FloatingIP Enhancement For Public Cloud Infrastructure

Transcription

1 FloatingIP Enhancement For Public Cloud Infrastructure June 4, 2015 Yushiro Furukawa Fujitsu Limited 0

2 Who am I? Yushiro Furukawa (Speaker) Software Engineer of Fujitsu from 2011 Developer of OpenStack Neutron Characteristics Red glasses frame 1

3 Agenda 1. OpenStack Neutron Overview 2. FloatingIP allocation with public cloud infrastructure 3. Legacy Router and DVR 2

4 OpenStack Neutron Overview 3

5 OpenStack Neutron 4

6 OpenStack Neutron Provide L2 / L3 networking Network isolation between tenants vrouter, NAT DHCP server Firewall FloatingIP Etc Connectable for VM Instances created by Nova. 5

7 Neutron Components (Legacy Router) API network External network eth0 eth0 Controller Node Compute Node Network Node Neutron Server ML2 plugin ML2 plugin OVS-agent ML2 plugin OVS-agent L3-agent DHCP-agent Metadata-agent eth1 eth1 eth2 eth1 eth2 Management network Data network 6

8 Neutron services Internet External Network vrouter Tenant Firewall Subnet Network Security-group Port VM Instance Security-group Port VM Instance 7

9 Neutron virtual networking services Internet External Network Network Virtual L2 network Tenant vrouter Port Firewall Subnet Connects a VM instance and Network Able to attach Security-Group Network Subnet Security-group Port VM Instance Security-group Port VM Instance IP address pool Provides an IP address for Port 8

10 Neutron extension services vrouter Internet External Network Tenant vrouter Connects Networks, also Network and External network. External Network Virtual L2 network between the Internet and tenants Firewall Security-group Port VM Instance Network Subnet Security-group Port VM Instance FloatingIP Will be explained later Security-group Works on Port Filters ingress/egress packets Uses a White-list for filtering Firewall Works on vrouter Filters packets 9

11 FloatingIP Allocation For Public Cloud Infrastructure 10

12 What is FloatingIP? In public cloud, GlobalIP is usually used as FloatingIP. We can associate a FloatingIP with a specific Port. vrouter Network Internet External Network /24 FloatingIP Port Port Port Port Port Port localip: Tenant:A localip: Tenant:B 11

13 Setup steps 1. Create a FloatingIP $ neutron floatingip-create FLOATING_NETWORK 2. Associate the FloatingIP with a Port of a VM instance. $ neutron floatingip-associate FLOATINGIP_ID PORT vrouter Network Internet External Network /24 1 Port Port Port Port Port Port localip: Tenant:A localip: Tenant:B 12

14 How FloatingIP works? SNAT and DNAT rule are added into vrouters. vrouter Internet SNAT and DNAT localip FloatingIP Network Port Port Port Port Port Port localip: localip: Tenant:A Tenant:B 13

15 Case-1: Single External Network GlobalIP is used as FloatingIP. FloatingIP address is allocated from the Subnet. IP address for physical network devices is manually picked up from the IP addresses in the Subnet. Meaning the cloud provider has to make sure to avoid overlapping External Network Subnet /24 vrouter Network Physical Network Devices Internet Port Port Port 14

16 Case-1: Single External Network GlobalIP is used as FloatingIP. FloatingIP address is allocated from the Subnet. IP address for physical network devices is manually picked up from the IP addresses in the Subnet. This increases complexity of address allocation algorithm External Network Subnet /24 vrouter Network Physical Network Devices Internet Port Port Port 15

17 Proposal of Case-1 GlobalIP is used as FloatingIP. Use PrivateIP for vrouters and physical routers. Create FloatingIP Pool for FloatingIP allocation. The cloud provider no longer has to be worried about overlapping External Network FloatingIP pool /24 subnet /24 vrouter Network Port Port vnic Port Physical Network Devices Internet 16

18 Case-2: Multiple External Networks GlobalIP is used as FloatingIP. There can be a case where several external networks exist in the infrastructure for some reasons External Network External Network vrouter subnet /24 subnet /24 Network Port Port vnic Port Physical Physical Network Devices Network Devices Internet 17

19 Case-2: Multiple External Networks GlobalIP is used as FloatingIP. There can be a case where several external networks exist in the infrastructure for some reasons Tenant-user have to select which external network to connect to, but it s just a burden tenant users shouldn t be take External Network External Network vrouter subnet /24 subnet /24 Network Port Port vnic Port Physical Physical Network Devices Network Devices Internet 18

