# Ovstorage Operator Deploy Broker

> Use when deploying the ovstorage-broker daemon with listener authentication, authorization policy, TLS, and storage connections.

- Skill: `nvidia-omniverse/ovstorage-operator-deploy-broker` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nvidia-omniverse/ovstorage-operator-deploy-broker`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nvidia-omniverse/ovstorage-operator-deploy-broker/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: CC-BY-4.0
- Author: NVIDIA-Omniverse (https://skillmd.com/u/nvidia-omniverse)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nvidia-omniverse/ovstorage-operator-deploy-broker

---


# Deploy the ovstorage Broker

## Goal

Stand up a single-tenant `ovstorage-broker` with an explicit listener trust
boundary, the built-in auth Layer, and the required storage Layer graph.

## Recipe

1. Read the [broker operator guide](../../docs/public/broker-operator/README.md).
2. Build the distribution with `make dist`.
3. Configure every listener with either `auth = "anonymous"` for an intentional
   trusted-local boundary or `[listener.auth] kind = "builtin-auth"` plus its
   authentication and policy configuration. Missing auth fails startup.
4. Configure TLS for public TCP listeners and provide all three JWT settings
   (`jwt_issuer`, `jwt_audience`, and `jwt_jwks_url`) together.
5. Configure the `[ovstorage]` Layer graph and `[[connections]]` used by the
   broker. Restrict `OVSTORAGE_PLUGIN_DIR` to trusted storage-plugin paths.
6. Start `ovstorage-broker --config /etc/ovstorage/broker.toml` under a
   dedicated service account.
7. Configure SIGHUP reload on Unix and drain-first SIGTERM/SIGINT shutdown.
   Windows configuration changes require a restart.

## Checks

- The listener has an explicit auth mode and public TCP uses TLS.
- `builtin-auth` policy is deny-by-default and covers every intended operation.
- Plugin directories contain only trusted Layer plugins.
- State and cache directories are broker-owned and appropriately permissioned.
- Unknown auth kinds and malformed policy fail before the listener starts.

This skill covers the lightweight broker daemon, not the Kubernetes-based
`ovstorage-services` stack.