Check the OVN substrate against its invariants.

GET

/v1/admin/network/ovn/doctor

Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/admin/network/ovn/doctor \
  --header 'Authorization: Bearer <token>'

Install-scope admin endpoint (network:GetOvnTopology, bootstrap-admin only) that evaluates the network invariants real outages were traced to, reporting each as PASS / WARN / FAIL.

Read-only. Always answers 200 when the report could be produced: a violated invariant is a successful diagnosis, and returning 5xx for one would stop a caller distinguishing “the substrate is broken” from “the check could not run”. Gate on overall.

WARN means an invariant could NOT be evaluated — a querier is not wired, or there is nothing of that kind on the cluster yet. It is deliberately distinct from PASS. A check that silently passes when it did not run is the failure this endpoint exists to remove: on the outages behind /1152/1158 every green light was accurate about its own narrow claim and useless in aggregate.

Each check names the ticket it was learned from, so a failure points at the known bug rather than being rediscovered.

Authorizations

bearerAuth

Responses

200

The invariant report.

application/json

object

overall

required

PASS — the invariant holds. FAIL — it is violated. WARN — it could not be evaluated, which is NOT a pass.

string

Allowed values: PASS WARN FAIL

checks

required

Array<object>

object

name

required

Stable identifier for the invariant, e.g. transit-fip-disjoint.

string

ticket

The issue this invariant was learned from, when there is one.

string

status

required

PASS — the invariant holds. FAIL — it is violated. WARN — it could not be evaluated, which is NOT a pass.

string

Allowed values: PASS WARN FAIL

detail

required

What was checked and, on failure, what was found.

string

offenders

The specific rows violating the invariant.

Array<string>

Example

{
  "overall": "PASS",
  "checks": [
    {
      "status": "PASS"
    }
  ]
}

403

Authenticated but not authorized.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}