OpenStack Network Design using Cisco Solutions Shannon McFarland CCIE #5245 Principal

Transcription

1

2 OpenStack Network Design using Cisco Solutions Shannon McFarland CCIE #5245 Principal

3 Other Sessions Getting Started with OpenStack (DEVNET-1101) OpenStack Enabling DevOps (DEVNET-1104) OpenStack and OpenDaylight (DEVNET-1105) TECACI ACI The Policy Driven Data Centre

4 Agenda Introduction to OpenStack OpenStack Participation OpenStack Deployment Summary OpenStack Networking Cisco Integration into Neutron Advanced Neutron Considerations Conclusion

5 Introduction to OpenStack

6 OpenStack is a collection of open source technologies delivering a massively scalable cloud operating system - openstack.org

7 OpenStack Projects Compute (Nova) Dashboard (Horizon) Database (Trove) Network (Neutron) Image (Glance) Orchestration (Heat) Object Storage (Swift) Identity (KeyStone) Data Processing (Sahara) Block Storage (Cinder) Telemetry (Ceilometer) Deployment (Triple O) Bare Metal (Ironic) DNS (Designate) Application Catalog (Murano) Containers (Magnum) Key Management (Barbican) Policy (Congress) File System (Manila) Messaging (Zaqar).

8 OpenStack Participation

9 Why Does OpenStack Matter? Choice There is no one-size fits all option for cloud computing There is no single vendor who can fill all needs of a cloud stack You will likely engage with multiple partners Community Open Source Community driven Individual, organisational Better time-to-market and faster feature velocity Commercialisation Start with the baseline OpenStack components Vendor opportunities for value-add integration on top of OpenStack baseline Design, deployment, automation, operation, high-availability, applications, etc

10 Cisco and OpenStack Code contributions across several services Network. Compute, Dashboard, Storage, Containers Incubating new OpenStack related Projects GBP, PlaceWise, AVOS, VMTP Community Participation Engineering Neutron/Cinder/Ironic Plugins/Drivers for Cisco infrastructure Nexus, APIC, CSR1K, ASR1K, UCS Cisco Applications on OpenStack OpenStack based Global Intercloud hosted across Cisco and partners data centres Metapod (Formerly MetaCloud) Cloud Services Partners/ Customers Cisco Validated Designs, UCSO Work closely and jointly with customers to design and build OpenStack environment

11 Kilo and Liberty release contributions lead by Cisco New resources for Neutron PCI Passthrough and Nova Flavor Heat template improvements Archive Policy per metric level Heat Gnocchi Kolla Containers - Ceilometer, Mongo, Neutron Container Sets - database-control, messaging-control, service-control, compute-control, computeoperation-nova Transport Layer Security Sub-ordinate certificate feature Kafka Publisher Alarms severity Network services notification plugin Barbican Metering Kilo + Liberty release Magnum Neutron Kubernetes plugin Python API for k8s CLI Container Networking Model Multiple IPv6 prefixes, IPv6 PD IPv6 router support VLAN trunking UCSM, Nexus driver ASR1000 driver CSR1Kv VPN driver Neutron IPv6 and L3 plugin support Devstack Horizon Curvature panel Ceph panel

12 OpenStack Deployment Summary

13 Common Enterprise Use Cases OpenStack, at least today, is targeted at modern day cloud native applications Sandbox environments A place to research, learn and test CI/CD processes PoC web applications along with practicing the new DevOps methodology A place to learn the whole cloud deployment framework, document, train, move to production Development environments Using the lessons learned in the sandbox phase: Build Dev, QA and production environments Apply CI/CD processes Slow-role Web application deployment either on standard OpenStack or in conjunction with a PaaS deployment Data Processing environments Big Data clusters, etc.. Training systems Cheap and fast to build and tear down for each class Revenue generating applications Vertical applications

14 Telco s are Turning to OpenStack for NFV DNS EPC Resource Allocation & Optimisation Resource Isolation Networking WAN orchestration VNF provisioning CDN Real Time Response Interrupt servicing OVS latency NEUTRON API OS NETWORK FRAMEWORK PLUGIN PLUGIN NETWORK DPI NFV Applications OS COMPUTE FRAMEWORK ESXi NOVA API Linux COMPUTE Carrier Grade NAT Enterprise Applications SWIFT API PLUGIN Cloud Manager CINDER API OS STORAGE FRAMEWORK PLUGIN STORAGE GLANCE API PLUGIN PE Router Application Domain OSS KEYSTONE API OS KEYSTONE FRAMEWORK PLUGIN IDAM Ceilometer High Availability Mitigation of failures Fault monitoring and heath check Session Border Controller Support functions WAN Acceleration Carrier Grade Security Multi-tenancy with end-to-end isolation Software Management and Upgrade Support Hitless & automated upgrades Backup and Restore Automatic backup Audit and Trouble Shooting Audit log, monitor Assurance: Firewall

