Using PCE for path computation, PCEP for device config and BGP-LS for topology discovery vcpe

Transcription

1 Requirement Configuration and management of DC networks using OpenStack Neutron Using overlay L2/L3 network for VM/IaaS connectivity Configuration and management of Open vswitch instances; deploying all the VXLAN tunnels required an Controller for OVS provisioning Using ODL topology manager to automatically generate a model of the network topology Fabric control: configuration and management of network elements (switches, routers) using OVSDB an Controller for hardware based OVS devices Dynamic L2 and L3 VPN provisioning using L2 and L3 network elements and Netconf interface Using MPLS or overlay network to dynamically create or extend L2/L3 VPN BGP-LS for topology discovery and synchronization PCEP for Tunnels discovery and enforcement With the ability to add customized Path Computation algorithms MPLS-TE on Demand Using PCE for path computation, PCEP for device config and BGP-LS for topology discovery vcpe Extending the L2 network overlay used in datacenters to the Operator's Access network (Border Network Gateway)

2 Priority Feature Description/Use Case OpenDaylight Status Remarks (1) Communication between VMs on the same Compute node Done Traffic should not leave the host. VM MAC bridging as well as ARP (and IPv6 ND?) should be handled locally on 'br-int' MVP L2 (subnet, network, port) (2) Communication between VMs on different Compute nodes Done Traffic should be directly forwarded between the Compute nodes Support for VLAN, VXLAN, and NVGRE encapsulation. VXLAN is the recommended one Traffic should not leave the host. Requires support for distributed router and local ARP (1) Communication between VMs on the same Compute node Done response MVP IPv4 routing (2) Communication between VMs on different Compute nodes (east-west) Done Traffic should be directly routed between the Compute nodes. Requires support for distributed router and local ARP response (3) Outgoing NPAT connectivity (north-south), aka SNAT WIP Traffic should be NATed between the Compute nodes and the external network. Requires external network access on each compute (br-ex) (4) 1:1 NAT for floating IP support (north-south) Done Traffic should be NATed between the Compute nodes and the external network. Requires external network access on each compute (br-ex) MVP Security Groups (IPv4) Ingress/egress firewall rules per Neutron port Investigate Native OVS/contrack using 2.4.0? Need to discuss the default rules. Also, it's importnat to provide support/compatibility with ML2 port-security (key for NFV) High IPv4 IPAM/DHCP IPv4 DHCP service, including extra options support (MTU, DNS, etc.) Need to discuss dnsmasq/dhcp-agent vs. native OVS/OpenFlow implementation High Metadata Cloud-init support for VM instances (config-drive?) The ML2/OVS implementation is very complex here, where Neutron (l3-agent, metadataagent) proxies the request to Nova. Need to think of an elegant way to impletment a openstack feature (in nova), but since we're changing l3 architecture, it will break things. distributed version of it. The metadata agent adds some HTTP headers for nova. I don't know if OVS can alter HTTP headers. Also, need to make sure that config-drive is tested properly for IPv6 Medium Security Groups (IPv6) Ingress/egress firewall rules per Neutron port Medium Medium IPv6 IPAM/DHCP No IPv6 at all in ODL provision OVS instances appropriately (1) Communication between VMs on the same Compute node No floating IP's for IPv6 (2) Communication between VMs on different Compute nodes (east-west) (3) External routing support (north-south) Neutron allows for SLAAC, DHCPv6 stateful, and DHCPv6 stateless address assignme (ipv6_ra_mode, ipv6_address_mode) Traffic should not leave the host. Requires support for distributed router and local ND response Traffic should be directly routed between the Compute nodes. Requires support for distributed router and local ND response. Requires external network access on each compute node (br-ex) Assuming tenants are assigned with global routed addresses (no need for NAT, no floating IP support) Need to discuss provisioning of the upstream router (i.e., static default-route config, or dynamic learning via RA/SLAAC) - as of Kilo, Neutron supports both Could be interesting to consider BGP support Need to discuss dnsmasq/dhcp-agent vs. native OVS/OpenFlow implementation Need to also consider the router (RAs are required for SLAAC, DHCPv6 stateless, and for default-route and MTU advertisment) Medium HW VTEP Ability to offload the VXLAN GW functionality to hardware, typically to a ToR switch Cumulus and HP looking into this Low LB LBaaS Medium customer demand. Need to consider API v1/v2 support, and keep in mind the shift towards Octavia as a virtual appliance Low VPN VPNaaS Low customer demand Nice to have FW FWaaS API is still considered experimental. Low customer demand TBD TBD IPv6 routing Provider Networks SR-IOV networking Direct VM connectivity into a pre-existing physical network (flat and VLAN being the most common network types) Direct assignemt of a VF into a Neutron port (Juno) Direct assignemt of an enitre PF into a Neutron port (WIP for Liberty) Need to check OVS/contack support for that (don't think this is covered in 2.4.0) - see Need to discuss the default rules This is a very common deployment with Neutron today, as it bypasses the l3-agent (and possibly the dhcp-agent) completely, and let the physical network handle routing and Currently implemented via an ML2 driver (sriovnicswitch). Requires bridge-mapping into a flat/vlan network Customer demand (Telefonica) for external switch control via OpenFlow - see Low Live migration

