Hálózati szolgáltatások OpenStack környezetben

Transcription

1 Hálózati szolgáltatások OpenStack környezetben Szabó Gábor Mérnök-tanácsadó, Cisco Magyarország Kft február

2 Agenda OpenStack Introduction Networking in OpenStack OpenStack Neutron Under The Hood Cisco Innovations Improving OpenStack Networking Experience Cisco Confidential 2

3 Cloud Requirements Self Service Consumption Model Frees up IT from mundane setup tasks and allows end users to get what they want, when they want it Rapid Provisioning Commissioning or decommissioning of resources within minutes instead of weeks Elastic Resource Allocation Rapid scalability of virtual and physical Automated deployment Pay-As-You-Use $ Consume metering, accounting, charge-back Cisco Confidential 3

4 Cloud Service Provider - Delivery Models Collocation Services Resources owned and Managed by customers. in SP Data Center Dedicated Cloud Resources dedicated to customers. Self managed or SP managed Virtual Private Cloud VPC delivered from shared Multitenant environment Self managed or SP managed Public Cloud Shared resources from Multi-tenant environment. SP managed SP Clouds IP WAN / Internet Hybrid Cloud Managed Cloud Customer Private Cloud Resources dedicated SP managed Cisco Confidential 4

5 Major Cloud Service Types Private Cloud Infrastructure as a Service (IAAS) Platform as a Service (PAAS) Software as a Service (SAAS) Applications Applications Applications Applications Runtimes Runtimes Runtimes Runtimes Databases Databases Databases Databases Security Security Security Security Servers Servers Servers Servers Virtualization Virtualization Virtualization Virtualization Networking Networking Networking Networking Storage Storage Storage Storage Managed by You Managed by Provider Cisco Confidential 5

6 M2M Interface Public / Hybrid Cloud Reference Architecture End User Human Interface Public Cloud Admin Enterprise Cloud Portal Enterprise Cloud Orchestration Engine Cloud API Hybrid Cloud Use Case Cloud API Public Cloud Portal Public Cloud Orchestration Engine Enterprise Cloud WAN Public Cloud Cisco Confidential 6

7 Cloud APIs: REST The REST interface use only the standard components of HTTP request messages to represent the API action that is being performed: HTTP method: describes the action the request will perform Universal Resource Identifier (URI): path and query elements that indicate the resource on which the action will be performed Request Headers: pieces of metadata that provide more information about the request itself or the requester Request Body: the data on which the service will perform an action Data format: XML or JSON Cisco Confidential 7

8 REST API example - XML (Verizon Terremark) Create POST virtualmachines/computepools/{computepoolid}/action/ createblankvirtualmachine <CreateBlankVirtualMachine name=""> <ProcessorCount></ProcessorCount> <Memory> <Unit></Unit> <Value></Value> </Memory> <Layout> <Row href="" name="" /> <Group href="" name="" /> <NewRow></NewRow> <NewGroup></NewGroup> </Layout> <Description></Description> <Tags> <Tag></Tag> </Tags> <OperatingSystem href="" name="" /> <Disks> <Disk> <Index></Index> <Size> <Unit></Unit> <Value></Value> </Size> <Name></Name> </Disk> </Disks> <NetworkAdapterSettings> <NetworkAdapter> <Network href="" name="" /> <IpAddress></IpAddress> <IpAddressV6></IpAddressV6> </NetworkAdapter> </NetworkAdapterSettings> <DetachedDisks> <DetachedDisk href="" name="" /> </DetachedDisks> </CreateBlankVirtualMachine> Cisco Confidential 8

9 REST API example JSON (Rackspace) Create POST { "server": { "name": "my_server_with_network", "imageref": "d42f821e-c2d f07-af5ed7912d0e", "flavorref": "2", "max_count": 1, "min_count": 1, "networks": [ {"uuid": "538a112a-34d1-47ff-bf1e-c40639e886e2"}, {"uuid": " "}, {"uuid": " "} ] } } Cisco Confidential 9

10 What is OpenStack? OpenStack is an Infrastructure As A Service (IaaS) cloud compu?ng project provides a means to control (administer) compute, storage, network and virtualiza?on technologies Cisco Confidential 10

11 Why OpenStack? Avoids vendor lock-in Open source with more than 180 vendors contributing Rapid build-out of Public or Private clouds Easily customizable by Internal Software teams Ready for mission-critical private clouds 8 th major release Market Traction Comcast CERN Bloomberg Intel NASA Best Buy PayPal HubSpot Others High Cisco Contribution Cisco Cloud CTO is Vice-chair of board Support for Cisco s entire Cloud portfolio Cisco Accelerating Innovation (Neutron) Lew Tucker Cisco Confidential 11

