Salvatore,<div><br></div><div>This is a very interesting concept... I can see it being useful in our production environments...</div><div><br></div><div>I wonder if we can make this a bit more general than "public or not"... Think about a generic ownership and "mode bits" concept of networks.</div>
<div><br></div><div>For example, the infrastructure owner can create a public network, to your point, that every tenant can see, plug into, but nothing else. For a network created by a tenant, it is by default only seen by itself. But it might be interesting for this tenant to allow other tenants to see or plug into that network.</div>
<div><br></div><div>What do you think?</div><div><br></div><div>Thanks.</div><div>-Simon</div><div><br><div class="gmail_quote">On Fri, Jul 20, 2012 at 10:24 AM, Lew Tucker <span dir="ltr"><<a href="mailto:lewtucker@yahoo.com" target="_blank">lewtucker@yahoo.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">We might want to think a bit about words here. I believe it would be less confusing to call this something else such as a "shared" network instead of public. As Salvatore indicates below, this is simply a network that is "shared among several tenants". A common use case as given by the blueprint is to allow tenant access to service-provider created networks. By calling it a public network, many would assume Internet access. I believe this capability is very important as it could open up the possibility not only for the service provider but also for one tenant to offer services to others by allowing multiple tenants to connect to a shared network without using public IP addresses. Perhaps for right now, the authZ work could simply support sharing with "All", but this could be refined later so that the owner of a shared network could implement finer-grained control such that only certain tenants (e.g. subscribers) could create ports.<div>
<span class="HOEnZb"><font color="#888888"><div><br></div><div>-Lew</div></font></span><div><div class="h5"><div><br><div><br></div><div><br><div><div>On Jul 19, 2012, at 5:16 PM, Salvatore Orlando wrote:</div><br><blockquote type="cite">
Indeed, "public" in our context means "shared among several tenants". We are not dealing with tenant access to the Internet or direct association of VIF to public IP addresses.<div><br></div><div>The basic model is still the 'guest network' model. This blueprint, for which some code is already available on gerrit, just addresses the authZ work necessary for ensuring multiple tenants can share the same network object.</div>
<div><br></div><div>Salvatore<br><br><div class="gmail_quote">On 19 July 2012 17:03, Tomoe Sugihara <span dir="ltr"><<a href="mailto:tomoe@midokura.com" target="_blank">tomoe@midokura.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hi Dan,<br>
<div><br>
On Thu, Jul 19, 2012 at 11:58 PM, Dan Wendlandt <<a href="mailto:dan@nicira.com" target="_blank">dan@nicira.com</a>> wrote:<br>
><br>
><br>
> On Tue, Jul 17, 2012 at 7:39 PM, Tomoe Sugihara <<a href="mailto:tomoe@midokura.com" target="_blank">tomoe@midokura.com</a>> wrote:<br>
>><br>
>> Hi Salvatore,<br>
>><br>
>> I have a few questions regarding your proposal mostly related to L3<br>
>> services.<br>
>> I've read in another thread that L3 services are out of Quantum's scope<br>
>> for<br>
>> Folsom<br>
><br>
><br>
> Actually, for Folsom-3 we are working on a blueprint<br>
> (<a href="https://blueprints.launchpad.net/quantum/+spec/quantum-l3-fwd-nat" target="_blank">https://blueprints.launchpad.net/quantum/+spec/quantum-l3-fwd-nat</a>) to<br>
> support the simple L3 and NAT/Floating-IP forwarding available in Nova (plus<br>
> a bit more flexibility).<br>
<br>
</div>Thanks for the info. This is very good to know.<br>
Now I'm assuming that *public* network just as the legacy network<br>
still get private IP prefix and they can have floating ip associated.<br>
Let me know if I'm missing something.<br>
<br>
Thanks,<br>
Tomoe<br>
<div><div><br>
<br>
><br>
> Dan<br>
><br>
><br>
>><br>
>> but I'd like to know how this publ networks?<br>
>><br>
>><br>
>> - How does VM on public network get internet connectivity? Would it<br>
>> get private IP<br>
>> first and then floating IP associated with it just as legacy<br>
>> nova+quantum network,<br>
