# OVN Internals Context

paths:
  - ovn-inspect
  - ovn-deep-dive

## OVN Architecture in this Cluster

3-node IncusOS cluster with OVN overlay network `net-prod` (10.10.10.0/24).
Incus manages OVN objects using a `net8` prefix convention.

### Key OVN Objects

- **Logical Router**: `incus-net8-lr` — gateway at 192.168.103.200/22
  - SNAT: 10.10.10.0/24 → 192.168.103.200
  - LB: 192.168.103.200:80 → 10.10.10.50:80, 10.10.10.51:80
- **Internal Switch**: `incus-net8-ls-int` — 10.10.10.0/24 overlay
- **External Switch**: `incus-net8-ls-ext` — bridges to UPLINK
- **Gateway Chassis**: oc-node-03 (HA group, highest priority)
- **Geneve Tunnels**: Full mesh on 192.168.102.140-142, BFD enabled
- **Provider Bridge**: `incusovn7` on each node maps to UPLINK physical network
- **MTU**: 1442 (1500 - 58 Geneve overhead)

### Accessing OVN

- NB/SB commands: `incus exec oc-node-01:ovn-central -- ovn-nbctl ...`
- OVS commands: Need privileged container with `/run/openvswitch` mounted
  (deploy Alpine on net-prod, `apk add openvswitch`)
- Helper script: `incusos/helpers/ovn-inspect --nb|--sb|--ovs|--full|--trace`

### Important Details

- `incusbr0` has no working NAT — containers needing internet must use `net-prod`
- The `ovn-central` container runs on oc-node-03 (on incusbr0 network)
- OVS version: 3.6.1
- All OVN names start with `incus-net8-` for the net-prod network
- Instance OVN ports contain the Incus instance UUID
- LB is conntrack-based (ct_lb_mark), stateful