BRKCDN-1006: Building Scalable OpenStack based Clouds on Cisco Architectures

Transcription

1

2 BRKCDN-1006: Building Scalable OpenStack based Clouds on Cisco Architectures Ram Durairaj, Sr. Technical Leader Murali Raju, Product Manager

3 Agenda Background Technical Overview API Walk thru Services Insertion using Quantum APIs Q&A 3

4 Acknowledgement We would like to thank the entire team for their support, contribution and help in creating this session, particularly, Daneyon Hansen Edgar Magana Masum Hasan and Sumit Naiksatam for their content/slides contributions and reviews. 4

5 OpenStack: A Brief History NASA Launches Nebula One of the first cloud computing platforms built by the Federal Government for the Federal Government March 2010: Rackspace Open Sources Cloud Files software, aka Swift May 2010: NASA open sources compute software, aka Nova June 2010: OpenStack is formed July 2010: The inaugural Design Summit nebula.nasa.gov 5

6 OpenStack Community & and counting 6

7 OpenStack Vision Public Clouds Private Clouds Seamless Cloud Interoperability Community Clouds 7

8 Agenda Background Technical Overview API Walk thru Services Insertion using Quantum APIs Q&A 8

9 OpenStack Introduction A Cloud Operating System A collection of interrelated software components delivering capabilities to build and manage cloud infrastructure. A global community of developers devoted to innovation and openness Flexibility in deployment and features Standards for broad deployment No fear of vendor lock-in 9

10 OpenStack Terminology Instance- Running virtual machine Image- Non-running virtual machine, multiple formats (AMI, OVF, etc.) Application Programming Interface (API)- Interface for computer programs Message Queue- Acts as a hub for passing messages between daemons Volume- Provides persistent block storage to instances Project- aka Tenants, provides logical separation among cloud users Flavors- Pre-created bundles of compute resources Fixed IP- Associated to an instance on start-up, internal only Floating IP- Public facing IP address 10

11 OpenStack Core Projects OpenStack Compute (Nova) Software to provision virtual machines on commodity hardware at massive scale OpenStack Object Storage (Swift) Software to reliably store billions of objects distributed across commodity hardware OpenStack Image Service (Glance) Services for discovering, registering, and retrieving virtual machine images 11

12 OpenStack Core Projects Cont.. OpenStack Dashboard (Horizon) A self-service web portal to allow administrators and users to manage OpenStack resources OpenStack Identity (Keystone) Provides unified authentication across all OpenStack projects and integrates with 3 rd party authentication systems 12

13 OpenStack Incubation Projects OpenStack Network Information Management (Melange) Intended to provide centralized network information management OpenStack Network Service (Quantum) Provides network connectivity as a service between devices managed by other OpenStack services Many Other Community Projects 13

14 OpenStack Networking Options Flat Mode All Instances are attached to a single Linux bridge. IP s are injected into image on launch FlatDHCP Mode Similar to Flat Mode, but includes a DHCP server to manage instance IP s. Instances receive an IP through a dhcpdiscover message VLAN Network Mode (Default Mode) A VLAN, Fixed IP Subnet, and Linux bridge per tenant. Switch must support 802.1Q VLAN tagging Quantum Network Manager A peer OpenStack service providing network connectivity services 14

15 OpenStack VLAN Networking Details OpenStack Compute OpenStack Instance i.e. eth0 Instance vnic i.e. vnet0 Virtual Port --vlan_interface= Physical Interface i.e. vlan 100 Virtual Interface virbr0 dnsmasq Hypervisor bridge-utils Linux Bridge 1 bridge, VLAN, Subnet per tenant iptables Libvirt-bin Libvirt bridge-nf ebtables nova-network 15

16 Cloud Platforms and Network APIs Networking is only used for connectivity. Cloud APIs are being standardized using a very simplistic network model Compute Service (VMs, Memory, Local Disk) Developer API Storage Service (Block, Massive Keyvalue store) Basic Network Connectivity User and System Admin Servers Disks Accounts 16

17 OpenStack and Cisco s contribution Quantum: Network-as-a-Service As a peer to compute and storage Compute Service (VMs, Memory, Local Disk) Developer API Storage Service (Block, Massive Key-value store) Network Service (Virtual Networks, Services) Servers Disks Networks Rich set of Network Connectivity and Features 17

18 Quantum Architecture Quantum API API Extensions Quantum Service L2 network abstraction definition and management Device and service attachment framework Does NOT implement any abstractions Quantum Plug-in API Vendor/User Plug-In Maps abstraction to implementation on physical network Makes all decisions about *how* a network is implemented Can provide additional features through API extensions 18