12 OpenStack: A Brief History NASA Launches Nebula One of the first cloud computing platforms built by the Federal Government for the Federal Government March 2010: Rackspace Open Sources Cloud Files software, aka Swift May 2010: NASA open sources compute software, aka Nova June 2010: OpenStack is formed July 2010: The inaugural Design Summit nebula.nasa.gov Cisco Confidential 12

13 OpenStack Timeline and Releases 2010 Mar May June July Rackspace Open Sources Swift NASA Open Sources Nebula OpenStack Formed Inaugural Design Summit in Austin Oct Feb Apr Sep Apr Sep Apr Oct Austin Bexar Cactus Diablo Essex Folsom Grizzly Havana Icehouse Cisco Confidential 13

14 OpenStack Software Modules ( Projects ) Orchestration ( Heat ) Dashboard ( Horizon ) Compute ( Nova ) Block Storage ( Cinder ) Object Storage ( Swift ) Network ( Neutron ) Image ( Glance ) Identity ( Keystone ) Metering ( Telemetry ) (former name: Celiometer ) Cisco Confidential 14

15 Networking in OpenStack Cisco Confidential 15

16 OpenStack Network Service (Neutron) Provides network connectivity as a service between devices managed by other OpenStack services Provides abstractions and functionality needed for cloud networking Why Neutron? First-gen networking under Nova is limited Provide tenants an API to build rich networking topologies Foster innovation through plug-ins Former name was Quantum Neutron Cisco Confidential 16

17 Basic Neutron API Abstractions Nova TenantA TenantB TenantA TenantC virtual server Neutron L2 Virtual Network Virtual Subnet ( /24) virtual port L2 virtual network virtual subnet Network: isolated L2 segment, transporting Ethernet frames Subnet: block of IPv4 or IPv6 addresses Port: connection point for attaching a device to a virtual network Cisco Confidential 17

18 OpenStack Logical Network Topologies TenantA TenantB TenantA TenantC TenantA TenantB TenantA TenantC TenantD Shared Net /22 Shared Net /24 Shared Net /24 Shared Net / Physical Router Physical Router Single Flat Network Multiple Flat Networks Cisco Confidential 18

19 OpenStack Logical Network Topologies TenantA Private Net /24 TenantC Private Net /24 TenantA TenantA TenantC TenantC TenantA TenantA TenantB TenantC TenantC TenantA Private Net / TenantC Private Net /24 Shared Net /22 Provider Router (virtual) External Net / Physical Router Mixed Flat and Private Network Physical Router Provider and Tenant Networks Cisco Confidential 19

20 OpenStack Logical Network Topologies TenantA TenantA TenantC TenantC TenantC TenantC TenantA Private Net /24 TenantC Private Net /24 TenantC Private Net / TenantA Router (virtual) TenantC Router (virtual) External Net / Physical Router Tenant Routers and Private Networks Cisco Confidential 20

21 Neutron API Extensions Neutron Base API v2.0 Networks Create, Delete, Update List, Show Subnets Ports Create, Delete, Update List, Show Create, Delete, Update List, Show Neutron API Extensions Routers Create, Delete, Update, List, Show Add / Remove Interface FloatingIP Create, Delete, Update, List, Show QoS, ACLs, LBaaS Security Filter Policies Netflow Port Profiles/Statistics Cisco Confidential 21

22 Example Neutron API Calls Method URI Description GET v2.0/networks Lists networks to which the specified tenant has access. POST v2.0/networks Creates a network. GET v2.0/networks/{network_id} Shows information for a specified network. PUT v2.0/networks/{network_id} Updates a specified network. DELETE v2.0/networks/{network_id} Deletes a specified network and its associated resources. GET v2.0/subnets Lists subnets to which the specified tenant has access. POST v2.0/subnets Creates a subnet on a specified network. GET v2.0/subnets/{subnet_id} Shows information for a specified subnet. PUT v2.0/subnets/{subnet_id} Updates a specified subnet. DELETE v2.0/subnets/{subnet_id} Deletes a specified subnet. Cisco Confidential 22

