OpenStack Networking
36 likes9,357 views
The document discusses OpenStack, an open-source cloud computing platform for building scalable private and public clouds. It covers networking components, including Nova Network and Quantum (now OpenStack Networking), various management solutions, and features like load balancing as a service. The document emphasizes the need for a more flexible and programmable networking architecture to support complex, multi-tenant environments.
OpenStack Networking
- 2. ● What is OpenStack ● Nova network ● (Quantum) OpenStack Networking ● Open vSwitch ● Load balancing as a service Agenda
- 3. ● Open source system for building scalable private and public clouds ● Launched in 2010 by NASA and Rackspace, now 150+ companies, >9000 people, 87 countries ● A collection of “cloud services” ● Each service includes: ○ A tenant-facing API that exposes logical abstractions for consuming the service. ○ One or more backend implementations of that API What is OpenStack?
- 4. ● What is OpenStack ● Nova network ● (Quantum) OpenStack Networking ● Open vSwitch ● Load balancing as a service Agenda
- 5. Very easy to configure Different managers (network providers): ● FlatManager ● FlatDHCPManager ● VlanManager Nova Network
- 6. ● Network bridge ● 'dnsmasq' DHCP server ● Bridge as default gw Limitations: ● Single L2 domain and ARP space, no tenant isolation ● Single IP pool Flat Network
- 8. ● Network bridge ● Vlan interface over physical interface Limitations: ● Scaling limit in 4k vlan tags ● Vlans are configured manually on switch by admin ● May have issues with overlapping MACs Vlan Network
- 10. ● Networking is too tied to Nova ● Two Key Problems: 1: Limited technology 2: Tenants want to replicate rich enterprise network topologies Why new module? VLANs are Great! - Stone Age Man
- 11. Issues: ● VLANs is the only way of doing multi-tenancy ● Only Linux bridge supported (no ACLs, QoS, monitoring) ● Network controller is single point of failure Solution: ● Software-defined Networking (SDN) / OpenFlow ● Overlay tunneling: VXLAN, NVGRE, STT ● Fabric solutions: FabricPath, Qfabric, etc. ● Pluggable mechanism via common API to enable different vendor technologies Limited technologies
- 12. Issues: ● No way to control topology nor create “multi-tier” networks ● No control over IP addressing ● No way to insert own services (e.g. firewall, IPS) Solution: ● API for managing multiple private networks, IP addressing ● API extensions to control: security policies, quality-of-service, monitoring ● Service plugins such as firewall, intrusion detection, VPN Tenants want control
- 13. OpenStack Modules .. before Compute Storage Network Nova Swift (Objects) Glance (Images) *-as-a-Service Capability OpenStack Service Cinder (Block) Identity Keystone
- 14. OpenStack Modules .. now Compute Storage Network Nova Swift (Objects) Glance (Images) *-as-a-Service Capability OpenStack Service Quantum Cinder (Block) Identity Keystone
- 15. ● What is OpenStack ● Nova network ● (Quantum) OpenStack Networking ● Open vSwitch ● Load balancing as a service Agenda
- 16. ● API to build rich networking topologies ● Extensible via plugins (may support virtual networks, hardware or mixed) ● More capabilities (QoS, security groups) ● Platform for services (LBaaS, FWaaS, etc) Welcome Quantum*! * urgently renamed to OpenStack Networking due to trademark violation
- 17. Quantum Architecture Core REST API Extension REST API Extension REST API AuthN/AuthZ Core Plugin (vendor-specific) DB agent Service Plugin DB agent Core Plugin Interface Service Plugin Interface
