---
title: Charmhub | Deploy Ovn Central using Charmhub - The Open Operator Collection
description: Deploy the latest version of Ovn Central on any cloud. Open Virtual Network
  for Open vSwitch
url: https://charmhub.io/ovn-central
---

# Ovn Central

[OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers")

* [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers")
* [Cloud](https://charmhub.io/?filter=cloud)
* [Networking](https://charmhub.io/?filter=networking)

Platform:

24.04

23.10

23.04

22.10

22.04

20.04

18.04

22.03/stable 5575159

```
juju deploy ovn-central --channel 22.03/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Overview

The ovn-central charm provides the Northbound and Southbound OVSDB Databases
and the Open Virtual Network (OVN) central control daemon (`ovn-northd`). It is
used in conjunction with either the [ovn-chassis](https://jaas.ai/ovn-chassis)
subordinate charm or the [ovn-dedicated-chassis](https://jaas.ai/ovn-dedicated-chassis)
principle charm.

> **Note**: The OVN charms are supported starting with OpenStack Train.

# Usage

The [OpenStack Base bundle](https://github.com/openstack-charmers/openstack-bundles/blob/master/development/openstack-base-bionic-ussuri-ovn/bundle.yaml) gives an example of how you
can deploy OpenStack and OVN with [Vault](https://jaas.ai/vault) to automate certificate
lifecycle management.

OVN makes use of Public Key Infrastructure (PKI) to authenticate and authorize
control plane communication. The charm therefore requires a Certificate
Authority to be present in the model as represented by the `certificates`
relation.

Refer to [Open Virtual Network (OVN)](https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/app-ovn.html) in the [OpenStack Charms
Deployment Guide](https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/) for details, including deployment steps.

> **Note**: The ovn-central charm requires a minimum of three units to operate.

## [Network spaces](https://charmhub.io/ovn-central#p-25417-network-spaces)

This charm supports the use of Juju network spaces.

By binding the `ovsdb`, `ovsdb-cms` and `ovsdb-peer` endpoints you can
influence which interface will be used for communication with consumers of the
Southbound DB, Cloud Management Systems (CMS) and cluster internal
communication.

```
juju deploy -n 3 --series focal \
    --bind "''=oam-space ovsdb=data-space" \
    ovn-central
```

## [OVN RBAC and securing the OVN services](https://charmhub.io/ovn-central#p-25417-ovn-rbac-and-securing-the-ovn-services)

The charm enables [RBAC](https://github.com/ovn-org/ovn/blob/master/Documentation/topics/role-based-access-control.rst) in the OVN Southbound database by default.
The RBAC feature enforces authorization of individual chassis connecting to the
database, and also restricts database operations.

In the event of an individual chassis being compromised, RBAC will make it more
difficult to leverage database access for compromising other parts of the
network.

> **Note**: Due to how RBAC is implemented in [ovsdb-server](https://github.com/openvswitch/ovs/blob/master/Documentation/ref/ovsdb-server.7.rst#413-transact)
> the charm opens up a separate listener at port 16642 for connections from
> [ovn-northd](https://manpages.ubuntu.com/manpages/eoan/en/man8/ovn-northd.8.html).

The charm automatically enables the firewall and will allow traffic from its
cluster peers to port 6641, 6643, 6644 and 16642. CMS clients will be allowed
to talk to port 6641.

Anyone will be allowed to connect to port 6642.

## [Deferred service events](https://charmhub.io/ovn-central#p-25417-deferred-service-events)

Operational or maintenance procedures applied to a cloud often lead to the
restarting of various OpenStack services and/or the calling of certain charm
hooks. Although normal, such events can be undesirable due to the service
interruptions they can cause.

The deferred service events feature provides the operator the choice of
preventing these service restarts and hook calls from occurring, which can then
be resolved at a more opportune time.

See the [Deferred service events](https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/deferred-events.html) page in the
[OpenStack Charms Deployment Guide](https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/) for an in-depth treatment of this
feature.

# Bugs

Please report bugs on [Launchpad](https://bugs.launchpad.net/charm-ovn-central/+filebug).

For general questions please refer to the [OpenStack Charm Guide](https://docs.openstack.org/charm-guide/latest/).

---

[Help improve this document in the forum](https://discourse.charmhub.io/t/ovn-central-docs-index/10550) ([guidelines](https://discourse.charmhub.io/t/how-to-write-docs-our-documentation-guidelines-for-contributors/1245)). Last updated 3 years ago.