# Driver `network.lan` **Minimal configlet:** [network#1] type = lan **Minimal setup command:** om test/ccfg/foo set --kw="type=lan" **Supported keywords:** - comment - dev - dns - gateway - mask_per_node - modes - network - ranges - type - vlan_mode - vlan_tag ## Keyword `comment` required: false scopable: false rbac: This driver group requires the root grant. **Description:** A free form text describing the role of the object, of the node, or of the section it is set in. The keyword is accepted in any section, so the DEFAULT section can document a configuration as a whole, and a resource, pool, heartbeat, array or network section can document itself. The agent does not interpret the value. ## Keyword `dev` required: false scopable: true rbac: This driver group requires the root grant. **Example:** dev=eth1 **Description:** The interface of the node on the segment, which the addresses drawn from this network are configured on, as `eth1`. When not set, it is the interface holding an address of the segment, not counting the addresses of the ranges. Set it when the nodes have no address on the segment, or when several interfaces hold one. ## Keyword `dns` required: false scopable: true convert: list rbac: This driver group requires the root grant. **Example:** dns=2001:db8::53 192.0.2.53 **Description:** The nameservers reachable from the network, which the containers whose network namespace holds an address of it, from an ip.netns or an ip.cni, are given in place of the nameservers of the cluster: a segment the cluster nameservers are not reachable from, as a public one, needs its own. The `dns` keyword of a container adds its own nameservers after them. Unset, the containers are given the nameservers of the cluster. A container with addresses on several networks naming nameservers is given the ones of each, in the order of its ip resources. ## Keyword `gateway` required: false scopable: true rbac: This driver group requires the root grant. **Example:** gateway=192.168.10.254 **Description:** The router of the segment, which the ip.netns resources drawing from this network route the traffic of their namespace through, unless they set a gateway of their own. The ip.host resources do not use it: their addresses are configured on the node, which has its own routes. It must be an address of the segment, and not one of the ranges om hands out. When not set, the ip.netns resources set no gateway, and a namespace with no default route of its own reaches the segment only. ## Keyword `mask_per_node` required: false scopable: false default: 0 convert: int rbac: This driver group requires the root grant. **Description:** The prefix length of the subnets distributed to each node. For example if the network is a x.x.x.x/16 you can distribute - x.x.x.x/17 subnets to 2 nodes - x.x.x.x/18 to 4 nodes - etc... If both `mask_per_node` and `ips_per_node` are set, `ips_per_node` is ignored. If only `ips_per_node` is set, it is honored for backward compatibility. The `ips_per_node` keyword is deprecated because its value is hard to manage for large ipv6 subnets (e.g a x.x.x.x/48 subnet has 281474976710656 ips). ## Keyword `modes` required: false scopable: true candidates: bridge, macvlan, ipvlan-l2, dedicated, ovs convert: list rbac: This driver group requires the root grant. **Example:** modes=macvlan ipvlan-l2 **Description:** The modes an ip.netns drawing its address from the network may join the segment with, the first being the one of an ip.netns naming none: the network says how the segment is joined, as `macvlan` where the interface of the node on it is no bridge, and an ip.netns naming another mode is refused. Unset, an ip.netns joins the segment with the mode it names, `bridge` by default, which needs the interface of the node on the segment to be a bridge. A namespace administrator can not name the mode of an ip.netns: the network choosing it is what lets the address of a namespace be on any segment. The keyword is scopable, for the nodes whose interface on the segment differs. ## Keyword `network` required: false scopable: false rbac: This driver group requires the root grant. **Example:** network=192.168.10.0/24 **Description:** The segment the nodes share, as `192.168.10.0/24`, which the addresses drawn from this network are configured with the prefix length of. Its first address, and the last of an ipv4 segment, are never handed out. om hands out the addresses of the ranges keyword only. Every node draws from all of them, so an address is the same wherever the object runs, and an object moving to another node takes its address along. A draw is made under the cluster lock of the network, and keeps clear of the addresses the nodes hold: the ones each node alive has reserved, the ones the cluster status reports, and the ones each node remembers the others last reported holding, which outlive a node the cluster stops hearing from. A node stopped cleanly, as for a restart, is waited for until its maintenance grace period ends, for as long as the lease of the lock allows. Two parts of a split cluster, each not hearing the other, draw blind to what the other draws, and can hand out the same address twice. The ip.host resources report such an address as held elsewhere too, and an administrator gives one of them another address: unset the addr of the resource and restart it, or unprovision and provision it. ## Keyword `ranges` required: false scopable: false convert: list rbac: This driver group requires the root grant. **Example:** ranges=192.168.10.100-192.168.10.149 192.168.10.151-192.168.10.199 **Description:** The addresses of the segment om hands out, as a list of subnets, as `192.168.10.128/26`, and of spans from a first to a last address, as `192.168.10.100-192.168.10.199`, the form nftables and ipset read. Required: the segment holds the addresses of the nodes, of the router and of the other hosts, which om knows nothing of. Keep the ranges clear of them, leaving out a host in the middle of a span by writing the span in two: ranges = 192.168.10.100-192.168.10.149 192.168.10.151-192.168.10.199 The ranges must be in the segment, and must not overlap, nor overlap the ranges of another lan network of the same segment. ## Keyword `type` required: false scopable: false candidates: bridge, routed_bridge, lan default: bridge rbac: This driver group requires the root grant. **Description:** The type of network. * `bridge`: a subnet on a bridge of each node, the same on every node, its traffic masqueraded out of the node. * `routed_bridge`: a subnet cut into one range per node, routed between the nodes. * `lan`: ranges of a segment the nodes share, the addresses of which an object takes along when it moves to another node, as the floating address of a failover service. The traffic the nodes forward for the `bridge` and `routed_bridge` networks is accepted in the om nft table, and, on a node running docker, whose forward chain drops what docker did not accept, in a chain the docker `DOCKER-USER` chain jumps to. ## Keyword `vlan_mode` required: false scopable: true candidates: access, native-tagged, native-untagged rbac: This driver group requires the root grant. **Example:** vlan_mode=access **Description:** The VLAN mode of the port an ip.netns joining the segment in `ovs` mode adds to the openvswitch bridge, when the ip.netns names none: `access`, `native-tagged` or `native-untagged`. ## Keyword `vlan_tag` required: false scopable: true rbac: This driver group requires the root grant. **Example:** vlan_tag=44 **Description:** The VLAN of the segment an ip.netns joining it in `ovs` mode puts its port in, the `tag` of the port on the openvswitch bridge, when the ip.netns names none. The segment is the network's: a namespace administrator, who can not name the tag of an ip.netns, joins it so.