- 18. Network Node quantum-l3-agent quantum-dhcp-agent quantum-*plugin-agent quantum-metadata-agent quantum-lbaas-agent Compute Node quantum-*plugin-agent nova-compute Cloud Controller nova-api nova-scheduler keystone quantum-server rabbotmq mysql Compute Node quantum-*plugin-agent nova-compute Compute Node quantum-*plugin-agent nova-compute data network management network Quantum Deployment external network Internet
- 19. Core API objects ● Port - a point of attachment to network ● Network - isolated L2 network segment ● Subnet - associates a block of IP addresses with network L3 extension objects ● Router - gateway between networks ● Floating IP - static mapping from public IP in external network to private IP in local Quantum Objects
- 20. Quantum Object Relations port network subnet floating ip router VM L3 L2
- 21. ● Big Switch Networks ● Brocade ● Cisco ● Hyper-V ● Linux Bridge ● Meta Plugin Core Plugins ● Midokura Midonet ● NEC OpenFlow ● Nicira NVP ● Open vSwitch ● PLUMgrid ● Ryu OpenFlow
- 22. ● Programmable packet forwarding and network topology configuration ● An external ‘controller’ component sets up flows and/or topologies for network traffic ● Particularly suitable for virtual networking in massively scalable environments Software Defined Networks
- 23. ● What is OpenStack ● Nova network ● (Quantum) OpenStack Networking ● Open vSwitch ● Load balancing as a service Agenda
- 24. ● Open source programmable virtual switch ● Supports OpenFlow, 802.1Q VLANs, LACP, STP ● Supports KVM and Xen ● OVS is the basis for different SDN/network virtualization platforms ● Flexible controller in user-space ● Fast datapath in kernel Open vSwitch
- 25. ● Port may have more than one interface ● IEEE 802.1Q support attaching VLAN tags to interfaces ● Packets are forwarded by flow ● Fine-grained ACLs and QoS (L2-L4 matching, actions) ● Centralized control via OpenFlow ● Works on Xen, KVM, VirtualBox Open vSwitch Concepts
- 26. Open vSwitch Tools ovs-vswitchd - daemon that implements a switch with help of kernel module ovsdb-server - database server ovs-vsctl - utility for working with the configuration ovs-appctl - tool for controlling Open vSwitch daemon ovs-dpctl - datapath management utility ovs-controller - simple OpenFlow controller ovs-ofctl - OpenFlow switch management utility ovs-pki - utility for managing public-key infrastructure
- 27. Example: logical view VM1 10.0.0.3 VM2 10.0.0.4 VM3 12.0.0.3 VM4 12.0.0.4 Tenant A router 10.0.0.1 30.0.0.2 Tenant B router 12.0.0.1 30.0.0.3 Tenant A Tenant B External router Internet
- 28. Example: physical view VM1 10.0.0.3 VM3 12.0.0.3 VM2 10.0.0.4 VM4 12.0.0.4 Compute Node 1 Compute Node 2 br-intbr-int eth1eth0 eth1eth0 mgmt network data network br-ex br-ex
- 29. Let's Start (with example)! We have: ● tenant A and network (10.0.0.0/24) ● router that wires private network with external ● DCHP enabled (quantum port is create) Commands we need: ● brctl show - to show all bridges ● ovs-vsctl show - to show all interfaces ● ip netns exec - to show contents of namespace ● quantum port-list, quantum net-list
- 30. ovs-vsctl show Bridge br-int Port "qr-9b80a882-55" tag: 1 Interface "qr-9b80a882-55" type: internal Port "tap66a249f1-bf" tag: 1 Interface "tap66a249f1-bf" type: internal Port br-int Interface br-int type: internal Bridge br-ex Port "qg-e41c368d-a8" Interface "qg-e41c368d-a8" type: internal Port br-ex Interface br-ex type: internal internal interface of router port of DHCP server external interface of router
- 31. brctl show bridge name bridge id STP enabled interfaces br-ex 0000.6eed69b21a4b no qg-e41c368d-a8 br-int 0000.f68d58076046 no qr-9b80a882-55 tap66a249f1-bf
