Saturday, May 28, 2016

OVN OpenStack

Install ovn-central service which will have ovn northbound and southbound database installed and use the correct schema.

dpkg -i openvswitch-common_2.5.90-1_amd64.deb
dpkg -i openvswitch-switch_2.5.90-1_amd64.deb
dpkg -i ovn-common_2.5.90-1_amd64.deb
dpkg -i ovn-central_2.5.90-1_amd64.deb

OVN database files will be at /etc/openvswitch directory by default. The above will also install openvswitch openvswitchd and its default database. There will be total three ovs database files:

  1. conf.db
  2. ovnnb_db.db
  3. ovnsb_db.db

Once ovn-central is installed, there will be ovsdb-server running for ovnnb_db and ovnsb_db. This service will also have ovn-northd running. Use the following command to start/stop the service

     service ovn-central start/stop

The above service should produce four processes like the following:

ovsdb-server --detach -vconsole:off --log-file=/var/log/openvswitch/ovsdb-server-nb.log --remote=punix:/var/run/openvswitch/ovnnb_db.sock --remote=ptcp:6641:0.0.0.0 --pidfile=/var/run/openvswitch/ovnnb_db.pid --unixctl=ovnnb_db.ctl /etc/openvswitch/ovnnb_db.db

ovsdb-server --detach -vconsole:off --log-file=/var/log/openvswitch/ovsdb-server-sb.log --remote=punix:/var/run/openvswitch/ovnsb_db.sock --remote=ptcp:6642:0.0.0.0 --pidfile=/var/run/openvswitch/ovnsb_db.pid --unixctl=ovnsb_db.ctl /etc/openvswitch/ovnsb_db.db

ovn-northd -vconsole:emer -vsyslog:err -vfile:info --ovnnb-db=unix:/var/run/openvswitch/ovnnb_db.sock --ovnsb-db=unix:/var/run/openvswitch/ovnsb_db.sock --no-chdir --log-file=/var/log/openvswitch/ovn-northd.log --pidfile=/var/run/openvswitch/ovn-northd.pid --detach --monitor

ovn-northd -vconsole:emer -vsyslog:err -vfile:info --ovnnb-db=unix:/var/run/openvswitch/ovnnb_db.sock --ovnsb-db=unix:/var/run/openvswitch/ovnsb_db.sock --no-chdir --log-file=/var/log/openvswitch/ovn-northd.log --pidfile=/var/run/openvswitch/ovn-northd.pid --detach --monitor


Use the following command to list the database running at the different port

       1. ovsdb-client list-dbs tcp:127.0.0.1:6641
       2. ovsdb-client list-dbs tcp:127.0.0.1:6642
       3. ovsdb-client list-dbs

Command #1 above shows the OVN_Northbound database, command #2 above shows the OVN_Southbound database. Command #3 above shows the database running at the default port.

To list each database schema, try the following command

    ovsdb-client get-schema tcp:127.0.0.1:6641 | python -m json.tool


Install ovn-host service onto compute node and configure it


Useful commands:

ovs-ofctl show br-int
ovs-ofctl -O OpenFlow13 dump-flows br-int 

1 comment:

  1. Hi Tong,
    Thanks for the great post.
    I am trying to experiment stateful ACLs on a non-openstack and non-sandbox environment.
    I have one physical host(ovs2.6 installed), with one physical port(eth2) added to br-int. Now, I want to apply the ACL rules for eth2. I am following the below steps:
    # ovn-nbctl ls-add sw0
    # ovn-nbctl lsp-add sw0 sw0-port1
    # ovn-nbctl lsp-set-addresses sw0-port1 00:00:00:00:00:01
    # ovs-vsctl add-port br-int eth2 — set Interface eth2 external_ids:iface-id=sw0-port1

    # ovn-nbctl acl-add sw0 from-lport 1002 “inport == \”sw0-port1\” && ip” allow-related
    # ovn-nbctl acl-add sw0 to-lport 1002 “outport == \”sw0-port1\” && ip && icmp” allow-related
    # ovn-nbctl acl-add sw0 to-lport 1002 “outport == \”sw0-port1\” && ip && tcp && tcp.dst == 22″ allow-related
    # ovn-nbctl acl-add sw0 to-lport 1001 “outport == \”sw0-port1\” && ip” drop

    I have two queries here :
    1) Am I doing right so far ?
    2) How do I verify whether ACL rules are getting evaluated or not ?( I was thinking of pumping UDP traffic using iperf destined to eth2, but since eth2 is attached to br-int, it doesn’t have an ip)

    Please help.

    ReplyDelete