Project Calico - an Introduction - May 2015

This is the presentation on Project Calico that I gave at the Docker London meetup in May 2015.

Transcript

1. @projectcalico Project Calico is sponsored by Sponsored by Project Calico: a Pure Layer 3 Approach to Docker Networking FOR DOCKER LONDON MEETUP Ed Harrison @eepyaich May 5, 2015
2. @projectcalico Project Calico is sponsored by  Ed Harrison  Dev Manager, Project Calico  @eepyaich  Metaswitch  Sequoia-backed software company  SDN & IP Multimedia Communications  1,000+ global customers  Project Calico  Open source project, sponsored by Metaswitch  Pure Layer 3 cloud networking solution  Containers, virtual machines & bare metal Introductions
3. @projectcalico Project Calico is sponsored by Docker Networking Today: Two Main Models Port forwarding / NAT  Simple  Works “out of the box”  Easily understood  … but not “real IP networking”  Won’t work with all applications (e.g. IPsec)  Onerous port assignment constraints on applications Overlay networks  Give each container its own private IP address (or subnet)  Separate “overlay” domain over “underlay” network with GRE, MPLS, VXLAN, or proprietary tunneling protocols  But…
4. @projectcalico Project Calico is sponsored by Virtual L2 segments, implemented in software by virtual switch The Standard Overlay Virtual Networking Model vSwitch vSwitch vSwitch Linux Linux Linux Encap / de- encap (& flooding!) Outer MAC Outer IP Outer UDP VXLAN Inner MAC Inner IP Inner TCP/UDP Payload Data Router services required to hop between tenants NAT required for public Internet access On/off-ramp required to get to NAS, etc. Virtual L2 segments, implemented in software by virtual switch
5. @projectcalico Project Calico is sponsored by ☹ Unnecessary complexity ☹ Low scale limits ☹ Performance issues ☹ Inefficient resource utilization ☹ Difficulty troubleshooting ☹ Demands placed on application developers to be networking experts This leads to… ALL solutions that use overlay / underlay model suffer from these effects, however they are mitigated. These issues become critical with containers due to the higher scale than VMs (100s vs 10s per server) … It doesn’t have to be this way!
6. @projectcalico Project Calico is sponsored by
7. @projectcalico Project Calico is sponsored by What if we built a Data Center like the Internet? IP App IP App IP App IP App IP App IP App IP App IP App Router Router Router BGP BGP Hosts
8. @projectcalico Project Calico is sponsored by What if we built a Data Center like the Internet? IP App IP App IP App IP App IP App IP App IP App IP App BGP BGP Compute Node Compute Node VMs / LXCs Router Router Router VMs / LXCs … this is Project Calico!
9. @projectcalico Project Calico is sponsored by Key Design Concepts IP  Perform layer 3 forwarding at each compute node  Leverage Linux kernel’s efficient IP forwarding engine – no separate vSwitch BGP  Distribute routes using proven Border Gateway Protocol, with route reflectors for scale  Program routes into Linux kernel on each host (and into physical fabric if required)  Separate policy decisions from routing information  Translate global policy into distributed firewall on each host, enabling tenant isolation & more
10. @projectcalico Project Calico is sponsored by Technical Details  Architecture components  Orchestrator plug-in  etcd – distributed, highly available datastore  Felix agent - forwarding table update, security policy  BIRD – BGP stack  Linux kernel – layer 3 forwarding and ACL enforcement  Build on and contribute to many existing open source projects  Release status  Docker – early/experimental  Integrating with partners (e.g. Clocker)  Openstack – ready for trials  Supported, hardened release end- Q2, 2015 Any physical fabric (L2, L3, MPLS, …) Cloud OS / Orchestration System Cloud OS / Orchestration System Compute Node Compute Node Compute Node Linux kernel Cloud OS / Orchestration System BGP Client Felix Routes ACLs Route Reflector Workload VM / Container Eth0 Eth1 Calico Plugin …
11. @projectcalico Project Calico is sponsored by Corollary: Other Advantages of the Calico Approach With Overlays Pure Layer 3 (Calico) Simplified Diagnostics. What is happening is “obvious” – traceroute, ping, etc., work as expected EXIT No on/off ramp required. Path from workload to non-virtual device or public internet (or even between data centers) is just a route Other IP techniques “just work”. E.g. Equal Cost Multi-Path (ECMP) & Anycast enable scalable resilience and full utilization of physical links
12. @projectcalico Project Calico is sponsored by Get Involved!  Main project website: www.projectcalico.org  Github  https://github.com/Metaswitch/ calico (and /calico-docker)  Mailing lists:  http://lists.projectcalico.org  Download & try it out  We welcome your feedback and contributions  Follow us @projectcalico
13. @projectcalico Project Calico is sponsored by Demo Time… Core 1 Policy Group 1 (“GROUP1”) L2 Policy Group 2 Core 2 Felix BIRD calico-node Container Felix BIRD calico-node Container Linux 172.17.8.101 Linux 172.17.8.102 Container B 192.168.1.2 Container A 192.168.1.1 Workloads Container C 192.168.1.3 Container E 192.168.1.5 Workloads Container D 192.168.1.4
14. @projectcalico Project Calico is sponsored by Demo Time… Core 1 Policy Group 1 (“GROUP1”) L2 Policy Group 2 Core 2 Linux 172.17.8.101 Linux 172.17.8.102 Felix BIRD calico-node Container Felix BIRD calico-node Container Container B 192.168.1.2 Container A 192.168.1.1 Workloads Container C 192.168.1.3 Container E 192.168.1.5 Workloads Container D 192.168.1.4
15. @projectcalico Project Calico is sponsored by Container B 192.168.1.2 Container A 192.168.1.1 Workloads Container C 192.168.1.3 Demo Time… Core 1 Policy Group 1 (“GROUP1”) L2 Policy Group 2 Core 2 Linux 172.17.8.101 Linux 172.17.8.102 Felix BIRD calico-node Container Felix BIRD calico-node Container Container E 192.168.1.5 Workloads Container D 192.168.1.4
16. @projectcalico Project Calico is sponsored by  Start Calico on each node  sudo ./calicoctl node --ip=172.17.8.101  Create some containers  docker run -e CALICO_IP=192.168.1.1 \ --name workload-A -tid busybox  Create Calico security groups and add the containers  ./calicoctl profile add PROF_A_C_E  ./calicoctl profile PROF_A_C_E member add workload-A Demo Time…
17. @projectcalico Project Calico is sponsored by Calico enables you to give your Docker containers real, routable IP addresses, with security/policy built-in TL;DR
18. @projectcalico Project Calico is sponsored by Get Involved!  Main project website: www.projectcalico.org  Github  https://github.com/Metaswitch/ calico (and /calico-docker)  Mailing lists:  http://lists.projectcalico.org  Download & try it out  We welcome your feedback and contributions  Follow us @projectcalico