23 Hosts and Neutron Services Management Network:through which s connect to iscsi storage, admins ssh into hosts, etc. Network node(s) functions as L3 router for gateway and adjacent VLAN traffic (via IP tables configured by L3 Agent) Data Network: through which traffic is switched between external-network-connected hosts and compute hosts Private Tenant Network Traffic Local L2 traffic bridged/switched on host Flat Networking Traffic VLAN Traffic across Nodes GRE or VXLAN tunnels across Nodes dhcp-agent dhcp-agent dhcp-agent *-plugin-agent *-plugin-agent *-plugin-agent l3-agent l3-agent L2B/OVS Network Node Network Node Network Node Data Network External Network Management Network nova-compute nova-compute nova-compute *-plugin-agent nova-compute *-plugin-agent *-plugin-agent *-plugin-agent L2B/OVS Compute Node Compute Node Compute Node Compute Node API Network nova-api nova-scheduler neutron-server keystone mysql, rabbit... Cloud Controller Node External Network: through which your users s communicate with the rest of the network/internet North/South Traffic uses Network Nodes as Gateway to Public/External Networks Multiple Network Nodes for high throughput Internet API Network: through which your users access the OpenStack dashboard (Horizon) and the Cloud API (REST) API Network is typically routable to enable public access Cisco Confidential 23

24 Network Types in OpenStack Different technologies for implementing L2 segment Local: internal in the same host ( all-in-one ) Flat: untagged native Ethernet VLAN: 802.1q tagged native Ethernet GRE: Ethernet over GRE tunnel VXLAN: Virtual Extensible LAN (Ethernet over UDP) tunnel Provider network: created by Openstack Admin Maps to physical networks Applicable types: Flat, VLAN Tenant network: Created by tenants, isolated between tenants Applicable types: VLAN, GRE, VXLAN Cisco Confidential 24

25 Neutron Plugin Concept Grizzly: monolithic plugin Havana: ML2 modular plugin Neutron Server Plugin API Vendor/User Plugin Neutron Server ML2 Plugin Type Manager API Extension Mechanism Manager Optional sub-plugin (Open vswitch) GRE TypeDriver VLAN TypeDriver VxLAN TypeDriver Open vswitch Linuxbridge Hyper-V Cisco Nexus Other Vendor Cisco Confidential 25

26 OpenStack Neutron Under The Hood Cisco Confidential 26

27 Tenant Networks - VLAN Compute nodes Network Node br- br- br Data Network 802.1Q (physical) br- Qrouter br-ex Segment ID: internal or external VLAN Data Network: 802.1Q VLAN range br-: VLAN translation eth1 External Network Cisco Confidential 27

28 Tenant Networks GRE, VxLAN Compute nodes Network Node br-tun br-tun br-tun Data Network (physical) br-tun Qrouter Full-mesh GRE/VxLAN tunnels Segment ID: GRE/VxLAN Tunnel ID Data Network: untagged or a VLAN br-ex eth1 External Network Management Network can be used as well Cisco Confidential 28

29 Tenant/Network Layout Host View - VLAN compute-node-01 network-node Tenant networks: internal VLANs Qrouter int-br- int-br- int-br-ex VLAN translation br- phy-br- Tenant networks: external VLANs br- phy-br- br-ex eth1 phy-br-ex VLAN range allocated to Tenant networks Data Network Public: x/24 Cisco Confidential 29

30 Tenant/Network Layout Host View GRE/VxLAN compute-node-01 network-node Tenant networks: internal VLANs Qrouter Internal VLAN Tunnel ID mapping br-tun patch-tun patch-int Tenant networks: Tunnel ID br-tun patch-tun patch-int br-ex eth1 int-br-ex phy-br-ex Public: x/24 Management Network: x Cisco Confidential 30

31 Open vswitch Bridge/Quantum Router view qr-xx & tapxx compute-node-01 network-node Qrouter qr-xx-ab qr-xx-06 ovs-vsctl list-ports int-br-ex patch-tun qr-024a qr-10f02a4b-ab qr-b37e qr-ef7c1e0c-79 tap e-68 tap271689cd-23 tap3fe91abf-c8 tap60a tap6d3911a5-44 patch-tun patch-int br-tun Tap interface for each network used for DHCP service Management Network: x patch-tun patch-int br-tun int-br-ex phy-br-ex br-ex eth1 Public: x/24 Cisco Confidential 31

32 OpenvSwitch Bridge/Quantum Router br-ex & br-tun view compute-node-01 network-node Qrouter patch-tun patch-tun int-br-ex patch-int network-node:~# ovs-vsctl list-ports br-ex eth1 br-tun phy-br-ex qg-8a8db076-b3 network-node:~# ovs-vsctl list-ports br-tun gre-1 br-tun patch-int gre-3 br-ex eth1 phy-br-ex qg-xx-b3 gre-1 gre-3 patch-int Management Network: x Public: x/24 Cisco Confidential 32

