On Wed, Sep 30, 2026 at 7:15 PM Numan via dev <[email protected]> wrote:
> From: Numan Siddique <[email protected]> > > start_ovsdb__() derives every per-database variable from its DB > argument, so for DB=OVNBR it reads $OVN_OVNBR_LOG and > $OVN_OVNBR_DB_SSL_*. Neither was defined: set_defaults() defined > OVNBR_DB_SSL_* instead, and nothing defined a log variable. As a > result: > > - The --ovnbr-db-ssl-* options were accepted and silently ignored, > so the OVN_Bridge_Controller ovsdb-server always took its TLS > settings from the database, whatever was passed on the command > line. > - --ovn-br-db-log was rejected as an unknown option, and the > ovsdb-server was started with no logging parameters at all, > unlike every other database server. > - --ovsdb-br-wrapper was rejected as an unknown option, and > start_ovnbr_ovsdb() did not pass a wrapper in any case. > > Name the options after the variables start_ovsdb__() reads, the way > the NB, SB and IC databases already do and the way the existing > --ovn-ovnbr-logfile option is named: --ovn-ovnbr-db-ssl-*, > --ovn-ovnbr-log (defaulting to "-vconsole:off -vfile:info", as for > the other database servers) and --ovsdb-ovnbr-wrapper. None of the > old names ever took effect, so no working configuration is broken by > the rename. > > Also fix the example in the ovn-br-db systemd unit, which used > --db-br-create-insecure-remote; the option is > --db-ovnbr-create-insecure-remote. > > Fixes: 22dbd8021359 ("ovn-ctl: Add commands to start OVN bridge controller > services.") > Reported-by: Dumitru Ceara <[email protected]> > Assisted-by: Claude Opus 5.5, Claude Code > Signed-off-by: Numan Siddique <[email protected]> > --- > rhel/usr_lib_systemd_system_ovn-br-db.service | 4 +-- > utilities/ovn-ctl | 33 ++++++++++--------- > utilities/ovn-ctl.8.xml | 29 +++++++++------- > 3 files changed, 37 insertions(+), 29 deletions(-) > > diff --git a/rhel/usr_lib_systemd_system_ovn-br-db.service > b/rhel/usr_lib_systemd_system_ovn-br-db.service > index 6de2a22f1e..a6f6631b09 100644 > --- a/rhel/usr_lib_systemd_system_ovn-br-db.service > +++ b/rhel/usr_lib_systemd_system_ovn-br-db.service > @@ -7,11 +7,11 @@ > # /etc/systemd/system/ovn-br-db.d/local.conf: > # > # [System] > -# Environment="OVN_BR_DB_OPTS=--db-br-create-insecure-remote=yes" > +# Environment="OVN_BR_DB_OPTS=--db-ovnbr-create-insecure-remote=yes" > # > # Alternatively, you may specify environment variables in the file > /etc/sysconfig/ovn-br-db: > # > -# OVN_BR_DB_OPTS="--db-br-create-insecure-remote=yes" > +# OVN_BR_DB_OPTS="--db-ovnbr-create-insecure-remote=yes" > > [Unit] > Description=OVN Bridge Controller OVSDB server > diff --git a/utilities/ovn-ctl b/utilities/ovn-ctl > index 788f1c14ba..8b73132e32 100755 > --- a/utilities/ovn-ctl > +++ b/utilities/ovn-ctl > @@ -461,7 +461,8 @@ start_ic_ovsdb () { > > > start_ovnbr_ovsdb() { > - start_ovsdb__ OVNBR br OVN_Bridge_Controller BR_Global > + start_ovsdb__ OVNBR br OVN_Bridge_Controller BR_Global \ > + "$OVSDB_OVNBR_WRAPPER" > } > > sync_status() { > @@ -1134,7 +1135,9 @@ set_defaults () { > OVNBR_CONTROLLER_WRAPPER= > > OVNBR_CONTROLLER_LOG="-vconsole:emer -vsyslog:err -vfile:info" > + OVN_OVNBR_LOG="-vconsole:off -vfile:info" > OVN_OVNBR_LOGFILE="$ovn_logdir/ovsdb-server-ovnbr.log" > + OVSDB_OVNBR_WRAPPER= > > OVNBR_CONTROLLER_SSL_KEY="" > OVNBR_CONTROLLER_SSL_CERT="" > @@ -1149,12 +1152,12 @@ set_defaults () { > DB_OVNBR_DETACH="yes" > DB_OVNBR_USE_REMOTE_IN_DB="yes" > > - OVNBR_DB_SSL_KEY="" > - OVNBR_DB_SSL_CERT="" > - OVNBR_DB_SSL_CA_CERT="" > - OVNBR_DB_SSL_PROTOCOLS="" > - OVNBR_DB_SSL_CIPHERS="" > - OVNBR_DB_SSL_CIPHERSUITES="" > + OVN_OVNBR_DB_SSL_KEY="" > + OVN_OVNBR_DB_SSL_CERT="" > + OVN_OVNBR_DB_SSL_CA_CERT="" > + OVN_OVNBR_DB_SSL_PROTOCOLS="" > + OVN_OVNBR_DB_SSL_CIPHERS="" > + OVN_OVNBR_DB_SSL_CIPHERSUITES="" > } > > set_option () { > @@ -1333,15 +1336,15 @@ Options: > --ovnbr-controller-ssl-protocols=PROTOCOLS OVN Bridge Controller > SSL/TLS protocols > --ovnbr-controller-ssl-ciphers=CIPHERS OVN Bridge Controller SSL/TLS > cipher list > --ovnbr-controller-ssl-ciphersuites=CIPHERSUITES OVN Bridge Controller > TLSv1.3+ ciphersuite list > - --ovnbr-db-ssl-key=KEY OVN Bridge Controller DB SSL/TLS private key file > - --ovnbr-db-ssl-cert=CERT OVN Bridge Controller DB SSL/TLS certificate > file > - --ovnbr-db-ssl-ca-cert=CERT OVN Bridge Controller DB SSL/TLS CA > certificate file > - --ovnbr-db-ssl-protocols=PROTOCOLS OVN Bridge Controller DB SSL/TLS > protocols > - --ovnbr-db-ssl-ciphers=CIPHERS OVN Bridge Controller DB SSL/TLS cipher > list > - --ovnbr-db-ssl-ciphersuites=CIPHERSUITES OVN Bridge Controller DB > TLSv1.3+ ciphersuite list > + --ovn-ovnbr-db-ssl-key=KEY OVN Bridge Controller DB SSL/TLS private key > file > + --ovn-ovnbr-db-ssl-cert=CERT OVN Bridge Controller DB SSL/TLS > certificate file > + --ovn-ovnbr-db-ssl-ca-cert=CERT OVN Bridge Controller DB SSL/TLS CA > certificate file > + --ovn-ovnbr-db-ssl-protocols=PROTOCOLS OVN Bridge Controller DB SSL/TLS > protocols > + --ovn-ovnbr-db-ssl-ciphers=CIPHERS OVN Bridge Controller DB SSL/TLS > cipher list > + --ovn-ovnbr-db-ssl-ciphersuites=CIPHERSUITES OVN Bridge Controller DB > TLSv1.3+ ciphersuite list > --ovnbr-controller-log=STRING ovn-br-controller process logging > params (default: $OVNBR_CONTROLLER_LOG) > - --ovn-br-db-log=STRING ovn brdb ovsdb-server processes > logging params (default: $OVN_BR_DB_LOG) > - --ovsdb-br-wrapper=WRAPPER run with a wrapper like valgrind for > debugging > + --ovn-ovnbr-log=STRING ovn bridge controller ovsdb-server > process logging params (default: $OVN_OVNBR_LOG) > + --ovsdb-ovnbr-wrapper=WRAPPER run with a wrapper like valgrind for > debugging > -h, --help display this help message > > File location options: > diff --git a/utilities/ovn-ctl.8.xml b/utilities/ovn-ctl.8.xml > index 478487e755..9389397cef 100644 > --- a/utilities/ovn-ctl.8.xml > +++ b/utilities/ovn-ctl.8.xml > @@ -219,6 +219,8 @@ > database server under the specified wrapper.