Tech Talk by Gal Sagie: Kuryr - Connecting containers networking to OpenStack Neutron

Project Kuryr
Antoni Segura Puimedon
(apuimedo)
Gal Sagie (gsagie)

What are the problems?
 Reinventing networking abstractions
 Changing and vendor specific solutions
 Flannel
 Weave
 SocketPlane
 Overlay2
for VM nested containers
 Performance, latency, SLA, management penalties

New Solutions For Containers Networking

Compute Node
Nested Containers Overlay2
VM
BR-INT
BR-TUN
Docker0
Compute Node
VM
BR-INT
BR-TUN
Docker0
Flannel Overlay
Neutron Overlay

Kuryr Mission
Neutron as the production ready
networking abstraction containers
need!

Kuryr Solution
 Neutron as the production ready network abstraction
containers need
 Map container networking abstractions to the Neutron API
 Allow consumers to choose vendor keeping one high quality API free of
vendor lock-in
 Bring your container and VM networking together under one
API
 Implement all the common code for Neutron vendors allowing
them to get to container networking by just having a binding
script

Kuryr Solution
 Implement a common base for Neutron vendors that support
VM nested containers
 Avoid double encapsulation
 Manage each container port as a Neutron entity
 Planned support for OVN, MidoNet, Dragonflow and Calico
 Leverage Neutron advanced networking
 LBaaS, FWaaS, VPNaaS
 Security Groups / NAT

Kuryr In OpenStack – Bare metal
Controller Node
Neutron
Server
Kuryr
Service
Compute Node
Neutron agents
(Optional)

Kuryr In OpenStack – Nested deployment
Controller Node
Neutron
Server
Compute Node
Neutron agents
(Optional)
VM
Kuryr
Service

Kuryr Project Overview
 Open source
 Part of OpenStack Neutron's big stadium
 Brings the Neutron networking model as a provider for the
Docker CNM
 Aims to support different Container Orchestration Engines
 E.g. Kubernetes, Mesos, Docker Swarm
 Weekly IRC meetings
 Working together with OpenStack community
 Neutron, Magnum, Kolla

Kuryr Project Overview
 Multiple companies working on it

Kuryr Libnetwork Remote Driver
 Keeping up to date with the changing libnetwork remote driver API
 Maps Docker's CNM operations into a Neutron API usage
 Any Neutron plugin can use it (for example OVS)

Kuryr Generic VIF Binding Layer
 Binds the container networking namespace to the networking infra
 Common part (container side)
– IPAM
– vEth creation
 Executable based vendor-specific part
– Choice based on Neutron port type
– Free implementation language
– Root context

Deployment
 Package based
 Container based with Kolla
 Vendors must generate their downstream container with the necessary
agents and plugin
 Quick and easy deployment (Ansible based)

VM Nested Containers
 Leverage the same Neutron solution for tenant containers
networking
– Neutron features
– Easier management
– Same “implementation”
– Support containers networks and VM network isolation
– Neutron plugins already support this: OVN, Midonet,
Dragonflow
 Magnum
 Backend Implementations interoperability

Compute Node
Mixed OpenStack Environments – Nested Containers
VM
OVS / Midonet / Calico / Dragonflow
VM
Lightweight Tagging Layer
Neutron network 1
Neutron network 2
Neutron network 3

Neutron Side
 Port Forwarding
– Can be used to implement Docker port-mapping
– Save public IP space
 Adding Tags to Resources
– Pre allocation of ports/networks
– Mapping between Docker IDs to Neutron IDs
 VLAN Trunk API (Nested Ports)
– Formal Neutron API to define nested containers ports
 DNS Resolution for Port Names
– Leveraged for DNS service discovery

New Features for Containers
 Security Groups
 Subnet Pools
 NAT (SNAT / DNAT – Floating IP)
 Port Security (ARP Spoofing)
 QoS
 Quota Management
 Neutron pluggable IPAM
 Provide well-integrated COE Load balancing through Neutron
 FWaaS for Containers
 Many more as Neutron progress…

Kuryr Roadmap Plan
 Liberty Release
– Kuryr specs in Neutron/Magnum communities
– Neutron new features specs
– Docker Libnetwork remote driver
– Generic VIF binding layer
– Functional testing
– Configuration and authentication in Neutron
and Docker

Kuryr Roadmap Plan
 Mitaka Release
 Neutron IPAM for Docker
 Containerized Neutron plugins and solutions with Kolla
 Nested containers in VM’s, Magnum – Kuryr integration
 Functional testing
 Missing Neutron features
 Port forwarding – port mapping for Docker
 Neutron tags to resources – pre-allocating of network/ports/subnets
 DNS resolution for port names – Docker DNS discovery
 VLAN trunk API - used for nested containers

 N Release
 Neutron advance services (LBaaS, FWaaS VPNaaS)
 Kubernetes services to use Neutron LBaaS
 Kubernetes networking model (K8s API)
Kuryr Roadmap Plan

Join Us! Be the Kuryr!
 Project Launchpad
 https://launchpad.net/kuryr
 Project Git Repository
 https://github.com/openstack/kuryr
 Weekly IRC Meeting
 http://eavesdrop.openstack.org/#Kuryr_Project_Meeting
 IRC
 #openstack-neutron @ Freenode

Join Us! Be the Kuryr!
 Mailing List
 openstack-dev@lists.openstack.org ([Neutron][Kuryr])
 Trello Board
 https://trello.com/b/cbIAXrQ2/project-kuryr
 Documentation
 http://docs.openstack.org/developer/kuryr
 Getting Started Blog posts
 http://galsagie.github.io/sdn/openstack/docker/kuryr/neutron/2015/08/24/kury
r-part1/
 http://galsagie.github.io/sdn/openstack/docker/kuryr/neutron/2015/10/10/kury
r-ovn/

Tech Talk by Gal Sagie: Kuryr - Connecting containers networking to OpenStack Neutron

More Related Content

What's hot (20)

Similar to Tech Talk by Gal Sagie: Kuryr - Connecting containers networking to OpenStack Neutron (20)

More from nvirters (12)

Recently uploaded (20)

Tech Talk by Gal Sagie: Kuryr - Connecting containers networking to OpenStack Neutron