[ovs-dev,ovn] docs: Add note about RBAC and remote ovn-northd connection
diff mbox series

Message ID CAKpbOARdG6vh3pbckqgBcvui4jTx81jHdQO0gr_7Bg7ObNnZxw@mail.gmail.com
State New
Headers show
Series
  • [ovs-dev,ovn] docs: Add note about RBAC and remote ovn-northd connection
Related show

Commit Message

Frode Nordahl Nov. 8, 2019, 5:51 a.m. UTC
Signed-off-by: Frode Nordahl <frode.nordahl@canonical.com>
Acked-by: Aliasgar Ginwala <aginwala@ebay.com>
Submitted-at: https://github.com/ovn-org/ovn/pull/25
---
 .../topics/role-based-access-control.rst      |  7 ++++++
 Documentation/tutorials/ovn-rbac.rst          | 25 +++++++++++++++++++
 2 files changed, 32 insertions(+)

--
2.20.1

Comments

Numan Siddique Nov. 8, 2019, 10:56 a.m. UTC | #1
On Fri, Nov 8, 2019 at 11:22 AM Frode Nordahl
<frode.nordahl@canonical.com> wrote:
>
> Signed-off-by: Frode Nordahl <frode.nordahl@canonical.com>
> Acked-by: Aliasgar Ginwala <aginwala@ebay.com>
> Submitted-at: https://github.com/ovn-org/ovn/pull/25

I applied this patch to master.
Sorry I didn't notice that you already had sent the patch to the ML
and I resubmitted here - https://patchwork.ozlabs.org/patch/1191808/.

Thanks
Numan

> ---
>  .../topics/role-based-access-control.rst      |  7 ++++++
>  Documentation/tutorials/ovn-rbac.rst          | 25 +++++++++++++++++++
>  2 files changed, 32 insertions(+)
>
> diff --git a/Documentation/topics/role-based-access-control.rst
> b/Documentation/topics/role-based-access-control.rst
> index 2acd1e88b..e13e2d5dc 100644
> --- a/Documentation/topics/role-based-access-control.rst
> +++ b/Documentation/topics/role-based-access-control.rst
> @@ -82,6 +82,13 @@ command:
>
>     $ ovn-sbctl set-connection role=ovn-controller ssl:192.168.0.1:6642
>
> +.. note::
> +
> +   There is currently no pre-defined role for ovn-northd. You must configure
> +   a separate listener on the OVN southbound database that ovn-northd can
> +   connect to if your deployment topology require ovn-northd to connect to a
> +   OVN southbound database instance on a remote machine.
> +
>  Pre-defined Roles
>  -----------------
>  This section describes roles that have been defined internally by OVS/OVN.
> diff --git a/Documentation/tutorials/ovn-rbac.rst
> b/Documentation/tutorials/ovn-rbac.rst
> index 22b169d6d..fc2de5d5d 100644
> --- a/Documentation/tutorials/ovn-rbac.rst
> +++ b/Documentation/tutorials/ovn-rbac.rst
> @@ -132,3 +132,28 @@ Configuring RBAC
>                      /path/to/chassis_2-cert.pem /path/to/cacert.pem
>        $ ovs-vsctl set open_vswitch . \
>                      external_ids:ovn-remote=ssl:machine_3-ip:6642
> +
> +The OVN central control daemon and RBAC
> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> +
> +The OVN central control daemon (`ovn-northd`) needs full write access to
> +the southbound database. When you have one machine hosting the central
> +components, `ovn-northd` can talk to the databases through a local unix
> +socket, bypassing the `ovn-controller` RBAC configured for the listener
> +at port '6642'. However, if you want to deploy multiple machines for
> +hosting the central components, `ovn-northd` will require a remote
> +connection to all of them.
> +
> +1. Configure the southbound database with a second SSL listener on a
> +   separate port without RBAC enabled for use by `ovn-northd`.
> +
> +   In `machine_3`::
> +
> +      $ ovn-sbctl -- --id=@conn_uuid create Connection \
> +          target="pssl\:16642" \
> +          -- add  SB_Global . connections=@conn_uuid
> +
> +   .. note::
> +
> +     Care should be taken to restrict access to the above mentioned port
> +     so that only trusted machines can connect to it.
> --
> 2.20.1
> _______________________________________________
> dev mailing list
> dev@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
Frode Nordahl Nov. 8, 2019, 11:01 a.m. UTC | #2
On Fri, Nov 8, 2019 at 11:56 AM Numan Siddique <numans@ovn.org> wrote:
>
> On Fri, Nov 8, 2019 at 11:22 AM Frode Nordahl
> <frode.nordahl@canonical.com> wrote:
> >
> > Signed-off-by: Frode Nordahl <frode.nordahl@canonical.com>
> > Acked-by: Aliasgar Ginwala <aginwala@ebay.com>
> > Submitted-at: https://github.com/ovn-org/ovn/pull/25
>
> I applied this patch to master.
> Sorry I didn't notice that you already had sent the patch to the ML
> and I resubmitted here - https://patchwork.ozlabs.org/patch/1191808/.

No worries, and thank you for the merge!

I'll stick to sending patches through ml/patchworks in the future.

Patch
diff mbox series

diff --git a/Documentation/topics/role-based-access-control.rst
b/Documentation/topics/role-based-access-control.rst
index 2acd1e88b..e13e2d5dc 100644
--- a/Documentation/topics/role-based-access-control.rst
+++ b/Documentation/topics/role-based-access-control.rst
@@ -82,6 +82,13 @@  command:

    $ ovn-sbctl set-connection role=ovn-controller ssl:192.168.0.1:6642

+.. note::
+
+   There is currently no pre-defined role for ovn-northd. You must configure
+   a separate listener on the OVN southbound database that ovn-northd can
+   connect to if your deployment topology require ovn-northd to connect to a
+   OVN southbound database instance on a remote machine.
+
 Pre-defined Roles
 -----------------
 This section describes roles that have been defined internally by OVS/OVN.
diff --git a/Documentation/tutorials/ovn-rbac.rst
b/Documentation/tutorials/ovn-rbac.rst
index 22b169d6d..fc2de5d5d 100644
--- a/Documentation/tutorials/ovn-rbac.rst
+++ b/Documentation/tutorials/ovn-rbac.rst
@@ -132,3 +132,28 @@  Configuring RBAC
                     /path/to/chassis_2-cert.pem /path/to/cacert.pem
       $ ovs-vsctl set open_vswitch . \
                     external_ids:ovn-remote=ssl:machine_3-ip:6642
+
+The OVN central control daemon and RBAC
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The OVN central control daemon (`ovn-northd`) needs full write access to
+the southbound database. When you have one machine hosting the central
+components, `ovn-northd` can talk to the databases through a local unix
+socket, bypassing the `ovn-controller` RBAC configured for the listener
+at port '6642'. However, if you want to deploy multiple machines for
+hosting the central components, `ovn-northd` will require a remote
+connection to all of them.
+
+1. Configure the southbound database with a second SSL listener on a
+   separate port without RBAC enabled for use by `ovn-northd`.
+
+   In `machine_3`::
+
+      $ ovn-sbctl -- --id=@conn_uuid create Connection \
+          target="pssl\:16642" \
+          -- add  SB_Global . connections=@conn_uuid
+
+   .. note::
+
+     Care should be taken to restrict access to the above mentioned port
+     so that only trusted machines can connect to it.