</p> > <p><code>--ovsdb-sb-wrapper=<var>WRAPPER</var></code> runs the > Southbound > database server under the specified wrapper.</p> > + <p><code>--ovsdb-ovnbr-wrapper=<var>WRAPPER</var></code> runs the OVN > + bridge controller database server under the specified wrapper.</p> > <p><code>--ovn-user=<var>USER[:GROUP]</var></code> runs OVN daemons > as the > specified user and optional group.</p> > <p><code>--ovn-manage-ovsdb=<var>yes|no</var></code> controls whether > @@ -330,11 +332,11 @@ > ovn-br-controller SSL/TLS CA certificate file.</p> > > <p><code>--ovnbr-controller-ssl-bootstrap-ca-cert=<var>CERT</var></code> > bootstraps the ovn-br-controller SSL/TLS CA certificate file.</p> > - <p><code>--ovnbr-db-ssl-key=<var>KEY</var></code> sets the > + <p><code>--ovn-ovnbr-db-ssl-key=<var>KEY</var></code> sets the > ovn-br-controller database SSL/TLS private key file.</p> > - <p><code>--ovnbr-db-ssl-cert=<var>CERT</var></code> sets the > + <p><code>--ovn-ovnbr-db-ssl-cert=<var>CERT</var></code> sets the > ovn-br-controller database SSL/TLS certificate file.</p> > - <p><code>--ovnbr-db-ssl-ca-cert=<var>CERT</var></code> sets the > + <p><code>--ovn-ovnbr-db-ssl-ca-cert=<var>CERT</var></code> sets the > ovn-br-controller database SSL/TLS CA certificate file.</p> > <p><code>--db-ovnbr-sock=<var>SOCKET</var></code> sets the OVN bridge > controller database socket.</p> > @@ -372,10 +374,12 @@ > <p><code>--ovn-nb-log=<var>STRING</var></code>, > <code>--ovn-sb-log=<var>STRING</var></code>, > <code>--ovn-ic-nb-log=<var>STRING</var></code>, > - <code>--ovn-ic-sb-log=<var>STRING</var></code>, and > - <code>--ovn-sb-relay-log=<var>STRING</var></code> set > database-server > - logging parameters. The defaults for the NB, SB, IC-NB, and IC-SB > - database servers are <code>-vconsole:off -vfile:info</code>. The > + <code>--ovn-ic-sb-log=<var>STRING</var></code>, > + <code>--ovn-sb-relay-log=<var>STRING</var></code>, and > + <code>--ovn-ovnbr-log=<var>STRING</var></code> set database-server > + logging parameters. The defaults for the NB, SB, IC-NB, IC-SB, and > + OVN bridge controller database servers are > + <code>-vconsole:off -vfile:info</code>. The > default for the SB relay database server is > <code>-vconsole:emer -vsyslog:err -vfile:info</code>.</p> > <p><code>--ovn-northd-logfile=<var>FILE</var></code>, > @@ -398,7 +402,7 @@ > <code>ovn-controller</code>, <code>ovn-northd</code>, > <code>ovn-ic</code>, <code>ovn-nb-db</code>, <code>ovn-sb-db</code>, > <code>ovn-ic-nb-db</code>, <code>ovn-ic-sb-db</code>, > - <code>ovn-sb-relay-db</code>, and <code>ovnbr-db</code>; > + <code>ovn-sb-relay-db</code>, and <code>ovn-ovnbr-db</code>; > append <code>-ssl-key</code>, <code>-ssl-cert</code>, > or <code>-ssl-ca-cert</code>. Controller prefixes also accept > <code>-ssl-bootstrap-ca-cert</code>. Empty values leave the normal > @@ -445,12 +449,13 @@ > ovn-br-controller SSL/TLS cipher list.