3 User Story As a <type of user>, I want <some goal> so that <some reason> As a tenant, I want to create logical networks so that I can plug in my VMs on demand As a tenant, I want to be able to attach subnets to my logical networks so that VMs are automatically assigned with IPv4 addresses As a tenant, I want to be able to choose my IPv4 addressing scheme so that VMs get assigned with IPs based on my application design As a tenant, I want to be able to specify the exact IPv4 address that will be assigned to my VM so that I can pick an IP based on my needs As a tenant, I want to be able to configure extra DHCP options for my subnets, so that I can pass information like MTU or DNS into my VMs Acceptance Criteria Verify that <some test> Verify that a tenant user can create a network using the API, CLI or Horizon UI Verify that a tenant can create an IPv4 subnet and attach it to a network. With IPv4, DHCP should be enabled by default so that VMs will get addresses assigned automatically Verify that a tenant user can chhose whatever IPv4 subnet he would like for his subnets. That also means that overlapping IP support is a mandatory requirement Verify that a tenant can disbale DHCP for a given subnet and statically/manually assign IPs from the subnet range Verify that extra options such as DNS server are showed propeprly in the subnet attributes and being passed into the VM guests plugged into the network As a tenant, I want that VMs on the same logical network will be able to communicate over IPv4 or IPv6 Veirfy that VMs on the same network can be bridged properly. Test using ICMP pings Verify that a teant user can create a router device and link it into their subnets so that it assigned with IP address from each subnet and performs routing. Easy test would be to issue a ping between VMs located on As a tenant, I want to create logical routers so that I can route between my different subnets different L3 subnets As a tenant, I want to be able to connect my routers into an external network so that I can communucate Verify that a tenant user can connect it's router to a (preconfigured) external network. Verify that a proper with outside systems defualt-route is configured on the virtual router As a tenant, I want to have external (egress) connectivity from my VMs by default, so that I can reach out Verify that a VM can ping external systems once link to the extrnal network. SNAT should take place in the external resources (e.g the Internet) without any special configuration background, with no user intervention and with no need to change the IP address configuration on the guest Veirfy that a tenant user can assign a floating IP to a VM. Once the floating IP is assigned, DNAT/1:1 NAT process should take place in the background, with no user intervention and with no need to change the IP As a tenant, I want to be able to assign floating IPs to my VMs so that they can be reached from external address configuration on the guest. With floating IP, all ingress and egress traffic flow on the VM should be networks (e.g the Internet) using the floting IP only As a tenant, I want to be able to control what traffic can flow in and out my VM using standard TCP/IP Verify that a tenant can setup security-groups per VM port and filter/match traffic based on IP address, IP characteristics, so that I can limit the applications running on it protocol numbers, TCP/UDP port numbers and ICMP codes. As a tenant, I want my VMs to have only egress traffic allowed so that they will be protected from outside Verify that with default security group rules applied, all ingress traffic is blcked* and eagress traffic is allowed. systems Only trusted control-plane traffic should be allowed to allow successful ARP and DHCP negotiation As a tenant, I want my VMs to originate or process incoming traffic using their assigned IP and MAC Verify that with default security group rules applied, the VM can not send or recieve packets with MAC or IP addresses only so that they will be protected from spoofing attacks address other then the ones known to Neutron As a tenant, I want to be able to turn-off any security polices on the VM, so that I can run network applications (VNFs) inside the VM Verify that a tenant can turn off security-groups entirely on a per port basis As a tenant user, I want to be able to define the hostname and root password for my instance/vm. Acceptance criteria: System injects metadata information into the VM/instance so that tenant user's metadata, e.g hostname or root password is associated with the guest Veirfy that cloud-init is working properly and that metadata information can be pushed from the Nova API As a tenant, I want to be able to assign an IPv6 subnet to my networks so that my VMs can operate using Veirfy that a tenant can create an IPv6 subnet and choose the address assigment options via the API, CLI, and IPv6 Horizon UI As a tenant, I want to able to control the IPv6 address assignment options of my subnets, so that I can pick between SLAAC, DHCPv6 stateless or DHCPv6 stateful Veirfy that a tenant can choose the address assigment option per subnet via the API, CLI, and Horizon UI As a tenant, I want to pick my IPv6 addresses so that the VMs will be assigned with global unicast Veirfy that a tenant can disable automatic address assignment and statically assign IPv6 addresses to VMs addresses from my range from the subnet range. Veirfy that a tenant can link different IPv6 networks/subnets to a router. Test would be to issue a ping6 between As a tenant, I want to be able to create routers so that I can route between my IPv6 subnets VMs located on different L3 subnets As a tenant, I want to have full reachability (ingress and eagress) using IPv6 only so that I can use my Veirfy that once a network/subnet is connected into the external network via a router, traffic can be route in and global unicast addresses for my applications out from the VMs (no NAT or floating IP support, just classic routing) As a tenant, I want to assign to a VM port with both an IPv4 and IPv6 address so that my applications can utilize dual-stack support Verify that a tenant can create a network and assign it with two subnets: one IPv4 based and one IPv6 based Verify that a tenant can create a network and assign it with two subnets: one IPv4 based and one IPv6 based. As a tenant, I want to attach both an IPv4 subnet and IPv6 subnet to a single network so that I can run in VM attached to this network should get both an IPv4 and IPv6 address from the configured ranges on their dual-stack mode port/logical device within the guest As a tenant, I want to be able to control what traffic can flow in and out my VM using standard TCP/IPv6 Verify that a tenant can setup security-groups per VM port and filter/match traffic based on IPv6 address, IPv6 characteristics, so that I can limit the applications running on it protocol numbers, TCP/UDP port numbers and ICMPv6 codes. As a tenant, I want to be able to live migrate my VMs between different Compute nodes, so that I can recover my application in case of a failure