15 All-in-One (AIO) Getting Started AIO Controller/Compute/ Storage AIO Controller AIO Controller AIO Controller: - MySQL, MariaDB, etc - RabbitMQ, Qpid, etc.. - API Endpoints: - Keystone - Glance - Nova - Neutron - Cinder - Heat - Swift Compute/ Storage Compute/ Storage Compute Compute Compute Storage Storage Storage

16 All-in-One (AIO) Compressed HA Data Centre Infrastructure Spine/Agg Layer Spine/Agg Layer Infrastructure Services SLB Build/PXE Automation DNS DHCP NTP Logging OOB TOR(s) TOR(s) TOR(s) AIO Controller Compute Network Node(s) Block Storage Object Storage OOB AIO Controller Compute Network Node(s) Block Storage Object Storage OOB AIO Controller Compute Network Node(s) Block Storage Object Storage AIO Controllers: - Galera/MySQL - RabbitMQ - API Endpoints: - Keystone - Glance - Nova - Neutron - Cinder - Heat - Swift

17 OpenStack Networking

18 UCS C-Series Services What Really Changes in my Data Centre? OpenStack components live South of the Top-of-Rack switch Your existing DC, Internet Edge and BN architecture stays the same It s about the compute, storage and orchestration/management tiers Your apps go largely unchanged Access Layer Enterprise/Internet Core Layer Agg Layer OpenStack Lives Here UCS B-Series

19 Neutron Networking for Layer 2 Tenant Isolation Network Segmentation Scheme for tenant isolation Device implementing Network Segmentation Scheme Network Type VLAN vswitch, ToR Neutron driver Layer 2 Networks Tenant Networks Admin Provider Networks VXLAN vswitch ToR, Fabric Direct Device Configuration Device Configuration through Controller Provisioned Externally GRE vswitch

20 Layer 2 Network Tenant Topologies Host and Network based VLAN Host based overlays Network based overlays Compute Node Compute Node Compute Node Compute Node Compute Node Compute Node VM3 VM1 VM4 VM2 VM3 VM1 VM4 VM2 VM3 VM1 VM4 VM2 vswitch vswitch vswitch vswitch vswitch vswitch Data Network Data Network Data Network Fabric Leaf, Top of Rack Fabric Leaf, Top of Rack Fabric Leaf, Top of Rack VLAN Overlay

21 Neutron Networking for Layer 3 and Network Services Network Type Device implementing Network Service Neutron driver Layer 3 Networks Tenant Routers Admin Provider Networks Linux Host Service VM s Service Node, Fabric Direct Device Configuration Device Configuration through Controller Provisioned Externally

22 Layer 3 Tenant Network Topologies Linux Host Service VMs Fabric or Service Node Network Node(s) Compute Node Compute Node Compute Node Network Node(s) Compute Node Namespace VM1 VM2 Service VMs VM1 VM2 VM1 VM vswitch vswitch vswitch vswitch vswitch vswitch Data Network Fabric, Top of Rack Data Network Fabric, Top of Rack Data Network Fabric, Service Node

23 Cisco Integration into Neutron

24 Neutron Layer 2 Default Implementation Network REST API requests Neutron Server Neutron Core plugin (ML2) Open vswitch/linux Bridge Mechanism Drivers RPC message to agent on nodes VM VM Compute Node vswitch Network and Compute Nodes Implements Neutron Core Resources Open vswitch and Linux Bridge Mechanism Drivers Agents on Network and Compute Nodes Host based VLAN or Overlay (VXLAN, GRE) Type Drivers

25 Neutron Reference East-West L2 (Switched) Traffic Management Network Neutron Host(s) DHCP ports Nova Host Nova Host PKT VM1 VM2 VM3 VM4 Nova Host VM5 VM6 Controller Host(s) vswitch vswitch vswitch vswitch Data Network External Network Packet path animation for packet traveling from VM1 VM3. Router Internet API Network

