OVN_K8S.CONF(5)

NAME
ovn_k8s.conf - Configuration File for ovn-kubernetes

DESCRIPTION

/etc/openvswitch/ovn_k8s.conf

This file overrides programmed defaults. It is usually set up during installation and is the same on all nodes. Command line options override options in this file.

This is in token=value format.

SECTIONS

[Default]

mtu=1400
    MTU value used for the overlay network.

conntrack-zone=64000
    ConntrackZone affects only the gateway nodes, This value is used to track connections that are initiated from the pods so that the reverse connections go back to the pods. This represents the conntrack zone used for the conntrack flow rules.

[Logging]

logfile=
    When logging to a file, this is the path and file. E.g., /var/log/openvswitch/ovn-k8s-cni-overlay.log Default is not to log to a file.

loglevel=4
    Level is the logging verbosity level: 5=debug, 4=info, 3=warn, 2=error, 1=fatal (default: 4).

[CNI]

The following config values are used for the CNI plugin.

conf-dir=/etc/cni/net.d
    Directory that contains the cni configuration.

plugin=ovn-k8s-cni-overlay
    Cni plugin name.

[Kubernetes]

K8S apiserver and authentication details are declared in the following options.

kubeconfig=
    Absolute path to the kubeconfig file (not required if the apiserver, cacert, and token are given).

cacert=
    The absolute path to the Kubernetes API CA certificate, e.g., /etc/openvswitch/k8s-ca.crt (not required if kubeconfig is given).

apiserver=http://localhost:8080
    URL to access the Kubernetes apiserver. The host must be a name, not IP. The kubernetes/openshift api server, by default, listens on 8443. E.g., https://masterhost:8443" (Not required if kubeconfig is given.)

token=
    The Kubernetes API authentication token permits the ovn plugin to communicate with the api server. On kubernetes, the token can be generated on the cluster master as follows: # kubectl create serviceaccount ovn # kubectl create clusterrolebinding ovn-admin --clusterrole=cluster-admin --serviceaccount=default:ovn # export TOKEN=$(kubectl describe secret $(kubectl get secrets | grep ovn | cut -f1 -d ' ') | grep -E '^token' | cut -f2 -d':' | tr -d ' ') On openshift, the token can be generated on the cluster master as follows: # oc create serviceaccount ovn # oc adm policy add-cluster-role-to-user cluster-admin -z ovn # oc adm policy add-scc-to-user anyuid -z ovn # oc sa get-token ovn (not required if kubeconfig is given).

[OvnNorth]

address=
    This is the url used to access the northbound database server. The scheme may be ssl or tcp. When ssl is used, the certs must be provided. The host must be a host IP address, not name. The port, by default, is 6441. E.g., ssl:1.2.3.4:6641

client-privkey=/etc/openvswitch/ovnnb-privkey.pem

client-cert=/etc/openvswitch/ovnnb-cert.pem

client-cacert=
    For example: /etc/openvswitch/ovnnb-ca.cert

server-privkey=

server-cert=

server-cacert=

[OvnSouth]

address=
    This is the url used to access the southbound database server. The scheme may be ssl or tcp. When ssl is used, the certs must be provided. The host must be a host IP address, not name. The port, by default, is 6442. E.g., ssl:1.2.3.4:6642

client-privkey=/etc/openvswitch/ovnsb-privkey.pem

client-cert=/etc/openvswitch/ovnsb-cert.pem

client-cacert=/etc/openvswitch/ovnsb-ca.cert

server-privkey=

server-cert=

server-cacert=

[Gateway]

mode=shared
    This is the node gateway mode. It can be left empty (disable gateway functionality), or set to "shared" (share a network interface) or "local" (use a NAT-ed virtual interface).

interface=eth1
    This interface will be used as the gateway interface in "shared" mode. If not specified the interface with the default route will be used.

next-hop=1.2.3.4
    This is the gateway IP address of interface to which traffic exiting the OVN logical network should be sent in "shared" mode. If not specified the next-hop of the default route will be used. vlan-id=0 This is the VLAN tag to apply to traffic exiting the OVN logical network in "shared" mode. A value of 0 means traffic should be untagged. nodeport=true When set to true Kubernetes NodePort services will be supported.

SEE ALso
ovnkube(1), ovn-kube-util(1).

https://github.com/ovn-org/ovn-kubernetes