19 Agenda Background Technical Overview API Walk thru Services Insertion using Quantum APIs Q&A 19

20 Cisco Plugin s for Quantum Quantum API Quantum Service Quantum Plug-in API Cisco Cloud Networking Plug-In API Extensions NX-OS, UCS, Cisco Network Services Manager, VXLAN, Cisco Infrastructure Products Unified Fabric Unified Network Services Unified Computing 20

21 Software Architecture Nova API calls Nova- API Queue (RabbitMQ) Nova- Scheduler Compute controller (Nova) Nova- Network DB MySQL) Quantum API calls Quantum Manager Network controller (Quantum) Quantum -API Quantum -Plugin A user can interface with the Quantum directly Or via a Quantum Client/Proxy (Quantum Manager) interfaced with Nova-Network Compute Node 1 Nova- Compute User VM 1 User VM 2 Request to launch a Server in Nova may result in call to Quantum to provision and connect Server to network 21

22 Quantum Abstractions Quantum provides abstractions and relevant functions and interfaces (API) for CRUD of Virtual Network (VN) SW 11 Virtual port (VPT) on a VN ETH1 VN-Blue-E1 VN-Red-E2 Hypervisor Attachment of a virtual interface (VIF) of a virtual server (VM) to VPT, thus connecting the VM to the network veth1 vnic1 OS WS1 veth2 vnic2 OS App veth3 vnic3 OS WS2 veth4 vnic4 OS App VM1 VM2 VM3 VM42 22

23 Quantum Abstractions Via the CRUD API a A VM can be dynamically Taken On or off network Moved from one port to another changing on-demand VLAN SW 11 ETH1 VN-Blue-E1 VN-Red-E2 Hypervisor QoS veth1 veth2 veth3 veth4 Network access (for example private to public) vnic1 OS vnic2 OS vnic3 OS vnic4 OS WS1 App WS2 App VM1 VM2 VM3 VM42 23

24 Realization of Quantum Abstractions Virtual network can be realized via (or mapped to) Linux Bridge VLAN Linux Bridge + VLAN Any network configuration via Plug-in SW 11 ETH1 VN-Blue-E1 VN-Red-E2 Hypervisor veth1 veth2 veth3 veth4 Virtual port mapped to Linux TAP/TUN vnic1 OS WS1 VM1 vnic2 OS App VM2 vnic3 OS WS2 VM3 vnic4 OS App VM42 TAP: L2 virtual port, TUN: L3 tunnel veth in VM-FEX environment 24

25 Plugin Create Network/Port and attachment are abstract APIs These abstractions can be mapped to multiple network technologies Any technology or vendor specific networking features/capabilities can be interfaced/integrated via Quantum Plug-in mechanism 25

26 Turn-key OpenStack offering Best practices and whitepapers have been developed Cisco s Quantum contribution available for download from OpenStack.org Current Software Development Quantum L3 service for Essex release (April 2012) Expand Cisco-specific drivers (NX-OS, UCS, Palo) Stabilize OpenStack Core Projects Cisco Intelligent Automation for Cloud integration (demo available) 26

27 Cisco s contribution to Quantum VIC/802.1qbh Driver UCS/VIC (Palo) Quantum API server Cisco Plug-in NX-OS driver NX-OS Fabric RestFul API: CRUD operations 1. create-network 2. create-port 3. attach-port API Cisco Extensions Port Profiles, Qos Policies Plug-In Drivers UCSM using XML/APIs NX-OS resident Policy Agent APIs or NX-OS XML APIs ( based on availability) Use Case Driven Development Openstack-Compute refactoring 27

28 Cisco s contribution to Quantum Quantum Logical Abstractions Realization of logical model, generic + extensions L2 Network Plugin Segmentation ID Manager VLAN Manager Mapping of logical model to underlying physical topology and network technology; global network view L2 Network Model L2 Device Inventory Static Configuration Discovered Configuration Technology-specific; acts on one device per call; local view UCS Plugin Device-specific Plugins Nexus Plugin Per device type, e.g. UCS Inventory Nexus Inventory Device-interaction-transportspecific; e.g. sending NETCONF commands UCSM Driver Device-specific Drivers Nexus Driver * Pluggable modules via configuration files * Modules external to Quantum 28