26 Neutron Cisco Nexus Driver Neutron Server create/update port request sent to Neutron Features Works with multiple Nexus platforms VLAN configuration Neutron Core plugin (ML2) Cisco Nexus Driver netconf Ncclient Nexus Nexus ToR Nova VM on a Compute VM Nodes VM Compute Nodes VXLAN configuration Nexus_VXLAN Type Driver Multicast VLAN to VNI association Benefits No need trunk all tenant VLANs on compute node interfaces on ToR Dynamic provisioning/deprovisioning on ToR Network based overlays

27 Neutron Cisco UCSM Driver (KVM) Neutron Server create/update port Features: Nova and Neutron enhancements to support SR-IOV Neutron Core plugin (ML2) Cisco UCSM driver UCSM SDK UCS Fabric Interconnect Nova VM VM VMs on Compute Node Compute Nodes Supports VLAN configuration of SR-IOV ports (using port profiles) and vnic ports (using Service Profiles) Enables configuration of VLAN profiles and automatic association with network ports Benefits SR-IOV and non SR-IOV based UCS Fabric Interconnect configurations

28 Neutron Routing Implementation Routing REST API requests Neutron Server Neutron router HA capabilities using VRRP Neutron Service plugin (L3) Agent Scheduler Picks a L3 agent on a Network Node L3 agent on Network L3 agent Nodes on Network Node Default Gateway, Namespace and IPTables Namespace maps to a Neutron logical router. IPTables handle address translations VM VM Compute Node Compute Nodes L3 traffic goes through Network node

29 Neutron Reference East-West L3 (Routed) Traffic Routing Management Network Neutron Host(s) Nova Host PKT Nova Host Nova Host Virtual Router VM1 VM2 VM3 VM4 VM5 VM6 Controller Host(s) vswitch vswitch vswitch vswitch Data Network External Network Packet path animation for packet traveling from VM1 VM4 Router Internet API Network

30 Neutron Reference North-South L3 Traffic (NAT) NAT Management Network Neutron Host(s) Nova Host PKT Nova Host Nova Host Virtual Router VM1 VM2 VM3 VM4 VM5 VM6 Controller Host(s) vswitch vswitch vswitch vswitch Data Network External Network Packet path animation for packet traveling from VM1 Internet Router Internet API Network

31 Issues in Neutron Reference L3 and ASR1K Solutions NAT for External Connectivity: Issue - Scale limitation in Linux iptables software NAT Solution - ASR1K can scale up to 4 million dynamic NAT entries and 16K static NAT entries Tenant Routing: Issue - Scale limitations in Linux namespaces based software tenant networking Solution - ASR1K uses Virtual Routing and Forwarding (VRF) instances for tenant routers. ASR1K can scale up to 4k VRFs (8k in upcoming release) Tenant Networks: Issue- Scale limitations in Linux software based interfaces Solution - ASR1K plugin maps tenant networks to sub-interfaces on ASR1K. ASR1K supports up to 64k subinterfaces Data Throughput: Issue - Performance limitations with software packet forwarding and NAT on generic compute hardware Solution - ASR1K can perform packet forwarding and NAT at rates up to 230 Gbps

32 Neutron Cisco ASR1000 for Neutron L3 Service Neutron Server Neutron Service plugin (L3) Config Agent Cisco Config Agent Routing Device Driver (ASR1K) netconf Nexus ASR1K Mapping of Neutron reference L3 implementation - Linux namespaces - ASR1K VRF Internal Router ports ASR1K VLAN or Port Channel sub interfaces External Gateway ports ASR1K VLAN or Port Channel sub interfaces Linux IPTables ASR1K NAT Benefits Routing using physical infrastructure Support for HSRP and Port Channel

33 OpenStack Neutron + Nexus + ASR : Physical Topology Example Layer-3 Network Core Nexus Layer-2 Fabric Tenant VLANs and External Traffic Nova Compute Nodes OpenStack Controller Neutron Server with Cisco Config Agent ASR 1000 Routers Management Network (NETCONF provisioning)

34 ML2 Nexus and ASR1K - East-West L3 (Routed) Traffic Management Network ASR1K L3 Plugin Neutron Host(s) ASR1K ML2 Nexus Driver Nova Host Nova Host PKT VM1 VM2 VM3 VM4 Nova Host VM5 VM6 Controller Node(s) Virtual Router vsw vsw vsw VRF with default GW and NAT (to global routing). Nexus TOR External Network Nexus TOR Router API Network Data Network (L3 routed) Internet Note : Packet animation included VM1 VM4

