# ovn-ic-nb

## NAME



           ovn-ic-nb - OVN_IC_Northbound database schema
    
           This database is the interface for cloud management system (CMS),
           such as OpenStack, to configure OVN interconnection settings. The
           CMS produces almost all of the contents of the database. The
           **ovn-ic** program monitors the database contents, transforms it, and
           stores it into the **OVN_IC_Southbound** database.
    
           We generally speak of ``the’’ CMS, but one can imagine scenarios
           in which multiple CMSes manage different parts of OVN
           interconnection.
    
       **External IDs**
           Each of the tables in this database contains a special column,
           named **external_ids**. This column has the same form and purpose each
           place it appears.
    
                  **external_ids** : map of string-string pairs
                         Key-value pairs for use by the CMS. The CMS might
                         use certain pairs, for example, to identify entities
                         in its own configuration that correspond to those in
                         this database.
    


## TABLE SUMMARY



           The following list summarizes the purpose of each of the tables in
           the **OVN_IC_Northbound** database.  Each table is described in more
           detail on a later page.
    
           Table     Purpose
           **IC_NB_Global**
                     IC Northbound configuration
           **Transit_Switch**
                     Transit logical switch
           **SSL** SSL configuration.
           **Connection**
                     OVSDB client connections.
    


## IC_NB_Global TABLE



           Northbound configuration for OVN interconnection. This table must
           have exactly one row.
    
       **Summary:**
           _Status:_
             **nb_ic_cfg** integer
             **sb_ic_cfg** integer
           _Common Columns:_
             **external_ids** map of string-string pairs
           _Common options:_
             **options** map of string-string pairs
             **options : ic_probe_interval**
                                         optional string
             **options : vxlan_mode** optional string
           _Connection Options:_
             **connections** set of **Connection** s
             **ssl** optional **SSL**
    
       **Details:**
         _Status:_
    
           These columns allow a client to track the overall configuration
           state of the system.
    
           **nb_ic_cfg** : integer
                  Sequence number for client to increment. When a client
                  modifies the interconnect northbound database configuration
                  and wishes to wait for **OVN-ICs** to handle this change and
                  update the Interconnect southbound database, it may
                  increment this sequence number.
    
           **sb_ic_cfg** : integer
                  Sequence number that one **OVN-IC** sets to the value of
                  **nb_ic_cfg** after waiting to all the **OVN-ICs** finish applying
                  their changes to interconnect southbound database.
    
         _Common Columns:_
    
           **external_ids** : map of string-string pairs
                  See **External IDs** at the beginning of this document.
    
         _Common options:_
    
           **options** : map of string-string pairs
                  This column provides general key/value settings. The
                  supported options are described individually below.
    
           **options : ic_probe_interval** : optional string
                  The inactivity probe interval of the connection to the OVN
                  IC Northbound and Southbound databases from **ovn-ic** , in
                  milliseconds. If the value is zero, it disables the
                  connection keepalive feature.
    
                  If the value is nonzero, then it will be forced to a value
                  of at least 1000 ms.
    
           **options : vxlan_mode** : optional string
                  This field allows the client to enable VXLAN as
                  encapsulation protocol for for cross-AZ traffic. Default
                  value is false.
    
         _Connection Options:_
    
           **connections** : set of **Connection** s
                  Database clients to which the Open vSwitch database server
                  should connect or on which it should listen, along with
                  options for how these connections should be configured. See
                  the **Connection** table for more information.
    
           **ssl** : optional **SSL**
                  Global SSL/TLS configuration.
    


## Transit_Switch TABLE



           Each row represents one transit logical switch for interconnection
           between different OVN deployments (availability zones).
    
       **Summary:**
           _Naming:_
             **name** string (must be unique within table)
           _Common Columns:_
             **other_config** map of string-string pairs
             **external_ids** map of string-string pairs
    
       **Details:**
         _Naming:_
    
           **name** : string (must be unique within table)
                  A name that uniquely identifies the transit logical switch.
    
         _Common Columns:_
    
           **other_config** : map of string-string pairs
    
           **external_ids** : map of string-string pairs
                  See **External IDs** at the beginning of this document.
    


## SSL TABLE



           SSL/TLS configuration for ovn-nb database access.
    
       **Summary:**
           **private_key** string
           **certificate** string
           **ca_cert** string
           **bootstrap_ca_cert** boolean
           **ssl_protocols** string
           **ssl_ciphers** string
           **ssl_ciphersuites** string
           _Common Columns:_
             **external_ids** map of string-string pairs
    
       **Details:**
           **private_key** : string
                  Name of a PEM file containing the private key used as the
                  switch’s identity for SSL/TLS connections to the
                  controller.
    
           **certificate** : string
                  Name of a PEM file containing a certificate, signed by the
                  certificate authority (CA) used by the controller and
                  manager, that certifies the switch’s private key,
                  identifying a trustworthy switch.
    
           **ca_cert** : string
                  Name of a PEM file containing the CA certificate used to
                  verify that the switch is connected to a trustworthy
                  controller.
    