29 Sequence of Operations Device- Device- Driver Device- Driver Driver L2-Network- Plugin 8 Core & Extended API: create_network() create_port() create_portprofile() L2-Network-Model Core & Extended API: create_network() create_port() create_portprofile() Return: Device IP + Context Core & Extended API: create_network(device_ip, context) 4 create_port(device_ip, context) create_portprofile(device_ip, context) Return: Success/failure, other information relevant to that plugin Device drivers: XML-API based UCSM driver, and NetConf based Nexus Driver 2 L2-Device Inventory L2-Device Inventory L2-Device Inventory L2-Device-Plugin L2-Device-Plugin L2-Device-Plugin

30 Cisco s Quantum Plug-in UCS/VIC support SAN LAN MGMT SAN G G G Fabric A Switch G G Fabric R Extender I S S Compute Chassis C Uplink Internal Fabric C G Fabric A Switch G G G G Fabric I R Extender UCS 6100 Series Fabric Interconnect UCS 5100 Series Blade Server Chassis UCS 2100 Series Fabric Extender Active/Standby per vnic Active Path M Adapter BMC P Adapter BMC P Adapter Mezzanine Palo Adaptors M81KR Host visible vnic/vhba X X x86 Computer Compute Blade (Half slot) X X X x86 Computer X Compute Blade (Full slot) UCS B-Series Blade Servers 30

31 Port-Profile Virtual Network port-profile type vethernet VN-1 IaaS Admin Enterprise E1 Site 1 VN-1 (mapped to) VLAN 15, VN-1-QoS vmware port-group switchport mode access switchport access vlan 15 CRUD Requests SW 11 Cloud Provider s DC 1 service-policy type qos input VN-1-QoS service-policy type qos output VN-1- QoS no shutdown state enabled OpenStack/ Quantum VSM (NX-OS) veth1 ETH1 VN-Blue-E1 VN-Red-E2 Nexus 1Kv VEM veth2 veth3 Hypervisor veth4 ip access-list ACL-1 permit ip any any class-map type qos match-all CL-1 match access-group name ACL-1 vnic1 vnic2 vnic3 vnic4 policy-map type qos VN-1-QoS OS WS1 VM1 OS App VM2 OS WS2 VM3 OS App VM42 class CL-1 set dscp cs7 31

32 VM-FEX IaaS Admin Enterprise E1 Site 1 VM-FEX instances (vnic) and associated veth (on Fabric Interconnect or 5K) created automatically port-profile type vethernet VM-App-E1 vmware port-group switchport mode access switchport access vlan 15 Cloud Provider s DC 1 service-policy type qos input E1-QoS-PL-1 SW 11 FI (6100) veth1 veth3 veth2 veth4 VLAN 15 service-policy type qos output E1-QoS-PL-1 no shutdown state enabled vnic1 vnic3 OpenStack/ Quantum UCSM vnic2 vnic4 N1Kv VEM Hypervisor 802.1qbh ip access-list E1-ACL-1 permit ip any any class-map type qos match-all E1-QoS-1 match access-group name E1-ACL-1 OS OS OS OS policy-map type qos E1-QoS-PL-1 App VM1 App VM2 App VM3 App VM42 class E1-QoS-CL-1 set dscp cs7 32

33 Cisco s Quantum Plugin NX OS Driver Part 1 (Quantum Service & Network Creation) Quantum service invokes Cisco Plugin Cisco Plugin invokes Cisco NX-OS Driver (Sub-Plugin) NX-OS driver creates a VLAN using the same ID that the one for UCSM NX-OS driver sets-up the VLAN parameters NX-OS driver sets-ups the ports associated to the UCS (Static Network Topology) Cisco Plugin calls UCS driver to create the port, profile and makes a cluster association 33

34 Cisco s Quantum Plugin NX OS Driver NX-OS driver maps the QoS configuration between the UCS and NX-OS. NX-OS dirver configures the QoS parameters for the VLAN associated. (VLAN Level) Part 2 (Nova Compute spawns VM) Nova compute creates Palo-specific libvirt configuration for VM by invoking appropriate Quantum Client APIs VM is spawned VM has connectivity on the network created earlier 34

35 Quantum L2 API POST /networks.json POST /networks/<network id>/ports.json PUT /networks/<network id>/ports/<port id>/attachment.json GET /tenants/tenant-id/networks Create virtual network (json indicates body will be in JSON) In body: { "network": { "name :." } } Returns <network id> Create a virtual port on specified network (<network id> Returns <port id> Attaches the VIF (of VM) to specified network and port List all networks of a tenant GET /tenants/tenant-id/networks/detail GET /tenants/tenant-id/networks/network-id GET /tenants/tenant-id/networks/network-id/detail PUT /tenants/tenant-id/networks/network-id Rename a network In body: { "network : { "name":. }} DELETE /tenants/tenant-id/networks/network-id Similarly for port and attachment For Further Reference: 35