35 ML2 Nexus and ASR1K - North-South L3 Traffic (NAT) Management Network ASR1K L3 Plugin Neutron Host(s) ASR1K ML2 Nexus Driver Nova Host Nova Host PKT VM1 VM2 VM3 VM4 Nova Host VM5 VM6 Controller Node(s) Virtual Router vswitch vswitch vswitch VRF with default GW and NAT (to global routing). Nexus TOR External Network Nexus TOR Router API Network Data Network (L3 routed) Internet Note : Packet animation included VM1 Internet

36 ACI Integration with OpenStack Multiple OpenStack Driver Options: APIC native Group-Based Policy Neutron ML2 APIC VMM Domain support for OpenStack Endpoint statistics, health, faults in APIC OpenStack Controller APIC Driver Hypervisor local enforcement security policies Security Groups (ML2 driver) via IP Tables Group-Based Policies via OpenFlow in Open vswitch Distributed NAT support on each compute node Floating IP snat (via hypervisor host IP) Distributed Neutron services per compute node L3 / Anycast gateway, metadata, DHCP Multiple VRF support Hypervisor V(X)LAN Open vswitch OpFlex Proxy OpFlex Agent Support for VLAN / VXLAN to ACI fabric Project 1 Project 2 Project 3 vm1 vm2 vm3 vm4 vm5

37 New ACI + OpenStack Design Guides Cisco ACI with OpenStack OpFlex Architectural Overview: x/openstack/b_aci_with_openstack_opflex_architectural_overview.html Cisco ACI with OpenStack OpFlex Deployment Guide for Red Hat: x/openstack/b_aci_with_openstack_opflex_deployment_guide_for_red_hat. html Cisco ACI with OpenStack OpFlex Deployment Guide for Ubuntu: x/openstack/b_aci_with_openstack_opflex_deployment_guide_for_ubuntu.h tml

38 Opflex Extends ACI to Hypervisor Pre-OpFlex Implementation OpFlex + OVS VLAN per Network / Group to ToR VXLAN within ACI Physical domain in ACI No APIC GUI integration Supports unmodified OVS, OVS agent OpenStack Controller APIC Driver VLAN Hypervisor Open vswitch OVS Driver OVS Agent Project 1 Project 2 Project 3 VLAN or VXLAN per Network / Policy Group to ToR OpFlex Proxy runs in leaf, OpFlex agent manages OVS Hypervisor-local traffic has policy, switching, routing handled locally VMM domain, GUI integration with APIC OpenStack Controller APIC Driver V(X)LAN Hypervisor Open vswitch OpFlex Agent OpFlex Proxy Project 1 Project 2 Project 3 vm1 vm2 vm3 vm4 vm5 Distributed support for NAT, metadata server proxies, DHCP vm1 vm2 vm3 vm4 vm5 Native neutron approach using Open vswitch Agent OpFlex Agent directly manages Open vswitch and integrates with APIC

39 ACI Plugin Options APIC ML2 Driver Group-Based Policy ACI fabric provides distributed L2 and L3 VLAN or VXLAN between hypervisor and ToR IP tables used for security enforcement Hypervisor IPTables vm1 vm2 OpenStack Controller V(X)LAN Open vswitch Project 1 Project 2 Project 3 vm3 vm4 APIC Driver OpFlex Proxy OpFlex Agent vm5 APIC Driver converts Neutron to ACI Policy OpFlex proxy receives policy from APIC OpFlex agent receives policy from ACI leaf ACI fabric provides distributed L2, L3, and security enforcement VLAN or VXLAN between hypervisor and ToR GBP policy and NAT enforced via OpenFlow Hypervisor vm1 vm2 OpenStack Controller Group-Based Policy V(X)LAN Open vswitch Project 1 Project 2 Project 3 vm3 vm4 APIC Driver vm5 OpFlex Proxy OpFlex Agent APIC Driver converts GBP to APIC policy OpFlex proxy receives policy from APIC OpFlex agent receives policy from ACI leaf

40 Neutron Cisco Application Policy Infrastructure Controller (APIC) Driver Neutron Server Neutron Core plugin (ML2) Cisco L2 APIC Driver REST API Neutron L3 Plugin Cisco L3 APIC Driver Network:EPG, Router:Contract VMs VMs on on Compute Nodes Nodes Neutron API: Network, Router, Subnet, Security Group L2 / L3 enforced in fabric, security groups enforced on hypervisor APIC Provides distributed L2,L3 functionality ACI Spine/Leaf Switches