           **bootstrap_ca_cert** : boolean
                  If set to **true** , then Open vSwitch will attempt to obtain
                  the CA certificate from the controller on its first SSL/TLS
                  connection and save it to the named PEM file. If it is
                  successful, it will immediately drop the connection and
                  reconnect, and from then on all SSL/TLS connections must be
                  authenticated by a certificate signed by the CA certificate
                  thus obtained. **This option exposes the SSL/TLS connection**
                  **to a man-in-the-middle attack obtaining the initial CA**
                  **certificate.** It may still be useful for bootstrapping.
    
           **ssl_protocols** : string
                  Range or a comma- or space-delimited list of the SSL/TLS
                  protocols to enable for SSL/TLS connections.
    
                  Supported protocols include **TLSv1.2** and **TLSv1.3**. Ranges can
                  be provided in a form of two protocol names separated with
                  a dash (**TLSv1.2-TLSv1.3**), or as a single protocol name with
                  a plus sign (**TLSv1.2+**). The value can be a list of
                  protocols or exactly one range. The range is a preferred
                  way of specifying protocols and the configuration always
                  behaves as if the range between the minimum and the maximum
                  specified version is provided, i.e., if the value is set to
                  **TLSv1.X,TLSv1.(X+2)** , the **TLSv1.(X+1)** will also be enabled
                  as if it was a range. Regardless of order, the highest
                  protocol supported by both sides will be chosen when making
                  the connection.
    
                  The default when this option is omitted is **TLSv1.2+**.
    
           **ssl_ciphers** : string
                  List of ciphers (in OpenSSL cipher string format) to be
                  supported for SSL/TLS connections with TLSv1.2. The default
                  when this option is omitted is **DEFAULT:@SECLEVEL=2**.
    
           **ssl_ciphersuites** : string
                  List of ciphersuites (in OpenSSL ciphersuites string
                  format) to be supported for SSL/TLS connections with
                  TLSv1.3 and later. Default value from OpenSSL will be used
                  when this option is omitted.
    
         _Common Columns:_
    
           The overall purpose of these columns is described under **Common**
           **Columns** at the beginning of this document.
    
           **external_ids** : map of string-string pairs
    


## Connection TABLE



           Configuration for a database connection to an Open vSwitch
           database (OVSDB) client.
    
           This table primarily configures the Open vSwitch database server
           (**ovsdb-server**).
    
           The Open vSwitch database server can initiate and maintain active
           connections to remote clients. It can also listen for database
           connections.
    
       **Summary:**
           _Core Features:_
             **target** string (must be unique within table)
           _Client Failure Detection and Handling:_
             **max_backoff** optional integer, at least 1,000
             **inactivity_probe** optional integer
           _Status:_
             **is_connected** boolean
             **status : last_error** optional string
             **status : state** optional string, one of **ACTIVE** ,
                                         **BACKOFF** , **CONNECTING** , **IDLE** , or **VOID**
             **status : sec_since_connect** optional string, containing an
                                         integer, at least 0
             **status : sec_since_disconnect**
                                         optional string, containing an
                                         integer, at least 0
             **status : locks_held** optional string
             **status : locks_waiting** optional string
             **status : locks_lost** optional string
             **status : n_connections** optional string, containing an
                                         integer, at least 2
             **status : bound_port** optional string, containing an
                                         integer
           _Common Columns:_
             **external_ids** map of string-string pairs
             **other_config** map of string-string pairs
    
       **Details:**
         _Core Features:_
    
           **target** : string (must be unique within table)
                  Connection methods for clients.
    
                  The following connection methods are currently supported:
    
                  **ssl:**_host_[**:**_port_]
                         The specified SSL/TLS _port_ on the host at the given
                         _host_ , which can either be a DNS name (if built with
                         unbound library) or an IP address. A valid SSL/TLS
                         configuration must be provided when this form is
                         used, this configuration can be specified via
                         command-line options or the **SSL** table.
    
                         If _port_ is not specified, it defaults to 6640.
    
                         SSL/TLS support is an optional feature that is not
                         always built as part of OVN or Open vSwitch.
    
                  **tcp:**_host_[**:**_port_]
                         The specified TCP _port_ on the host at the given
                         _host_ , which can either be a DNS name (if built with
                         unbound library) or an IP address. If _host_ is an
                         IPv6 address, wrap it in square brackets, e.g.
                         **tcp:[::1]:6640**.
    
                         If _port_ is not specified, it defaults to 6640.
    
                  **pssl:**[_port_][**:**_host_]
                         Listens for SSL/TLS connections on the specified TCP
                         _port_. Specify 0 for _port_ to have the kernel
                         automatically choose an available port. If _host_ ,
                         which can either be a DNS name (if built with
                         unbound library) or an IP address, is specified,
                         then connections are restricted to the resolved or
                         specified local IPaddress (either IPv4 or IPv6
                         address). If _host_ is an IPv6 address, wrap in square
                         brackets, e.g. **pssl:6640:[::1]**. If _host_ is not
                         specified then it listens only on IPv4 (but not
                         IPv6) addresses. A valid SSL/TLS configuration must
                         be provided when this form is used, this can be
                         specified either via command-line options or the **SSL**
                         table.
    
