AGENDA Introduction Pivotal Cloud Foundry NSX-V integration with Cloud Foundry New Features in Cloud Foundry Networking NSX-T with Cloud Fou

Transcription

1 NET1523BE INTEGRATING NSX AND CLOUD FOUNDRY Usha Ramachandran Staff Product Manager, Pivotal Sai Chaitanya Product Line Manager, VMware VMworld 2017 Content: Not for publication #VMworld

2 AGENDA Introduction Pivotal Cloud Foundry NSX-V integration with Cloud Foundry New Features in Cloud Foundry Networking NSX-T with Cloud Foundry Networking 2

3 Cloud Native Model for Application Delivery Continuous Delivery Microservices Release #1 Microservices Release #2 An idea in the morning can ship by evening 3

4 Customer Personas and Needs Application Developer DEVELOPER Create applications to meet business goals Focus on business logic Tools and frameworks for easy development Write once, run anywhere Different applications types Micro-services Clustering Apps Latency-sensitive or secure services Speed and Agility Self-Service no tickets! Minimal impact during upgrades 4

5 Customer Personas and Needs Platform Operator OPERATOR Keep the platform running smoothly Platform Stability Day-2 operations Faster patching and upgrades Security Network Security Authorization and Authentication Platform Security Visibility Billing and auditing Triage and debugging 5

6 PIVOTAL CLOUD FOUNDRY VMworld 2017 Content: Not for publication 6

7 DEVELOPMENT OPERATIONS Multiple Languages Microservices Support Services Marketplace Operating System Native User Provided Partner Cloud API App Deployment & Management Availability Visibility & Administration Container Orchestration CI/CD Tools, ID, Security Health, Metrics, Patching Apps & Platform Dashboards 7

8 PCF Technical Primer Simplified view 6 cf push app_a 1 Deploy app App access 2 Uploads app and invokes scheduler Cloud Controller VMworld 2017 Load Balancer *.cfapps.cloud.com GoRouters Go Go Router Router 5 Register route: app_a.cfapps.cloud.com cell_1_ip : port_num 3 App scheduled to a container host Diego cell_1 cell N A T 4 CF app instance ( Container) stateless, aka state persisted externally Content: Not for publication 7 CF Services for persistent storage Pivotal Ops Manager and Ops Manager Director are used to install, maintain and upgrade PCF 8

9 Network Security in Cloud Foundry Using CF Application Security Groups PCF Prod PCI - Space PCF Services - PCI Net Non PCI - Space VMworld 2017 PCF Services non PCI Net Challenges ASGs Collection of egress allow rules that specify {IP CIDR, Port, Protocol} that an app can access Applied to entire foundation or at CF space level Source Destination Port and Proto Cannot specify policy at app granularity Action Any PCI Services tcp, 3306 Allow Content: Not for publication Any Any any Deny PCI and non PCI containers can share some container host Apps cannot be identified by IP or Subnet to apply ingress security 9

10 NSX-V AND Pivotal Cloud Foundry VMworld 2017 Content: Not for publication 10

11 1 PCF Infra Networking and Load Balancing requirements Four Private Networks Ops Manager Ops Man Director CC PCF Infra Network /26 Go Go Router brain brain VMworld 2017 Content: Not for 2 cell cell publication PCF Deployment Network /22 3 PCF Services Network /22 4 Other External Services /22 11

12 PCF and NSX-V Logical Networking & Load Balancing Basic Routing Design Go Router brain NSX LS Infra /26 External Network /24 Ops Manager NSX ESG VPN NSX LS External Services /22 Service Source Destination Source NAT /16 External IP 1 Dest NAT External IP 2 Ops Man IP Service VIP Pool Load Balancing External IP 3 Go Router IPs Load Balancing External IP 4 Diego Brain IPs NSX LB can either terminate SSL or be configured as passthrough (Go router terminates SSL) Design Guide coming soon! NSX LS Deployment /22 NSX LS Services /22 With Advanced Routing Designs & more 12

13 PCF Infrastructure Security Requirements Go Router brain NSX LS Infra /26 External Network /24 Ops Manager NSX ESG VPN NSX LS Ext Services /22 ESG Firewall to protect the PCF foundation Source Destin Service Actio n Any Ops_Manager SSH, HTTP, HTTPS any VIP_Go_Router HTTP, HTTPS Allow Allow Allow Allow Any Any Deny Deny oad_balancer NSX LS Deployment /22 NSX LS Services /22 13

14 Cloud Foundry Isolation Segments bbs Diego brain brain cell_1 cell PCI Isolation Segment cell_1 Non PCI Isolation Segment Isolation Segments Dedicated set of diego cells to enable compute isolation of apps Can be assigned to CF org or space Apps (and instances) in org or space will only be scheduled to their own dedicated cells Benefits Apps of different kinds can be deployed with compute isolation on shared foundation e.g. PCI and non-pci, Retail Banking and Investment Banking etc Save operational and cost overhead of maintaining multiple foundations 14

15 PCF Isolation Segments and NSX-V Ops Manager and NSX integration for CF Isolation Segments Deploy Isolation Segment VMworld 2017 Ops Manager deploys dedicated Diego cells for IS Ops Manager adds Diego cells to NSX-V SG If SG with same name as Isolation segment, exists VMs are added to SG Content: Not for publication If SG with name of Isolation Segment is not found, create SG and adds VMs As Diego Cells are added / deleted, NSX SG membership is maintained 15

