| 2022-07-20 07:22:08 |
Liu Xie |
description |
As the title describes, we can use 'address set' of ovn to support the feature that address group. |
As the title describes, we can use 'Address_Set' of ovn to support the feature that address group.
OVN is already supporting the feature 'Address_Set' that create a set of address contains IPv4, or IPv6 addresses with optional bitwise or CIDR masks. For details, we can see [0].
For example:
# Create an address set
ovn-nbctl create Address_Set name=as1 addresses=\"10.0.0.2\",\"10.0.0.3\"
# Add acl1 uses as1
ovn-nbctl --wait=hv acl-add pg1 to-lport 1001 'outport == "pg1" && ip4 && ip4.src == $as1' allow
So we can implement the feature that translate the neutron address group to a Address_Set entry and put this entry to a match filed of ovn acl.
[0]https://github.com/ovn-org/ovn/blob/81503d661ed9449ebe85f4b6b3130b75c7dd60bd/ovn-nb.xml#L1641 |
|
