuration
              must be provided when this form is used, this configuration can
              be specified via command-line options or the <ref table="SSL"/>
              table.
            </p>
            <p>
              If <var>port</var> is not specified, it defaults to 6640.
            </p>
            <p>
              SSL/TLS support is an optional feature that is not always
              built as part of OVN or Open vSwitch.
            </p>
          </dd>

          <dt><code>tcp:<var>host</var></code>[<code>:<var>port</var></code>]</dt>
          <dd>
            <p>
              The specified TCP <var>port</var> on the host at the given
              <var>host</var>, which can either be a DNS name (if built with
              unbound library) or an IP address.  If <var>host</var> is an IPv6
              address, wrap it in square brackets, e.g. <code>tcp:[::1]:6640</code>.
            </p>
            <p>
              If <var>port</var> is not specified, it defaults to 6640.
            </p>
          </dd>
          <dt><code>pssl:</code>[<var>port</var>][<code>:<var>host</var></code>]</dt>
          <dd>
            <p>
              Listens for SSL/TLS connections on the specified TCP
              <var>port</var>.
              Specify 0 for <var>port</var> to have the kernel automatically
              choose an available port.  If <var>host</var>, which can either
              be a DNS name (if built with unbound library) or an IP address,
              is specified, then connections are restricted to the resolved or
              specified local IPaddress (either IPv4 or IPv6 address).  If
              <var>host</var> is an IPv6 address, wrap in square brackets,
              e.g. <code>pssl:6640:[::1]</code>.  If <var>host</var> is not
              specified then it listens only on IPv4 (but not IPv6) addresses.
              A valid SSL/TLS configuration must be provided when this form is
              used, this can be specified either via command-line options or
              the <ref table="SSL"/> table.
            </p>
            <p>
              If <var>port</var> is not specified, it defaults to 6640.
            </p>
            <p>
              SSL/TLS support is an optional feature that is not always built
              as part of OVN or Open vSwitch.
            </p>
          </dd>
          <dt><code>ptcp:</code>[<var>port</var>][<code>:<var>host</var></code>]</dt>
          <dd>
            <p>
              Listens for connections on the specified TCP <var>port</var>.
              Specify 0 for <var>port</var> to have the kernel automatically
              choose an available port.  If <var>host</var>, which can either
              be a DNS name (if built with unbound library) or an IP address,
              is specified, then connections are restricted to the resolved or
              specified local IP address (either IPv4 or IPv6 address).  If
              <var>host</var> is an IPv6 address, wrap it in square brackets,
              e.g. <code>ptcp:6640:[::1]</code>.  If <var>host</var> is not
              specified then it listens only on IPv4 addresses.
            </p>
            <p>
              If <var>port</var> is not specified, it defaults to 6640.
            </p>
          </dd>
        </dl>
        <p>When multiple clients are configured, the <ref column="target"/>
        values must be unique.  Duplicate <ref column="target"/> values yield
        unspecified results.</p>
      </column>
    </group>

    <group title="Client Failure Detection and Handling">
      <column name="max_backoff">
        Maximum number of milliseconds to wait between connection attempts.
        Default is implementation-specific.
      </column>

      <column name="inactivity_probe">
        Maximum number of milliseconds of idle time on connection to the client
        before sending an inactivity probe message.  If Open vSwitch does not
        communicate with the client for the specified number of seconds, it
        will send a probe.  If a response is not received for the same
        additional amount of time, Open vSwitch assumes the connection has been
        broken and attempts to reconnect.  Default is implementation-specific.
        A value of 0 disables inactivity probes.
      </column>
    </group>

    <group title="Status">
      <p>
        Key-value pair of <ref column="is_connected"/> is always updated.
        Other key-value pairs in the status columns may be updated depends
        on the <ref column="target"/> type.
      </p>

      <p>
        When <ref column="target"/> specifies a connection method that
        listens for inbound connections (e.g. <code>ptcp:</code> or
        <code>punix:</code>), both <ref column="n_connections"/> and
        <ref column="is_connected"/> may also be updated while the
        remaining key-value pairs are omitted.
      </p>

      <p>
        On the other hand, when <ref column="target"/> specifies an
        outbound connection, all key-value pairs may be updated, except
        the above-mentioned two key-value pairs associated with inbound
        connection targets. They are omitted.
      </p>

    <column name="is_connected">
        <code>true</code> if currently connected to this client,
        <code>false</code> otherwise.
      </column>

      <column name="status" key="last_error">
        A human-readable description of the last error on the connection
        to the manager; i.e. <code>strerror(errno)</code>.  This key
        will exist only if an error has occurred.
      </column>

      <column name="status" key="state"
              type='{"type": "string", "enum": ["set", ["VOID", "BACKOFF", "CONNECTING", "ACTIVE", "IDLE"]]}'>
        <p>
          The state of the connection to the manager:
        </p>
        <dl>
          <dt><code>VOID</code></dt>
          <dd>Connection is disabled.</dd>

          <dt><code>BACKOFF</code></dt>
          <dd>Attempting to reconnect at an increasing period.</dd>

          <dt><code>CONNECTING</code></dt>
          <dd>Attempting to connect.</dd>

          <dt><code>ACTIVE</code></dt>
          <dd>Connected, remote host responsive.</dd>

          <dt><code>IDLE</code></dt>
          <dd>Connection is idle.  Waiting for response to keep-alive.</dd>
        </dl>
        <p>
          These values may change in the future.  They are provided only for
          human consumption.
        </p>
      </column>

      <column name="status" key="sec_since_connect"
              type='{"type": "integer", "minInteger": 0}'>
        The amount of time since this client last successfully connected
        to the database (in seconds). Value is empty if client has never
        successfully been connected.
      </column>

      <column name="status" key="sec_since_disconnect"
              type='{"type": "integer", "minInteger": 0}'>
        The amount of time since this client last disconnected from the
        database (in seconds). Value is empty if client has never
        disconnected.
      </column>

      <column name="status" key="locks_held">
        Space-separated list of the names of OVSDB locks that the connection
        holds.  Omitted if the connection does not hold any locks.
      </column>

      <column name="status" key="locks_waiting">
        Space-separated list of the names of OVSDB locks that the connection is
        currently waiting to acquire.  Omitted if the connection is not waiting
        for any locks.
      </column>

      <column name="status" key="locks_lost">
        Space-separated list of the names of OVSDB locks that the connection
        has had stolen by another OVSDB client.  Omitted if no locks have been
        stolen from this connection.
      </column>

      <column name="status" key="n_connections"
              type='{"type": "integer", "minInteger": 2}'>
        When <ref column="target"/> specifies a connection method that
        listens for inbound connections (e.g. <code>ptcp:</code> or
        <code>pssl:</code>) and more than one connection is actually active,
        the value is the number of active connections.  Otherwise, this
        key-value pair is omitted.
      </column>

      <column name="status" key="bound_port" type='{"type": "integer"}'>
        When <ref column="target"/> is <code>ptcp:</code> or
        <code>pssl:</code>, this is the TCP port on which the OVSDB server is
        listening.  (This is particularly useful when <ref
        column="target"/> specifies a port of 0, allowing the kernel to
        choose any available port.)
      </column>
    </group>

    <group title="Common Columns">
      The overall purpose of these columns is described under <code>Common
      Columns</code> at the beginning of this document.

      <column name="external_ids"/>
      <column name="other_config"/>
    </group>
  </table>
</database>