36 Quantum & L3 Quantum today Only L2; Nova currently handles some L3 constructs but this is not desirable What do we need? Why? Extend Quantum to support L3 constructs in addition to available L2 constructs Introduce Subnets and abstracted Routing constructs Enable: Intra-tenant routing (multi-tier topologies), Public-Private, Private-Public, VPN, L3 Services (Load-balancer, Firewall, Caching, etc.), Hybrid Cloud, Network Containers 36

37 The Big Picture 37

38 Quantum L3 (tenant) Model ( Proposed) Tenant Tenant VM Tenant VM VM Create Project/Tenant Create Legend: New resources proposed for the L3 model in Quantum Plug L2 L2 Network L2 Network Map L3 L3 L3 Subnet Subnet Create Routes Route-table Associate Targets Target Tenant owned network resources VPN Gateway (Target) Internet Gateway Other Services Tenant VM ID, IP Addr VM ID, IP Addr SP resources created for tenant Target Entities Tenant resources 3 rd Party Resources VPN VPN VPN Public Network SP-Local Network SP managed infrastructure Note: This is proposed and Under active discussions in Openstack community. Model and APIs are subject to change 38

39 Quantum L3 : Usecase 1 (one Private Subnet) Source Destination Target Subnet-A My VPN Gateway * Application Private Subnet (ID: Subnet- A) /24 Application *Refers to the ID of a target resource created by the tenant with the following call: create_target(tenantid, name= My VPN Gateway, type_id= VPN 1, protocol= IPSec, version= 1 ) Note: This is proposed and Under active discussions in Openstack community. Model and APIs are subject to change 39

40 Quantum L3 : Usecase 2 (Public/Private Subnets) Source Destination Target Subnet-A /24 Subnet-B Subnet-B /24 Subnet-A Subnet-A My Internet Gateway Subnet-B My VPN Gateway Public Subnet (ID: Subnet-A) /24 Private Subnet (ID: Subnet-B) /24 Web Server (FIP) Web Server (FIP) DB Server DB Server

41 Quantum L3 : Usecase 3 (Public/2 Private Subnets) Source Destination Target Subnet-A /24 Subnet-B Public Subnet (ID: Subnet-A) /24 Subnet-B /24 Subnet-C Subnet-A My Internet Gateway * Web Server (FIP) Web Server (FIP) *Refers to the ID of a target resource created by the tenant with the following call: create_target(tenantid, name= My Internet Gateway, type_id= Public ) Private Subnet (ID: Subnet-B) /24 Private Subnet (ID: Subnet-C) /24 App Server DB Server DB Server App Server

42 Agenda Background Technical Overview Quantum API Walk thru Services Insertion using Quantum APIs Q&A 42

43 Network Services Insertion It defines the way services will be inserted in the network, and the necessary configuration steps to maintain them up and running along all possible changes on the customers cloud infrastructure 43

44 Network Services Types 1. Single Side Services: Just require one service instance to provide the service and they are mostly deployed at the application server side of the network 2. Symmetric Services: Require one server instance running at each side of the edge routers of the network, one for the client side and one for the server application Network Services Insertion Modes Server Gateway Server Gateway Service Service / Service Clusters In-Path Insertion Out-of- Path Insertion (Redirection) 44

45 Network Services Insertion Model 1. Network Templates Orchestration Building the entire network and all the required components based on templates designed for certain services or a combination of them. 2. On Demand As Dynamic Virtual Machines (VMs) Network services are provided on-demand by Cloud Service Providers and Third party entities through Network APIs (Quantum) 45

46 Network Services Insertion - On Demand Model 1. Cloud Service Providers (CSPs) deploy and administrate services 46

47 Network Services Insertion - On Demand Model 2. Tenants deploy and administrate services 47

48 Network Services Insertion - On Demand Model 3. Cloud Service Providers deploy and maintain services but tenants administrate their functionality 48

