Principal charm that deploys ovn-northd, the OVN central control daemon,
and ovsdb-server, the Open vSwitch Database (OVSDB).
The ovn-northd daemon is responsible for translating the high-level OVN
configuration into logical configuration consumable by daemons such as
The ovn-northd process talks to OVN Northbound- and Southbound- databases.
The ovsdb-server exposes endpoints over relations implemented by the ovsdb
The charm supports clustering of the OVSDB, you must have a odd number of
units for this to work. Note that write performance decreases as you
increase the number of units.
Running multiple ovn-northd daemons is supported and they will operate in
active/passive mode. The daemon uses a locking feature in the OVSDB to
automatically choose a single active instance.
This charm provides the Northbound and Southbound OVSDB Databases and the
Open Virtual Network (OVN) central control daemon (
OVN makes use of Public Key Infrastructure (PKI) to authenticate and authorize
control plane communication. The charm requires a Certificate Authority to be
present in the model as represented by the
Network Spaces support
This charm supports the use of Juju Network Spaces.
By binding the
ovsdb-peer endpoints you can
influence which interface will be used for communication with consumers of
the Southbound DB, Cloud Management Systems (CMS) and cluster internal
juju deploy ovn-central --bind "''=oam-space ovsdb=data-space"
OVN RBAC and securing the OVN services
The charm enables RBAC
in the OVN Southbound database by default. The RBAC feature enforces
authorization of individual chassis connecting to the database, and also
restricts database operations.
In the event of a individual chassis being compromised, RBAC will make it more
difficult to leverage database access for compromising other parts of the network.
The charm automatically enables the firewall and will allow traffic from its
cluster peers to port 6641, 6643, 6644 and 16642. CMS clients will be allowed
to talk to port 6641.
Anyone will be allowed to connect to port 6642.
Please report bugs on Launchpad.
For general questions please refer to the OpenStack Charm Guide.
- (int) Maximum number of seconds of idle time on connection to client before sending an inactivity probe message. The Open vSwitch ovsdb-server default of 5 seconds may not be sufficient depending on type and load of the CMS you want to connect to OVN.
- (string) Repository from which to install OVS+OVN May be one of the following: distro (default) ppa:somecustom/ppa (PPA name must include UCA OpenStack Release name) deb url sources entry|key id or a supported Ubuntu Cloud Archive pocket. Supported Ubuntu Cloud Archive pockets include: cloud:xenial-pike cloud:xenial-queens cloud:bionic-rocky Note that updating this setting to a source that is known to provide a later version of Ceph will trigger a software upgrade.