                         If _port_ is not specified, it defaults to 6640.
    
                         SSL/TLS support is an optional feature that is not
                         always built as part of OVN or Open vSwitch.
    
                  **ptcp:**[_port_][**:**_host_]
                         Listens for connections on the specified TCP _port_.
                         Specify 0 for _port_ to have the kernel automatically
                         choose an available port. If _host_ , which can either
                         be a DNS name (if built with unbound library) or an
                         IP address, is specified, then connections are
                         restricted to the resolved or specified local IP
                         address (either IPv4 or IPv6 address). If _host_ is an
                         IPv6 address, wrap it in square brackets, e.g.
                         **ptcp:6640:[::1]**. If _host_ is not specified then it
                         listens only on IPv4 addresses.
    
                         If _port_ is not specified, it defaults to 6640.
    
                  When multiple clients are configured, the **target** values
                  must be unique. Duplicate **target** values yield unspecified
                  results.
    
         _Client Failure Detection and Handling:_
    
           **max_backoff** : optional integer, at least 1,000
                  Maximum number of milliseconds to wait between connection
                  attempts. Default is implementation-specific.
    
           **inactivity_probe** : optional integer
                  Maximum number of milliseconds of idle time on connection
                  to the client before sending an inactivity probe message.
                  If Open vSwitch does not communicate with the client for
                  the specified number of seconds, it will send a probe. If a
                  response is not received for the same additional amount of
                  time, Open vSwitch assumes the connection has been broken
                  and attempts to reconnect. Default is implementation-
                  specific. A value of 0 disables inactivity probes.
    
         _Status:_
    
           Key-value pair of **is_connected** is always updated. Other key-value
           pairs in the status columns may be updated depends on the **target**
           type.
    
           When **target** specifies a connection method that listens for inbound
           connections (e.g. **ptcp:** or **punix:**), both **n_connections** and
           **is_connected** may also be updated while the remaining key-value
           pairs are omitted.
    
           On the other hand, when **target** specifies an outbound connection,
           all key-value pairs may be updated, except the above-mentioned two
           key-value pairs associated with inbound connection targets. They
           are omitted.
    
           **is_connected** : boolean
                  **true** if currently connected to this client, **false**
                  otherwise.
    
           **status : last_error** : optional string
                  A human-readable description of the last error on the
                  connection to the manager; i.e. **strerror(errno)**. This key
                  will exist only if an error has occurred.
    
           **status : state** : optional string, one of **ACTIVE** , **BACKOFF** ,
           **CONNECTING** , **IDLE** , or **VOID**
                  The state of the connection to the manager:
    
                  **VOID** Connection is disabled.
    
                  **BACKOFF**
                         Attempting to reconnect at an increasing period.
    
                  **CONNECTING**
                         Attempting to connect.
    
                  **ACTIVE** Connected, remote host responsive.
    
                  **IDLE** Connection is idle. Waiting for response to keep-
                         alive.
    
                  These values may change in the future. They are provided
                  only for human consumption.
    
           **status : sec_since_connect** : optional string, containing an
           integer, at least 0
                  The amount of time since this client last successfully
                  connected to the database (in seconds). Value is empty if
                  client has never successfully been connected.
    
           **status : sec_since_disconnect** : optional string, containing an
           integer, at least 0
                  The amount of time since this client last disconnected from
                  the database (in seconds). Value is empty if client has
                  never disconnected.
    
           **status : locks_held** : optional string
                  Space-separated list of the names of OVSDB locks that the
                  connection holds. Omitted if the connection does not hold
                  any locks.
    
           **status : locks_waiting** : optional string
                  Space-separated list of the names of OVSDB locks that the
                  connection is currently waiting to acquire. Omitted if the
                  connection is not waiting for any locks.
    
           **status : locks_lost** : optional string
                  Space-separated list of the names of OVSDB locks that the
                  connection has had stolen by another OVSDB client. Omitted
                  if no locks have been stolen from this connection.
    
           **status : n_connections** : optional string, containing an integer, at
           least 2
                  When **target** specifies a connection method that listens for
                  inbound connections (e.g. **ptcp:** or **pssl:**) and more than one
                  connection is actually active, the value is the number of
                  active connections. Otherwise, this key-value pair is
                  omitted.
    
           **status : bound_port** : optional string, containing an integer
                  When **target** is **ptcp:** or **pssl:** , this is the TCP port on
                  which the OVSDB server is listening. (This is particularly
                  useful when **target** specifies a port of 0, allowing the
                  kernel to choose any available port.)
    
         _Common Columns:_
    
           The overall purpose of these columns is described under **Common**
           **Columns** at the beginning of this document.
    
           **external_ids** : map of string-string pairs
    
           **other_config** : map of string-string pairs
    


* * *