33 Open vswitch Bridge/Quantum Router compute-node-01 view compute-node-01 network-node Qrouter patch-tun patch-tun int-br-ex br-tun patch-int br-tun patch-int br-ex phy-br-ex ovs-vsctl list-ports patch-tun qvo180f8458-7b qvo3e60deda-cc Management Network: x qvo da eth1 Public: x/24 Cisco Confidential 33

34 Open vswitch Bridge/Quantum Router Linux Bridge View compute-node-01 vnetx qbr-xx qvb-xx qvo-xx vnet 7b 7b 7b Need for Linux Bridge: Iptables support on TAP if Patch interfaces: virtual patch cables patch-tun patch-int br-tun brctl show bridge name bridge id STP enabled interfaces e15d719a548 no int-br-ex qvo180f8458-7b qvo3e60deda-cc qvo da br-tun 0000.febc48d02540 no qbr180f8458-7b a425eeda354 no qvb180f8458-7b vnet0 qbr3e60deda-cc a70b498c8ce no qvb3e60deda-cc vnet2 qbr da e21bdf7dd5b no qvb da vnet1 Cisco Confidential 34

35 OpenvSwitch Bridge/Quantum Router br-tun Detailed View compute-node-01 patch-tun patch-int br-tun gre-2 gre-3 ovs-vsctl show ac44a899-5f10-4ff9-8dad-902fa7c10e5e... Bridge br-tun Port "gre-2" Interface "gre-2" type: gre options: {in_key=flow, out_key=flow, remote_ip=" "} Port patch-int Interface patch-int type: patch options: {peer=patch-tun} Port "gre-3" Interface "gre-3" type: gre options: {in_key=flow, out_key=flow, remote_ip=" "} Port br-tun Interface br-tun type: internal network-node compute-node-02 Cisco Confidential 35

36 Basic Traffic Flow High-Level Walk-Thru compute-node-01 network-node IP Tables/Floating IP NAT Qrouter High-Level Walk-Thru DHCP DHCP tap patch-tun patch-tun int-br-ex br-tun patch-int br-tun patch-int br-ex phy-br-ex eth1 GRE tunnel Management Network: x Public: x/24 Cisco Confidential 36

37 Cisco Innovations Improving OpenStack Networking Experience Cisco Confidential 37

38 Nexus Routing with VLAN Networking Management Network Network node(s) functions as L3 router for gateway and adjacent VLAN traffic (via IP tables configured by L3 Agent) Data Network: through which traffic is switched between external-networkconnected hosts and compute hosts Private Tenant Network Traffic Local L2 traffic bridged/ switched on host Flat Networking Traffic VLAN Traffic across Nodes GRE or VXLAN tunnels across Nodes dhcp-agent dhcp-agent dhcp-agent *-plugin-agent *-plugin-agent *-plugin-agent l3-agent l3-agent L2B/OVS Network Node Network Node Network Node Data Network External Network nova-compute nova-compute nova-compute *-plugin-agent nova-compute *-plugin-agent *-plugin-agent *-plugin-agent L2B/OVS Compute Node Compute Node Compute Node Compute Node API Network nova-api nova-scheduler neutron-server keystone mysql, rabbit... Nexus PIugin Cloud Controller Node SVI configured on Nexus for L3 forwarding and external Gateway Internet Cisco Confidential 38

39 Cisco Nexus Plugins for Neutron - Benefits Automated VLAN Provisioning Configure VLANs on the Nexus switch Layer 3 Gateway Map Nexus Switch Virtual Interface (SVI) to tenant VLAN Scalability with Top of Rack (ToR) Nexus as default Layer 3 Gateway Eliminates configuration and bottleneck of host-based software L3 forwarding Agent Multi-Homed Host Deployments Virtual Port Channel (vpc) for High Availability (HA) and link optimization to multiple Nexus switches Hardware and Software-based Networking Performance benefits of hardware-based ToR switch (Nexus 3000, 5000, 6000, 7000) Flexibility of software-defined Networking with Nexus 1000V Cisco Confidential 39