16 PCF Isolation Segments and NSX-V Compute Isolation and Network Segmentation Create NSX SG for PCI & Non-PCI Create Segmentation Policy Create Isolation Segments Assign to Space or Org Deploy app Isolation Segment : PCI cell_1 DFW segmentation policy Source Destin Service Action SG_PCI PCI_Services HTTP, HTTPS Allow SG_non_PCI Non_PCI_Services HTTP, HTTPS Allow SG_PCI and SG_non_PCI cell_n NSX SG - PCI Isolation Segment : Non-PCI cell_1 cell_n NSX SG Non-PCI Shared Services Allow Any Any Deny Deny Stateful Network Segmentation & Monitoring at the Org / Space granularity 16

17 17

18 NEW FEATURES IN CLOUD FOUNDRY NETWORKING VMworld 2017 Content: Not for publication 18

19 LEGACY CLOUD FOUNDRY NETWORKING 19

20 DESIRED STATE 20

21 PCF 1.11 Networking Features c2c Connectivity CNI Silk CNI plugin Unique IP on overlay 3rd party plugins Policies App to App Dynamic CLI or API Self Service Existing Features Application Security Groups Egress Cell IP:SNAT Ingress Cell IP:DNAT 21

22 Container Networking Interface (CNI) is an industry standard API for container runtimes to call third party networking plugins 22

23 PCF 1.11 Networking cell /24 cell /24 Single Overlay network for all containers in a single foundation 2 PCF Container Network /16 2 PCF Deployment Network /22 Defaults to a /16 range to allow for ~250 cells with ~250 containers per cell Access to external services and through GoRouter continue to use the PCF Deployment Network 23

24 PCF 1.11 Policy Policy cf add-network-policy APP1 -> APP 2 Container Network APP 1 APP 2 APP 3 Cell Cell Deployment Network Ingress traffic Cell Egress traffic 24

25 POLICY CONFIGURATION Allow two apps to talk to each other $ cf add-network-policy SOURCE_APP --destination-app DESTINATION_APP [(--protocol (tcp udp) --port RANGE)] List policies $ cf network-policies [--source SOURCE_APP] Revoke the policy for two apps to talk to each other $ cf remove-network-policy SOURCE_APP --destination-app DESTINATION_APP -- protocol (tcp udp) --port RANGE 25

26 USE CASES APP 1 APP 1 frontend boot billing billing billing inventory inventory inventory inventory peer Checkout Checkout Auth Secure Microservices Direct east-west communication Private microservices do not need public routes Fine-grained application level policies Clustering Applications Same source and destination in policy peer Communicate on an TCP or UDP port 26

27 Demo 27

28 NSX-T CONTAINER NETWORKING FOR PCF VMworld 2017 Content: Not for publication 28

29 NSX-T & PCF Network & Security platform for cloud native & traditional apps NSX Network & Security Physical Network & Security VMworld 2017 CNI Integration with Cloud Foundry Native Container Networking & Security Common operational model for traditional and cloud native Content: Not for publication Integrated with data center network, tools & processes Leverage existing investments 29

30 NSX-T CONTAINER NETWORKING Two modes routed & private container network PCF Foundation 1 Network Mode : Routed Org /27 PCF Foundation 2 Network Mode : Private Org /27 SNAT IP VMworld 2017 Content: Not for Container Network integrated with Data Center Network with routing (BGP) Automated creation / deletion of container network in response to CF Org create / delete publication Private Container Network Conserve IP address space in core DC network Maintain isolation between core network & container network App identified using SNAT IP address in core network / /24 30

31 NSX-T & PCF SECURITY Cloud Native App Platform Instance 1 Namespace shopping_cart Namespace notifications Apps & Databases Cloud Native App Platform Instance n Namespace payments Namespace auth Use Cases 1 Inter Microservice same cloud native platform instance Inter Microservice multiple 2 instances of CNA platform/s 3 Microservice to VM or Database app Configuration approaches 1 CF Network Policy 2 NSX APIs DFW, Section 31

32 MONITORING FOR CLOUD NATIVE APPS Send / Receive stats for Unicast, Bcast/Mcast and Dropped traffic Traffic Mirroring VMworld 2017 Content: Not for NSX Traceflow Simulate app traffic between containers and / or VMs and identify failure points publication Rule statistics packets, bytes, sessions Syslog Container Cluster and App context in NSX NSX Search enables co-relating app and infrastructure instantaneously enabling efficient incident response 32

33 NSX-T & CLOUD NATIVE APPS Provision & manage network like cloud native apps Native Container Networking Microsegmentation for Containers NSX-T 2.0 VMworld 2017 Content: Not for Monitoring & Troubleshooting Containers publication Integration with existing tools & processes Load Balancing Reference Designs 33

34 SUMMARY Cloud Foundry and NSX together provide the agility and security required for digital transformation NSX-V with CF isolation segments provides stateful network segmentation at the org/space level Cloud Foundry has a secure and extensible networking stack that enables direct container communication based on app level policies Cloud Foundry CNI enables third party SDN integration VMworld 2017 Content: Not for publication NSX-T and Cloud Foundry CNI integration provides native container networking and security, and a common operational model across cloud native and traditional apps 34

35

36 Questions? 36

37