</p> > > <p><code>--ovnbr-controller-ssl-ciphersuites=<var>CIPHERSUITES</var></code> > sets the ovn-br-controller TLS 1.3 and later ciphersuite list.</p> > - <p><code>--ovnbr-db-ssl-protocols=<var>PROTOCOLS</var></code> sets the > + <p><code>--ovn-ovnbr-db-ssl-protocols=<var>PROTOCOLS</var></code> > sets the > ovn-br-controller database SSL/TLS protocols.</p> > - <p><code>--ovnbr-db-ssl-ciphers=<var>CIPHERS</var></code> sets the > + <p><code>--ovn-ovnbr-db-ssl-ciphers=<var>CIPHERS</var></code> sets the > ovn-br-controller database SSL/TLS cipher list.</p> > - <p><code>--ovnbr-db-ssl-ciphersuites=<var>CIPHERSUITES</var></code> > sets > - the ovn-br-controller database TLS 1.3 and later ciphersuite > list.</p> > + > <p><code>--ovn-ovnbr-db-ssl-ciphersuites=<var>CIPHERSUITES</var></code> > + sets the ovn-br-controller database TLS 1.3 and later ciphersuite > + list.</p> > > <h1>Address and port options</h1> > <p><code>--db-nb-sync-from-addr=<var>IP ADDRESS</var></code>.</p> > -- > 2.55.0 > > _______________________________________________ > dev mailing list > [email protected] > https://mail.openvswitch.org/mailman/listinfo/ovs-dev > > Thank you Numan, one option was still missing. I applied the following diff, merged the change into main and backported it down to 26.03. I had to also backport 4736e44b740e ("ovn-ctl: Refresh option reference."). diff --git a/utilities/ovn-ctl b/utilities/ovn-ctl index 8b73132e3..559fffddb 100755 --- a/utilities/ovn-ctl +++ b/utilities/ovn-ctl @@ -1158,6 +1158,7 @@ set_defaults () { OVN_OVNBR_DB_SSL_PROTOCOLS="" OVN_OVNBR_DB_SSL_CIPHERS="" OVN_OVNBR_DB_SSL_CIPHERSUITES="" + OVN_OVNBR_DB_SSL_SERVER_NAME="" } set_option () { @@ -1342,6 +1343,7 @@ Options: --ovn-ovnbr-db-ssl-protocols=PROTOCOLS OVN Bridge Controller DB SSL/TLS protocols --ovn-ovnbr-db-ssl-ciphers=CIPHERS OVN Bridge Controller DB SSL/TLS cipher list --ovn-ovnbr-db-ssl-ciphersuites=CIPHERSUITES OVN Bridge Controller DB TLSv1.3+ ciphersuite list + --ovn-ovnbr-db-ssl-server-name=NAME OVN Bridge Controller DB TLS server name for SNI --ovnbr-controller-log=STRING ovn-br-controller process logging params (default: $OVNBR_CONTROLLER_LOG) --ovn-ovnbr-log=STRING ovn bridge controller ovsdb-server process logging params (default: $OVN_OVNBR_LOG) --ovsdb-ovnbr-wrapper=WRAPPER run with a wrapper like valgrind for debugging diff --git a/utilities/ovn-ctl.8.xml b/utilities/ovn-ctl.8.xml index 9389397ce..7a9ac9994 100644 --- a/utilities/ovn-ctl.8.xml +++ b/utilities/ovn-ctl.8.xml @@ -443,6 +443,7 @@ <p><code>--ovn-ic-nb-db-ssl-server-name=<var>NAME</var></code>.</p> <p><code>--ovn-ic-sb-db-ssl-server-name=<var>NAME</var></code>.</p> <p><code>--ovn-sb-relay-db-ssl-server-name=<var>NAME</var></code>.</p> + <p><code>--ovn-ovnbr-db-ssl-server-name=<var>NAME</var></code>.</p> <p><code>--ovnbr-controller-ssl-protocols=<var>PROTOCOLS</var></code> sets the ovn-br-controller SSL/TLS protocols.</p> <p><code>--ovnbr-controller-ssl-ciphers=<var>CIPHERS</var></code> sets the Regards, Ales _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