49 Use Case 1: Single In-Path Service Insertion create_network (tenant_id, net_name) network-x create_network (tenant_id, net_name) network-y create_multiport (net_id, number_ports, tenant_id) Firewall Creates the new networks and necessary ports euca-run-instances (Firewall) euca-run-instances (Tenant VMs) Instantiate both services from VM images plug_iface (tenent_id, net_id, port_id) From FW to Net-X plug_iface (tenent_id, net_id, port_id) From FW to Net-Y plug_iface (tenent_id, net_id, port_id) From Net-Y to VMs plug_iface (tenent_id, net_id, port_id) From Net-X to GW Re-connects Network X and V as well as the new services 49

50 Use Case 2: Multiple In-Path Services Insertion 50

51 Use Case 2: Multiple In-Path Services Insertion create_network (net_name, tenant_id) network-g create_network (net_name, tenant_id) network-f create_multiport (net_id, number_ports, tenant_id) Firewall create_multiport (net_id, number_ports, tenant_id) Wan Opt Creates the new networks and necessary ports unplug_iface (tenent_id, net_id, port_id) network-x unplug_iface (tenent_id, net_id, port_id) network-v Unplugging interfaces between the GW and Network X and V euca-run-instances (Firewall) euca-run-instances (Wan Opt) Instantiate both services from VM images 51

52 Use Case 2: Multiple In-Path Services Insertion plug_iface (tenent_id, net_id, port_id) From Net-V to FW plug_iface (tenent_id, net_id, port_id) From Net-F to FW plug_iface (tenent_id, net_id, port_id) From Net-G to FW plug_iface (tenent_id, net_id, port_id) From Net-X to Web Opt plug_iface (tenent_id, net_id, port_id) From Wan Opt to Net-F plug_iface (tenent_id, net_id, port_id) From Net-G to GW Re-connects Network X and V as well as the new services Management Best Practices: create_network (net_name, tenant_id) management-network create_multiport (net_id, number_ports, tenant_id) plug_iface (tenent_id, net_id, port_id) Firewall plug_iface (tenent_id, net_id, port_id) Web Opt 52

53 Services Insertion Utility 53

54 Service Insertion Utility insert_inpath_service <tenant_id> <service_image_id> <management_net_name> <northbound_net_name> <southbound_net_name> delete_service <tenant_id> <service_instance_id> connect_vm <tenant_id> <vm_image_id> <service_instance_id> disconnect_vm <vm_instance_id> Reference: 54

55 Questions? 55

56 Complete Your Online Session Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Passport points for each session evaluation you complete. Complete your session evaluation online now (open a browser through our wireless network to access our portal) or visit one of the Internet stations throughout the Convention Center. Don t forget to activate your Cisco Live Virtual account for access to all session material, communities, and on-demand and live activities throughout the year. Activate your account at the Cisco booth in the World of Solutions or visit 56

57 Final Thoughts Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042 Come see demos of many key solutions and products in the main Cisco booth 2924 Visit after the event for updated PDFs, ondemand session videos, networking, and more! Follow Cisco Live! using social media: Facebook: Twitter: LinkedIn Group: 57

58

59 Backup Slides

60 OpenStack Authentication Architecture OpenStack Nova nova-api (EC2, OS, Admin) Swift object-api Glance glance-api Keystone Service & Admin API s identity token Catalog Policy Service Backends (KVS, SQL, PAM, Templated) 60

61 OpenStack Image Service Architecture OpenStack Swift Nova object-api Keystone nova-api (EC2, OS, Admin) Service API Glance Glance API Server (glace-api) SQL Registry Server Store Adapter S3 Store HTTP Store Swift Store Filesystem Store 61

62 OpenStack Compute Architecture OpenStack Users Nova nova-api (EC2, OS, Admin) Scheduler (nova-scheduler) Message Queue (RabbitMQ) Compute Worker(s) (nova-compute) Network Controller(s) (nova-network) Volume Worker(s) (nova-volume) Data Store Computer Programs glance-api object-api Service API Glance Swift Keystone 62

63 OpenStack Software Architecture OpenStack Other OpenStack Projects project-api Nova nova-api (EC2, OS, Admin) Glance glance-api object-api Swift 63

64 OpenStack Software Architecture OpenStack Other OpenStack Projects project-api Nova nova-api (EC2, OS, Admin) Glance glance-api object-api Swift 64

65 OpenStack Software Architecture OpenStack Other OpenStack Projects project-api Nova nova-api (EC2, OS, Admin) Glance glance-api object-api Swift 65

66 OpenStack Software Architecture OpenStack Other OpenStack Projects project-api Nova nova-api (EC2, OS, Admin) Glance glance-api object-api Swift 66