41 Demo

42 OpenStack integration with Cisco Solutions Summary Purpose Using Cisco Product Code Availability Network Layer 2 Virtual Switch Nexus 1000v OpenStack Juno SR-IOV UCS Fabric Interconnect Cisco OpenStack Juno Plus Tech Preview Physical Switch Nexus OpenStack Juno DHCP IPAM Prime Network Registrar Not upstream yet Network Layer 3 Network Services Virtual Router Cloud Services Router 1000v OpenStack Juno Physical Router ASR 1000 Not upstream yet Virtual Firewall and VPN Cloud Services Router 1000v Firewall - Cisco OpenStack Juno Tech Preview VPN - Cisco OpenStack Juno Plus Tech Preview Network Layer2, Layer3, Services Controller Application Policy Infrastructure Controller APIC L2 - OpenStack Juno APIC L3 - OpenStack Juno Declarative Policy Model Group Based Policy Framework Group Based Policy StackForge Juno

43 Advanced Neutron Considerations

44 The Hard Stuff IPv6 + Cloud Inside of a private cloud stack you have a lot of moving parts and they all ride on IP: API endpoints Provisioning, Orchestration and Management services Boatload of protocols and databases and high-availability components Virtual networking services <> Physical networking IPv6 has been available with OpenStack for awhile but it has depended on a lot of backports and custom patches to be functional Kilo offers the best out-of-box support yet but still needs more work Tenant IPv6 Address Assignment via: SLAAC, Stateful DHCPv6, Stateless DHCPv6 Two common approaches for IPv6 support: Dual-Stack everything (Service Tier + Tenant Access Tier [Tenant management interface along with VM network access]) Conditional Dual stack (Tenant Access Tier only API endpoints & DBs are still IPv4)

45 Cloud Stack IP Version Options Dual-Stack Everything Conditional Dual-Stack Service Tier Tenant Access Tier Service Tier Tenant 1 Access Tier Tenant 2 Access Tier IPv4/IPv6 IPv4/IPv6 IPv4/IPv6 API endpoints Database(s) Automation IPv4/IPv6 IPv4/IPv6 VM Operating System Virtual Networking (L2/L3) IPv4 IPv4 IPv4 API endpoints Database(s) Automation IPv4/IPv6 IPv4/IPv6 VM Operating System Virtual Networking (L2/L3) IPv6 IPv6 VM Operating System Virtual Networking (L2/L3) IPv4/IPv6 Interface (GUI, CLI) IPv4/IPv6 Virtual Network Services (SLB/FW) IPv4/IPv6 Interface (GUI, CLI) IPv4/IPv6 Virtual Network Services (SLB/FW) IPv6 Virtual Network Services (SLB/FW) IPv4/IPv6 Tenant Interface (GUI, CLI) IPv4/IPv6 Tenant Interface (GUI, CLI) IPv6 Tenant Interface (GUI, CLI)

46 Network Function Virtualisation Network Tenant Node(s) A Namespace Compute Node VM1 Compute Node VM2 VM1 Compute Node Compute Node Service VM1 VM2 VM1 VM vswitch vswitch vswitch vswitch vswitch Data Network Data Network Admin provisioned Service Tenant provisioned Service

47 Neutron and NFV Issue Anti-spoofing rules to ensure traffic originates and terminates as expected Doesn t work for NFV VNF use cases Solution Added Port Security Extension Adds new Port Security enabled attribute to Network and Port Resources Only tenant owner can set this attribute on the resources Security Group and Allowed Address Pair are not allowed to be set Issue VXLAN for tenant isolation and VLAN for app traffic isolation within the tenant No means to identify VLAN transparent networks Solution Added Network Resource Extension Adds new Vlan Transparent attribute to Network Resource Only tenant owner can set this attribute on the resources No firewalling on VLAN tagged packets

48 Conclusion OpenStack is for real and maturing at a rapid pace Many different players involved and it is evolving rapidly Align yourself with market leaders who have strong partnerships Installation is still tough but getting better Keep your design simple and reduce/remove technical debt wherever possible it can kill your upgrades and scale out plans Get involved in the community open source enjoys the major advantage of feature velocity

49 Q & A

50 Complete Your Online Session Evaluation Give us your feedback and receive a Cisco 2016 T-Shirt by completing the Overall Event Survey and 5 Session Evaluations. Directly from your mobile device on the Cisco Live Mobile App By visiting the Cisco Live Mobile Site Visit any Cisco Live Internet Station located throughout the venue T-Shirts can be collected Friday 11 March at Registration Learn online with Cisco Live! Visit us online after the conference for full access to session videos and presentations.

51 Thank you