20 Proposal of Case-2 Abstract the External Network Tenant-users can see only one abstracted external network FloatingIP pool simplifies the mechanism of the Abstracted External Network. Without FloatingIP pool, each External network has a Subnet, and the Abstracted External Network needs to select which Subnet to use... subnet /24 External Network Abstracted External Network External Network subnet /24 FloatingIP pool /24 vnic Port vnic Port vnic Port vrouter Network Physical Physical Network Devices Network Devices Internet 19

21 However. I have been thinking about FloatingIP enhancement for legacy router configuration. DVR is becoming the de facto standard configuration, and now I also should consider to develop the enhancement on DVR. DVR? 20

22 DVR (Distributed Virtual Router) Enhancement 21

23 Neutron Components (Legacy-Router) API network External network eth0 eth0 Controller Node Compute Node Network Node Neutron Server ML2 plugin ML2 plugin OVS-agent ML2 plugin OVS-agent L3-agent DHCP-agent Metadata-agent eth1 eth1 eth2 eth1 eth2 Management network Data network 22

24 Neutron Components (DVR) API network External network eth0 eth0 eth0 Controller Node Compute Node Network Node Neutron Server ML2 plugin ML2 plugin OVS-agent L3-agent Metadata-agent ML2 plugin OVS-agent L3-agent (SNAT) DHCP-agent eth1 eth1 eth2 eth1 eth2 Management network Data network 23

25 Network Traffic on Legacy Router Compute Node#1 Compute Node#2 Network Node Main characteristic: vrouter only exists on Network Node. All network traffic must go through Network Node. East-West (between different Subnets) North-South (between the Internet and tenants using FloatingIP or SNAT) => Can be a performance bottle neck. Network Node is also Single-Point-of-Failure. 24

26 Network Traffic on DVR Compute Node#1 Compute Node#2 SNAT Network Node Main characteristic: vrouter exists on all Compute Nodes. Basically, Network traffic only has to go through Network Node when the traffic goes to the Internet using SNAT => Performance can scale more. 25

27 Network Traffic Case#1 Between VMs in the same Subnet and host Legacy Router: to Compute Node#1 Compute Node#2 Network Node DVR: to fip SNAT Compute Node#1 Compute Node#2 26 Network Node

28 Network Traffic Case#2 Between VMs in the same Subnet, but in Different hosts Legacy Router: to Compute Node#1 Compute Node#2 Network Node DVR: to fip SNAT Compute Node#1 Compute Node#2 27 Network Node

29 Network Traffic Case#3 Between VMs in the same hosts, but in different Subnets Legacy Router: to Compute Node#1 Compute Node#2 Network Node DVR: to fip SNAT Compute Node#1 Compute Node#2 28 Network Node

30 Network Traffic Case#4 Between VMs in different Subnets and hosts Legacy Router: to Compute Node#1 Compute Node#2 Network Node DVR: to fip SNAT Compute Node#1 Compute Node#2 29 Network Node

31 Network Traffic Case#5 Between the External Network and a VM using FloatingIP Legacy Router: to external Compute Node#1 Compute Node#2 Network Node DVR: to external fip SNAT Compute Node#1 Compute Node#2 30 Network Node

32 Network Traffic Case#6 VM booting: a VM accesses to DHCP server Legacy Router: is booted from Nova DHCP Compute Node#1 Compute Node#2 Network Node DVR: is booted from Nova fip DHCP Compute Node#1 Compute Node#2 31 Network Node

33 Network Traffic Case#7 VM booting: a VM gets metadata from the vrouter Legacy Router DHCP DVR Compute Node#1 Compute Node#2 Network Node fip DHCP Compute Node#1 Compute Node#2 32 Network Node

34 Proposal: Distributed DHCP agent and L3-agent API network External network eth0 eth0 eth0 Controller Node Compute Node Network Node Neutron Server ML2 plugin ML2 plugin OVS-agent L3-agent DHCP-agent Metadata-agent ML2 plugin OVS-agent L3-agent (SNAT) DHCP-agent eth1 eth1 eth2 eth1 eth2 Management network Data network 33

35 Elimination of Network Node Distribute DHCP-agent to each Compute Node. => Reduce DHCP broadcast in Data Network Move SNAT function to Compute Node. => Can eliminate Single-point-of-failure Once completes this enhancement, I ll work on FloatingIP enhancement for DVR SNAT br-tun SNAT br-tun fip fip DHCP Compute Node#1 DHCP Compute Node#2 34

36