4 As a cloud architect, I want the compute nodes to handle ARP and IPv6 ND process so that I can avoid punting this traffic into a dedicated node As a cloud architect, I want each compute node to handle L2 switching in a distributed matter so that traffic flow is optimal As a cloud architect, I want each comute node to handle L3 routing between tenant subnets in a distributed matter so that I can avoid using a dedicated Network node As a cloud architect, I want each comute node to handle floating IPs/DNAT directly so that I can avoid using a dedicated Network node As a cloud architect, I want each compute node to handle the default SNAT functionalty so that I can avoid using a dedicated Network node As a cloud architect, I want each compute node to handle DHCP and IP address assignment locally so that I can avoid using a dedicated Network node As a cloud architect, I want each to be able to choose between VLAN, GRE and VXLAN as a tenant segmentation technology As a cloud architect, I want an elgant solution for mapping between MAC addresses and VTEP IP addresses so that BUM (broadcast, unknown unicast, and multicast) traffic will not need to be flooded everywhere or sent to a centeral location Verify that VMs can communicate locally or between Compute nodes with no need to send ARP or IPv6 ND traffic to any outside system Verify that VMs running on the same Compute node and belonging to the same network can communicate locally with no need to send traffic to any outside system. Only traffic destined to a VM running on a different compute should be sent out through the physical network directly to the correct Compute Verify that VMs running on the same Compute node and belonging to the same tenant can communicate locally with no need to send traffic to any outside system. Only traffic destined to a VM running on a different compute should be sent out through the physical network, directly to the correct Compute Verify that VM can reach the external network directly with no need to send the traffic to a cenntral place Verify that VM can reach the external network directly with no need to send the traffic to a cenntral place As a cloud operator, I want to be able to choose between GRE, VXLAN or VLAN segregation for each of my tenants so that I can pick the best solution based on my network design As a cloud operator, I want the MTU to be automatically adjusted properly for me on all relevant network devices in the Compute nodes so that my clients get the best performance and utilization while avoiding packet fragmentation As a cloud operator, I want the system to automatically discover all Compute nodes/ovs instances so that I can troubleshoot the enviornment more easily As a cloud operator, I want to get notices if a Compute node/ovs instance is going down so that I can troubleshoot the enviornment more easily As a cloud operator, I want to get live numbers showing the network bandwidth utilization on the Compute nodes so that I can troubleshoot the enviornment more easily As a cloud operator, I want to be able to run connectivity tests (for e.g ping or tracert) for my tenants from a centerlized management system so that I can troubleshoot the enviornment more easily As a cloud operator, I want to able to retreive information about the upstream (for e.g ToR) switch connected to each Compute so that I can troubleshoot the enviornment more easily Verify that VMs can get proper network access with both overlays (GRE, VXLAN) and VLANs Verify that ODL automatically generate a model of the network topology, and listing all OVS instances Verify that ODL automatically generate a model of the network topology, and listing all OVS instances

5 Performance Resiliency Security Scalability Support IPv6 at API, GUI and CLI level Migration from ML2/OVS?

6 Discovery of Compute nodes Autoconfig of OVS manager (?) Setup of clustering