39 lines
1.5 KiB
Markdown
39 lines
1.5 KiB
Markdown
# OVN Internals Context
|
|
|
|
paths:
|
|
- ovn-inspect
|
|
- ovn-deep-dive
|
|
|
|
## OVN Architecture in this Cluster
|
|
|
|
3-node IncusOS cluster with OVN overlay network `net-prod` (10.10.10.0/24).
|
|
Incus manages OVN objects using a `net8` prefix convention.
|
|
|
|
### Key OVN Objects
|
|
|
|
- **Logical Router**: `incus-net8-lr` — gateway at 192.168.103.200/22
|
|
- SNAT: 10.10.10.0/24 → 192.168.103.200
|
|
- LB: 192.168.103.200:80 → 10.10.10.50:80, 10.10.10.51:80
|
|
- **Internal Switch**: `incus-net8-ls-int` — 10.10.10.0/24 overlay
|
|
- **External Switch**: `incus-net8-ls-ext` — bridges to UPLINK
|
|
- **Gateway Chassis**: oc-node-03 (HA group, highest priority)
|
|
- **Geneve Tunnels**: Full mesh on 192.168.102.140-142, BFD enabled
|
|
- **Provider Bridge**: `incusovn7` on each node maps to UPLINK physical network
|
|
- **MTU**: 1442 (1500 - 58 Geneve overhead)
|
|
|
|
### Accessing OVN
|
|
|
|
- NB/SB commands: `incus exec oc-node-01:ovn-central -- ovn-nbctl ...`
|
|
- OVS commands: Need privileged container with `/run/openvswitch` mounted
|
|
(deploy Alpine on net-prod, `apk add openvswitch`)
|
|
- Helper script: `incusos/helpers/ovn-inspect --nb|--sb|--ovs|--full|--trace`
|
|
|
|
### Important Details
|
|
|
|
- `incusbr0` has no working NAT — containers needing internet must use `net-prod`
|
|
- The `ovn-central` container runs on oc-node-03 (on incusbr0 network)
|
|
- OVS version: 3.6.1
|
|
- All OVN names start with `incus-net8-` for the net-prod network
|
|
- Instance OVN ports contain the Incus instance UUID
|
|
- LB is conntrack-based (ct_lb_mark), stateful
|