Interop Tokyo 2014 SDI (Software Defined Infrustructure) ShowCase Seminoar Presentation. The presentation covers Neutron API models (L2/L3 and Advanced Network services), Neutron Icehouse Update and Juno topics.
Compute API L2/L3 API Horizon, Heat or Orchestration LB Service VM Process Based LB (HAProxy) HW Appliance LBaaS API OpenStack が提供するのは Abstraction と Integration (≠ Virtualization) Neutron には L2/L3 API と Advanced Service API が両方存在している。 両者を区別してみると、理解しやすいと思います。
Compute Virtual Switch VM VM Nova Compute Virtual Switch VM VM HW Switch CLI / Dashboard (Horizon) / Orchestration Tool OpenFlow Controller Network OFC API Neutron API OpenFlow Protocol Nova API agent agent NEC OpenFlow OpenDaylight
Nova Compute Virtual Switch VM VM Nova Compute Virtual Switch VM VM HW Switch CLI / Dashboard (Horizon) / Orchestration Tool Compute Node にそれぞれ OpenFlow Controller を載せる例もある Neutron API OpenFlow Protocol Nova API agent agent OpenFlow Controller OpenFlow Controller Ryu
worker – Improvements in dhcp-agent, l3-agent, OVS agent … – Scenario test / API test coverage in tempest – Third party testing (vendor driver testing) • nova event callback – Notify nova of port status changes when fixed_ips/floatingips change – It ensure a VM is launched after network connection is available. • Deprecate OVS Plugin and Linux Bridge plugin – Migration to ML2 plugin is recommended. • 機能面の変更は少なめ – これまでの機能追加中心だったが、一度立ち止まって底上げ – 次の機能追加に向けた充電期間と考えるべき Key New Features During Icehouse cycle the team focused on stability and testing of the Neutron codebase. Many of the existing plugins and drivers were revised to address known performance and stability issues. Icehouse Release Notes
に通知する仕組み • Nova 側では、確実に、ネットワーク接続の準備が整ってか ら VM 起動を行えるようになる。 – これまでは、Nova は Neutron ポートを作成すると、状態を確認 せずに VM 起動を行っていたので、DHCP の IP アドレス割り当 て等に失敗することがあった。 nova-compute VM OVS VIF Neutron Server OVS agent (1) Create Port (2) Tap-dev作成 Network (3) ネットワーク 接続準備 (4) 準備完了通知 (5) Notify Nova (6) VM Launch Dhcp server Neutronから通知 があるまで待つ
and “Test Coverage” (rather than new features) – Scenario and API test coverage in tempest – Enable parallel testing on tempest • Nova-Network Feature Parity – Nova-network feature parity towards deprecating nova-network – A lot of progresses but the completion will be Juno (or later) • Nova Integration : nova-event-callback – Notify nova of port status changes when fixed_ips/floatingips change – It ensure a VM is launched after network connection is available. • ML2 (Modular Layer2) plugin – Add support for vnic type request to be managed by ML2 mechanism drivers • Allows nova to request vnic type for a port : normal, direct (pass-through), macvtap – Implement the binding:profile port attribute in ML2 – Extensible port attribute for plugin to provide details to VIF driver – Migration from OVS / linux bridge plugin to ML2 • Provide a tool to migration DB data from deprecated plugins to ML2. • L3 : Operational Status for Floating IPs • Advanced Network Services (LBaaS, VPNaaS, FWaaS) – No major features – Some vendor drivers: Radware/Embrane (LBaaS), Cisco (VPNaaS)
– OpenDayLight plugin (It works with Hydrogen ODL release) – OpenFlow agent (ryu) driver (OpenFlow controller per compute node) – Big Switch, Mellanox, Brocade • New plugins : IBM SDN-VE, Nuage, OneConvergence • Existing plugins: – BigSwtich (async ope, secgroup, resync with backend) – Vmware NSX (renamed from Nicira NVP plugin), Plumgrid (provider network) – NEC plugin : packet filter extension support for PFC • Items deferred to Juno …. – IPv6 related attributes to control IPv6 RA and address assignments (ipv6-two-attributes) • API layer is defined but backend implementation is not merged. – Layer 3 HA • L3-agent HA • Distributed Virtual Router (with OVS) – Advanced Network Service “flavor” support – Advanced service in VM – and so on
VM でネットワーク機能を実現する枠組み – Service VM 自体は Neutron/Nova など複数プロジェク トにまたがるため、独立したプロジェクト (stackforge) で進めることになった。 – Service VM を実現する上での Neutron に必要機能を 整理し、Neutron 側と連携して実装していく。 • Disabling Security Group / Anti-spoofing rule • Trunk VLAN support for VM port • Traffic Steering • …. – https://etherpad.openstack.org/p/servicevm
API (rule, policy, firewall resource) – L3-agent based impl, some vendor plugin – 制限事項 • 1 firewall per tenant (with l3-agent) • Firewall applies to all routers • Icehouse – Service Insertion/Service Type Framework – Zone – Apply Operation – Counters – https://etherpad.openstack.org/p/icehouse-neutron-fwaas
– Horizon, Heat support • Icehouse – Service Type Framework • 複数種類のVPNのサポート – SSL-VPN – IPSec Certification Support – MPLS/BGP – (L2-VPN?) – https://etherpad.openstack.org/p/NeutronVPNaaSIce House