ovstorage-operator-deploy-broker

name	ovstorage-operator-deploy-broker
description	Use when deploying the ovstorage-broker daemon with listener authentication, authorization policy, TLS, and storage connections.
license	CC-BY-4.0
version	0.2.0
author	NVIDIA Omniverse
tags	["ovstorage","broker","deployment"]
tools	["Read","Write","Bash"]
compatibility	Requires operator access to deployment hosts or manifests, TLS material, authentication configuration, and approved secret-management paths.

Deploy the ovstorage Broker

Goal

Stand up a single-tenant ovstorage-broker with an explicit listener trust boundary, the built-in auth Layer, and the required storage Layer graph.

Recipe

1. Read the broker operator guide.
2. Build the distribution with make dist.
3. Configure every listener with either auth = "anonymous" for an intentional trusted-local boundary or [listener.auth] kind = "builtin-auth" plus its authentication and policy configuration. Missing auth fails startup.
4. Configure TLS for public TCP listeners and provide all three JWT settings (jwt_issuer, jwt_audience, and jwt_jwks_url) together.
5. Configure the [ovstorage] Layer graph and [[connections]] used by the broker. Restrict OVSTORAGE_PLUGIN_DIR to trusted storage-plugin paths.
6. Start ovstorage-broker --config /etc/ovstorage/broker.toml under a dedicated service account.
7. Configure SIGHUP reload on Unix and drain-first SIGTERM/SIGINT shutdown. Windows configuration changes require a restart.

Checks

• The listener has an explicit auth mode and public TCP uses TLS.
• builtin-auth policy is deny-by-default and covers every intended operation.
• Plugin directories contain only trusted Layer plugins.
• State and cache directories are broker-owned and appropriately permissioned.
• Unknown auth kinds and malformed policy fail before the listener starts.

This skill covers the lightweight broker daemon, not the Kubernetes-based ovstorage-services stack.