NAME

       ovn-controller-vtep  -  Open  Virtual  Network  local controller for vtep enabled physical
       switches.

SYNOPSIS

       ovn-controller-vtep [options] [--vtep-db=vtep-database] [--ovnsb-db=ovnsb-database]

DESCRIPTION

       ovn-controller-vtep is the local controller daemon in OVN, the Open Virtual  Network,  for
       VTEP  enabled  physical  switches.  It  connects  up  to  the OVN Southbound database (see
       ovn-sb(5)) over the OVSDB protocol, and down to the VTEP database (see vtep(5))  over  the
       OVSDB protocol.

   PKI Options
       PKI  configuration  is  required  in  order to use SSL for the connections to the VTEP and
       Southbound databases.

              -p privkey.pem
              --private-key=privkey.pem
                   Specifies a PEM file containing the private key used as identity for  outgoing
                   SSL connections.

              -c cert.pem
              --certificate=cert.pem
                   Specifies  a  PEM file containing a certificate that certifies the private key
                   specified on -p or --private-key to be trustworthy. The  certificate  must  be
                   signed by the certificate authority (CA) that the peer in SSL connections will
                   use to verify it.

              -C cacert.pem
              --ca-cert=cacert.pem
                   Specifies a PEM file containing the CA certificate for verifying  certificates
                   presented to this program by SSL peers. (This may be the same certificate that
                   SSL peers use to verify the certificate specified on -c or  --certificate,  or
                   it may be a different one, depending on the PKI design in use.)

              -C none
              --ca-cert=none
                   Disables  verification of certificates presented by SSL peers. This introduces
                   a security risk, because it means that certificates cannot be verified  to  be
                   those of known trusted hosts.

              --bootstrap-ca-cert=cacert.pem
                     When  cacert.pem exists, this option has the same effect as -C or --ca-cert.
                     If it does not exist, then the executable will  attempt  to  obtain  the  CA
                     certificate from the SSL peer on its first SSL connection and save it to the
                     named PEM file. If it is successful, it will immediately drop the connection
                     and reconnect, and from then on all SSL connections must be authenticated by
                     a certificate signed by the CA certificate thus obtained.

                     This option  exposes  the  SSL  connection  to  a  man-in-the-middle  attack
                     obtaining   the   initial   CA   certificate,  but  it  may  be  useful  for
                     bootstrapping.

                     This option is only useful if the SSL peer sends its CA certificate as  part
                     of  the  SSL certificate chain. The SSL protocol does not require the server
                     to send the CA certificate.

                     This option is mutually exclusive with -C and --ca-cert.

              --peer-ca-cert=peer-cacert.pem
                     Specifies a PEM file that contains one or more  additional  certificates  to
                     send to SSL peers. peer-cacert.pem should be the CA certificate used to sign
                     the program’s own certificate, that is, the certificate specified on  -c  or
                     --certificate.   If   the   program’s   certificate   is  self-signed,  then
                     --certificate and --peer-ca-cert should specify the same file.

                     This option is not useful in normal operation, because  the  SSL  peer  must
                     already  have  the CA certificate for the peer to have any confidence in the
                     program’s identity. However, this offers a way for  a  new  installation  to
                     bootstrap the CA certificate on its first SSL connection.

CONFIGURATION

       ovn-controller-vtep  retrieves  its  configuration information from both the ovnsb and the
       vtep database. If the database locations are not given from command line, the  default  is
       the  db.sock  in local OVSDB’s ’run’ directory. The database location must take one of the
       following forms:

              •      ssl:host:port

                     The specified SSL port on the give host, which can either be a DNS name  (if
                     built  with  unbound library) or an IP address (IPv4 or IPv6). If host is an
                     IPv6 address, then wrap host with square brackets, e.g.: ssl:[::1]:6640. The
                     --private-key,  --certificate and either of --ca-cert or --bootstrap-ca-cert
                     options are mandatory when this form is used.

              •      tcp:host:port

                     Connect to the given TCP port on host, where host can  be  a  DNS  name  (if
                     built with unbound library) or IP address (IPv4 or IPv6). If host is an IPv6
                     address, then wrap host with square brackets, e.g.: tcp:[::1]:6640.

              •      unix:file

                     On POSIX, connect to the Unix domain server socket named file.

                     On Windows, connect to a localhost TCP port whose value is written in file.

       ovn-controller-vtep assumes it gets configuration information from the following  keys  in
       the Global table of the connected hardware_vtep database:

              other_config:ovn-match-northd-version
                     The  boolean flag indicates if ovn-controller-vtep needs to check ovn-northd
                     version. If this flag is set to true and the ovn-northd’s version  (reported
                     in  the  Southbound  database)  doesn’t match with the ovn-controller-vtep’s
                     internal version, then it will stop processing the southbound and  connected
                     hardware_vtep  database  changes.  The  default value is considered false if
                     this option is not defined.

              other_config:ovn-remote-probe-interval
                     The inactivity probe interval  of  the  connection  to  the  OVN  Southbound
                     database,  in milliseconds. If the value is zero, it disables the connection
                     keepalive feature.

                     If the value is nonzero, then it will be forced to a value of at least  1000
                     ms.