Enable operator SSH access via OVN localport for this subnet.
curl --request POST \ --url https://stratum.example.com/v1/admin/network/subnets/example/actions/enable-ops-access \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "ip": "example", "mac": "example" }'. Writes a host-helper intent file the reconciler converges on the host: creates the OVN localport LSP + OVS internal port + brings the kernel iface up. Substrate-host packets can then reach VM IPs in this subnet directly. Bypasses subnet SG ACLs by design.
Body is optional. Empty body uses the defaults (highest
non-reserved host IP in the subnet’s CIDR, deterministic
MAC). Pass {ip, mac} to override.
Gated by network:EnableSubnetOpsAccess on the install
resource (bootstrap-admin / platform-admin only). Audit
event: network.subnet.ops_access_enabled.
Idempotent: re-running with the same body refreshes the intent file (no-op on the reconciler when nothing changed).
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Body
Section titled “Request Body”body for POST /v1/admin/network/subnets/{id}/actions/enable-ops-access. All fields optional.
object
Host-side IP in CIDR notation (e.g. 192.168.99.250/24). Must fall in the subnet’s CIDR and outside the reserved band (.0,.1-.10, broadcast). Default: the highest non-reserved host IP in the subnet’s CIDR.
Host-side MAC. Default: deterministic locally-administered MAC derived from the subnet ID.
Example generated
{ "ip": "example", "mac": "example"}Responses
Section titled “Responses”Intent accepted; reconciler converges asynchronously.
response shape for the enable-ops-access action.
object
OVN logical switch name (ls-
OVN LSP name (ops-
Host-side OVS internal / kernel iface name (ops-<8hex>, fits IFNAMSIZ).
Resolved host IP in CIDR notation.
Resolved host MAC.
Example generated
{ "subnetId": "example", "lsName": "example", "lspName": "example", "hostIfaceName": "example", "hostIp": "example", "hostMac": "example"}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Resource not found.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}