40 Cisco Nexus Plugins for Neutron Physical Switch Provisioning NETCONF over SSH (XML-based config snippets) CMD_PORT_TRUNK = """ <interface> <%s> <interface>%s</interface> < XML MODE_if-ethernet-switch> <switchport></switchport> <switchport> <mode> <trunk> </trunk> </mode> </switchport> </ XML MODE_if-ethernet-switch> </%s> </interface> """ CMD_VLAN_SVI_SNIPPET = """ <interface> <vlan> <vlan>%s</vlan> < XML MODE_vlan> <no> <shutdown/> </no> <ip> <address> <address>%s</address> </address> </ip> </ XML MODE_vlan> </vlan> </interface> """ CMD_NO_VLAN_INT_SNIPPET = """ <interface> <%s> <interface>%s</interface> < XML MODE_if-ethernet-switch> <switchport></switchport> <switchport> <trunk> <allowed> <vlan> <remove> <vlan>%s</vlan> </remove> </vlan> </allowed> </trunk> </switchport> </ XML MODE_if-ethernet-switch> </%s> </interface> """ Cisco Confidential 40

41 Configuring Cisco Nexus Plugin (1/3) Openvswitch VLAN Mode - Basic Plugin Configuration Edit /etc/neutron.conf ->"core_plugin" core_plugin = neutron.plugins.cisco.network_plugin.pluginv2 Edit /etc/neutron/plugins/cisco/cisco_plugins.ini -> [cisco_plugins] vswitch_plugin=neutron.plugins.openvswitch.ovs_neutron_plugin.ovsneutronpluginv2 Edit /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini [ovs] bridge_mappings = physnet1:br-eth1 network_vlan_ranges = physnet1:1000:1100 tenant_network_type = vlan Cisco Confidential 41

42 Configuring Cisco Nexus Plugin (2/3) Openvswitch VLAN Mode Nexus Configuration Edit /etc/neutron/plugins/cisco/cisco_plugins.ini [NEXUS_SWITCH: ] IP address of Nexus # Hostname and port used of the node compute-1=1/1 Nexus interface where # Hostname and port used of the node compute-2=1/2 compute node is connected # Port number where the SSH will be running at the Nexus Switch, e.g.: 22 (Default) ssh_port=22 # Provide the Nexus credentials, if you are using Nexus switches. If not this will be ignored. username=admin password=mysecretpasswordfornexus Cisco Confidential 42

43 Configuring Cisco Nexus Plugin (3/3) Openvswitch VLAN Mode Nexus vpc Configuration Edit /etc/neutron/plugins/cisco/cisco_plugins.ini (partial config) [NEXUS_SWITCH: ] # Hostname and port used of the node compute-1=portchannel:2 # Hostname and port used of the node compute-2=portchannel:3 [NEXUS_SWITCH: ] # Hostname and port used of the node compute-1=portchannel:2 # Hostname and port used of the node compute-2=portchannel:3 Same IP address compute of Nexus nodes, same port-channels Nexus vpc must be preconfigured Compute node external interface bonding must be preconfigured Cisco Confidential 43

44 Roadmap: OpenStack with Nexus 1000V Foundation of DC Virtual Services Architecture Management Network Replacing Open vswitch vpath Service Insertion/ Chaining VXLAN Overlay Networking CSR, VPN, Firewall, etc. nova-compute nova-compute dhcp-agent *-plugin-agent *-plugin-agent l3-agent Compute VSM/N1000V Node Compute Node Network Node nova-compute nova-compute nova-compute *-plugin-agent nova-compute *-plugin-agent *-plugin-agent *-plugin-agent Compute Compute N1000V Node Node Compute Node Compute Node nova-api nova-scheduler Neutron-server keystone mysql, rabbit... Data Network Cloud Controller Node API Network External Network Internet API Network is typically routable to enable public access Cisco Confidential 44

45 Roadmap: CSR 1000V Routing Network or Compute node(s) hosts CSR router(s) as for gateway and adjacent VLAN traffic CSR Provides per tenant isolation and full IOS capabilities including VPN, BGP, OSFP, MPLS, etc. dhcp-agent *-plugin-agent CSR 1000V VSM/N1000V Network Node Management Network nova-compute nova-compute nova-compute *-plugin-agent nova-compute *-plugin-agent *-plugin-agent *-plugin-agent Compute Compute N1000V Node Node Compute Node Compute Node nova-api nova-scheduler Neutron-server keystone mysql, rabbit... Data Network Cloud Controller Node API Network External Network Internet API Network is typically routable to enable public access Cisco Confidential 45

46 Future VxLAN termination on Nexus Compute nodes Network Node br-tun br-tun DHCP br-tun br-tun Data Network (physical) External Network Nexus 7K w/ F3, Nexus 5600 Massively Scalable Tenant Networks (16M, 16K terminated on N7K) Cisco Confidential 46

47 Thank you.