maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/.claude/rules/ovn-internals.md

1.5 KiB
Raw Blame History

OVN Internals Context

paths:

  • bin/helpers/ovn-inspect
  • notes/ovn-deep-dive*

OVN Architecture in this Cluster

3-node IncusOS cluster with OVN overlay network net-prod (10.10.10.0/24). Incus manages OVN objects using a net8 prefix convention.

Key OVN Objects

  • Logical Router: incus-net8-lr — gateway at 192.168.103.200/22
    • SNAT: 10.10.10.0/24 → 192.168.103.200
    • LB: 192.168.103.200:80 → 10.10.10.50:80, 10.10.10.51:80
  • Internal Switch: incus-net8-ls-int — 10.10.10.0/24 overlay
  • External Switch: incus-net8-ls-ext — bridges to UPLINK
  • Gateway Chassis: oc-node-03 (HA group, highest priority)
  • Geneve Tunnels: Full mesh on 192.168.102.140-142, BFD enabled
  • Provider Bridge: incusovn7 on each node maps to UPLINK physical network
  • MTU: 1442 (1500 - 58 Geneve overhead)

Accessing OVN

  • NB/SB commands: incus exec oc-node-01:ovn-central -- ovn-nbctl ...
  • OVS commands: Need privileged container with /run/openvswitch mounted (deploy Alpine on net-prod, apk add openvswitch)
  • Helper script: bin/helpers/ovn-inspect --nb|--sb|--ovs|--full|--trace

Important Details

  • incusbr0 has no working NAT — containers needing internet must use net-prod
  • The ovn-central container runs on oc-node-03 (on incusbr0 network)
  • OVS version: 3.6.1
  • All OVN names start with incus-net8- for the net-prod network
  • Instance OVN ports contain the Incus instance UUID
  • LB is conntrack-based (ct_lb_mark), stateful