Simple IP networking for clustered Docker containers
THE BRAINS OF THE NEW GLOBAL NETWORKCALICO ON COREOS - SIMPLE IPNETWORKING FOR CLUSTEREDDOCKER CONTAINERSNeil Jerram 10th March 2015Metaswitch Networks | Proprietary and confidential | © 2014 | 1
View Slide
Open source (Apache licensed) project Networking of workloads in a datacenter / cloud environment Sponsored by MetaswitchWHAT IS CALICO?Metaswitch Networks | Proprietary and confidential | © 2014 | 2SimpleScale OpenThousands of servers,100k’s of workloadsDon’t demand users tobe networking expertsOpen source and openstandards
VIRTUAL NETWORKING FOR CONTAINERSMetaswitch Networks | © 2015 | 3KernelNAT + Port MappingLinux BridgeContainer ContainerContainerKernelNAT + Port MappingLinux BridgeContainer ContainerContainer
Virtual L2 segments, implementedin software by virtual switchTHE STANDARD VIRTUAL NETWORKING MODELMetaswitch Networks | Proprietary and confidential | © 2014 | 4vSwitch vSwitch vSwitchLinux Linux LinuxEncap / de-encap(& flooding!)OuterMACOuterIPOuterUDPVXLANVMMACVMIPVMTCP/UDPVMDataRouterservicerequired tohop betweentenantsNAT requiredfor publicInternetaccessOn/off-ramprequired toget to NAS,etc.Virtual L2 segments, implementedin software by virtual switch
☹ Unnecessary complexity☹ Low scale limits☹ Performance issues☹ Management overhead☹ Inefficient resource utilization☹ Difficulty troubleshooting☹ Demands placed onapplication developers to benetworking expertsTHIS LEADS TO…Metaswitch Networks | Proprietary and confidential | © 2014 | 5ALL solutions that useoverlay / underlaymodel suffer fromthese effects, howeverthey are mitigated.These issues becomecritical withcontainers due to thehigher scale than VMs(100s vs 10s perserver)… It doesn’t have to be this way!
Metaswitch Networks | Proprietary and confidential | © 2014 | 6
WHAT IF WE BUILT A DATA CENTER LIKE THE INTERNET?Metaswitch Networks | Proprietary and confidential | © 2014 | 7IPAppIPAppIPAppIPAppIPAppIPAppIPAppIPAppRouterRouterRouterBGP BGPHosts
WHAT IF WE BUILT A DATA CENTER LIKE THE INTERNET?Metaswitch Networks | Proprietary and confidential | © 2014 | 8IPAppIPAppIPAppIPAppIPAppIPAppIPAppIPAppBGP BGP Compute NodeCompute NodeVMs / LXCsRouterRouterRouterVMs / LXCs
ADVANTAGES OF THE CALICO MODEL More scalable Based on proven Internet-stylearchitecture More efficient Simplified data path betweenVMs and physical network Equal Cost Multi-Path (ECMP)enables full utilization of physicallinks Easier to troubleshoot Eliminates nested IP stacksneeded for overlay-basednetworking More secure Applies traffic isolation rules atboth egress and ingress points More interoperable Supports direct connectivity betweenVMs, Linux Containers (LXCs) andphysical devices Does not require “On/Off ramps” fornon-virtualized network elements More robust Load-balancing and resilience easilyprovided by Anycast More straightforward 1:1 NAT and floating IPs are nolonger strict requirements More distributable Supports geographically distributedservice chains straightforwardlyMetaswitch Networks | Proprietary and confidential | © 2014 | 9
DEMO TIME…Metaswitch Networks | Proprietary and confidential | © 2014 | 10CoreOS Host 1Policy Group 1 (“Default”)L2Policy Group 2 (“Group_A”)CoreOS Host 2Container C192.168.1.3Container B192.168.1.2Container A192.168.1.1WorkloadsFelixBIRDCalicoControl Plane(‘node’container)Container E192.168.1.5Container D192.168.1.4WorkloadsFelixBIRDCalicoControl Plane(‘node’container)etcd, Powerstrip etcd, PowerstripPlugin.epPlugin.netCalicoOrchestrator(‘master’container)ACLManager
DEMO TIME…Metaswitch Networks | Proprietary and confidential | © 2014 | 11CoreOS Host 1Policy Group 1 (“Default”)L2Policy Group 2 (“Group_A”)CoreOS Host 2Container C192.168.1.3Container B192.168.1.2Container A192.168.1.1WorkloadsFelixBIRDCalicoControl Plane(‘node’container)Container E192.168.1.5Container D192.168.1.4WorkloadsFelixBIRDCalicoControl Plane(‘node’container)etcd, Powerstrip etcd, PowerstripPlugin.epPlugin.netCalicoOrchestrator(‘master’container)ACLManager
DEMOMetaswitch Networks | Proprietary and confidential | © 2014 | 12
GET INVOLVED Main project website:www.projectcalico.org Github https://github.com/Metaswitch/calico-docker Mailing list: http://lists.projectcalico.org/listinfo/calico Download & try it out We welcome yourfeedback and contributionsMetaswitch Networks | Proprietary and confidential | © 2014 | 13