- 32. Let's Rock! Expand the configuration: ● Launch VM in tenant A (10.0.0.3) ● Create network for tenant B (12.0.0.0/24) with DHCP enabled (12.0.0.2) but without router ● Launch VM in tenant B (12.0.0.3)
- 33. logical view VM1 10.0.0.3 VM3 12.0.0.3 Tenant A router 10.0.0.1 172.18.7.3 Tenant A Tenant B External router Internet
- 34. ovs-vsctl show Bridge br-int Port "qvo8b0b577a-2c" tag: 1 Interface "qvo8b0b577a-2c" Port "qr-9b80a882-55" tag: 1 Interface "qr-9b80a882-55" type: internal Port "tap66a249f1-bf" tag: 1 Interface "tap66a249f1-bf" type: internal Port "qvo4a744a65-92" tag: 2 Interface "qvo4a744a65-92" Port "tap3aa4a560-d2" tag: 2 Interface "tap3aa4a560-d2" type: internal Port br-int Interface br-int type: internal interface for VM in tenant A interface for VM in tenant B interface of DHCP server in tenant B
- 35. physical view VM 10.0.0.3 VM 12.0.0.3 Compute Node 1 eth0 br-ex DHCP 10.0.0.2 DHCP 12.0.0.2 Router 10.0.0.1 br-int
- 36. brctl show bridge name bridge id STP enabled interfaces br-ex 0000.6eed69b21a4b no qg-e41c368d-a8 br-int 0000.f68d58076046 no qr-9b80a882-55 qvo4a744a65-92 qvo8b0b577a-2c tap3aa4a560-d2 tap66a249f1-bf qbr4a744a65-92 8000.7a95a8a2b9bd no qvb4a744a65-92 tap4a744a65-92 qbr8b0b577a-2c 8000.de84d986f61e no qvb8b0b577a-2c tap8b0b577a-2c one bridge for VM (created by VIF driver in Nova)
- 37. ip netns List of namespaces. There's one namespace per DHCP port and per router port qdhcp-9a7e9331-2508-4615-889b-b99a6f260eef qdhcp-1b2101e0-cefa-4347-a581-e1f1f02215a1 qrouter-0e0e2e6e-a60b-4808-b914-8f45cae02b2e qdhcp-9a7e... qdhcp-1b21... qrouter-0e0e... 12.0.0.2 10.0.0.2 10.0.0.1 172.18.7.3
- 38. ip netns exec <> ifconfig Show interfaces for namespace associated with router qg-e41c368d-a8 Link encap:Ethernet HWaddr fa:16:3e:27:a1:85 inet addr:172.18.7.3 Bcast:172.18.76.135 Mask:255.255.255.248 inet6 addr: fe80::f816:3eff:fe27:a185/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:60 errors:0 dropped:0 overruns:0 frame:0 TX packets:69 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:6608 (6.6 KB) TX bytes:5298 (5.2 KB) qr-9b80a882-55 Link encap:Ethernet HWaddr fa:16:3e:9e:ed:50 inet addr:10.0.0.1 Bcast:10.0.0.255 Mask:255.255.255.0 inet6 addr: fe80::f816:3eff:fe9e:ed50/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:18878 errors:0 dropped:0 overruns:0 frame:0 TX packets:3958 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:3269696 (3.2 MB) TX bytes:349880 (349.8 KB)
- 39. ● What is OpenStack ● Nova network ● (Quantum) OpenStack Networking ● Open vSwitch ● Load balancing as a service Agenda
- 40. ● Unified API for load balancing ● Features: ○ LB between services on VMs ○ configurable LB methods (e.g. round-robin) ○ session persistence ○ health monitoring (TCP, HTTP) ● Reference implementation based on HAProxy Load Balancing as a Service
- 41. LBaaS Architecture Plugin Agent HAProxy process RPC REST API DB Extension python-quantumclient Horizon Quantum
- 42. Pool LBaaS Model Member Member VM A 10.0.0.4:80 VM B 10.0.0.5:80 Vip (10.0.0.10:80) Health Monitor Subnet Subnet
- 43. LBaaS Wiring VM A Load Balancer Router 10.0.0.1010.0.0.4 VM B 10.0.0.5 External Traffic Internal Trafficfloating ip 172.0.0.10
- 44. 1. Create pool 2. Create members (1 per VM / service) 3. Create vip for the pool 4. (opt.) Create health monitor and associate with Pool LBaaS Workflow
- 45. LBaaS UI
- 46. Havana Release: ● More services: firewall-as-a-service, vpn-as-a- service ● Multi-host DHCP agent (analog to Nova) ● IPv6 support for L3 services Provide API for every service in the network! Future of OpenStack Networking
- 47. Q&A