>> or would public network get public IP connectivity directly?<br>
>><br>
>> - What about the non-public networks? Would VMs on non-public<br>
>> networks be able to<br>
>> get internet connectivity with floating ip and masquerading using<br>
>> nova-network? Or<br>
>> they wouldn't get internet access because it's not public?<br>
>><br>
>><br>
>> 2. How ports in a public network for different tenants are isolated? or<br>
>> not isolated at all?<br>
>><br>
>> If I understand correctly, ports on the same quantum network should<br>
>> get virtual L2<br>
>> connectivity (within a single broadcast domain). So I'm assuming that<br>
>> ports on the same network<br>
>> are not isolated (unless security groups rules are enforced).<br>
>> But shouldn't those port be isolated? If so, wouldn't that cause semantic<br>
>> change to quantum network?<br>
>><br>
>><br>
>> Cheers,<br>
>> Tomoe<br>
>><br>
>> On Thu, Jul 12, 2012 at 11:30 AM, Salvatore Orlando <<a href="mailto:sorlando@nicira.com" target="_blank">sorlando@nicira.com</a>><br>
>> wrote:<br>
>> > Re-including openstack ML in the loop, as several Quantum contributors<br>
>> > might<br>
>> > not yet be registered to openstack-dev.<br>
>> ><br>
>> > Apologies for spamming.<br>
>> ><br>
>> > Salvatore<br>
>> ><br>
>> > ---------- Forwarded message ----------<br>
>> > From: Yong Sheng Gong <<a href="mailto:gongysh@cn.ibm.com" target="_blank">gongysh@cn.ibm.com</a>><br>
>> > Date: 11 July 2012 19:10<br>
>> > Subject: Re: [Openstack] [Quantum] Public Network spec proposal<br>
>> > To: Salvatore Orlando <<a href="mailto:sorlando@nicira.com" target="_blank">sorlando@nicira.com</a>><br>
>> > Cc: <a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a><br>
>> ><br>
>> ><br>
>> > See inline comments.<br>
>> ><br>
>> > Thanks<br>
>> ><br>
>> ><br>
>> ><br>
>> > -----Salvatore Orlando <<a href="mailto:sorlando@nicira.com" target="_blank">sorlando@nicira.com</a>> wrote: -----<br>
>> > To: Yong Sheng Gong/China/IBM@IBMCN<br>
>> > From: Salvatore Orlando <<a href="mailto:sorlando@nicira.com" target="_blank">sorlando@nicira.com</a>><br>
>> > Date: 07/12/2012 09:11AM<br>
>> > Cc: <a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a><br>
>> > Subject: Re: [Openstack] [Quantum] Public Network spec proposal<br>
>> ><br>
>> ><br>
>> > Yong,<br>
>> > thanks for your feedback. See my comments inline.<br>
>> ><br>
>> > Sorry for sending the previous email to the wrong list!<br>
>> > Yong, thanks for fixing the recipients.<br>
>> ><br>
>> > On 11 July 2012 17:38, Yong Sheng Gong <<a href="mailto:gongysh@cn.ibm.com" target="_blank">gongysh@cn.ibm.com</a>> wrote:<br>
>> >><br>
>> >> Hi,<br>
>> >> Thanks for the spec<br>
>> >> Below is my understanding about it:<br>
>> >><br>
>> >> About POST network:<br>
>> >><br>
>> >> quantum net-create --tenant_id mynet --public True<br>
>> ><br>
>> ><br>
>> > Sounds correct, but I think that the convention with boolean attributes<br>
>> > is<br>
>> > that if they're specified on the command line then they're true,<br>
>> > otherwise<br>
>> > false.<br>
>> > so the above command could become:<br>
>> ><br>
>> > quantum net-create --tenant_id mynet --public<br>
>> > [yong sheng gong] As you know, bool has just two values True or False,<br>
>> > we<br>
>> > should use three logic here, True, False or not specified.<br>
>> > True mean we list only public networks, False means we show only private<br>
>> > networks, not specified mean we don't care if the network is public or<br>
>> > private.<br>
>> >><br>
>> >><br>
>> >> About GET networks:<br>
>> >><br>
>> >> qantum net-list --tenant_id myid<br>
>> >> which should return all the networks owned by myid and public networks.<br>
>> >> quantum net-list --tenant_id myid --public True<br>
>> >> which should return only public networks.<br>
>> >><br>
>> >> quantum net-list --tenant_id myid --public False<br>
>> >> which should return the non-public networks owned by myid.<br>
>> >> quantum net-list<br>
>> >> Which should return only public networks if there is no tenant_id in<br>
>> >> context.<br>
>> ><br>
>> ><br>
>> > I am still a bit undecided concerning the CLI syntax for this operation.<br>
>> > My current thinking is:<br>
>> ><br>
>> > quantum net-list --tenant_id myid<br>
>> > - return private networks for tenant my_id<br>
>> > quantum net-list --public<br>
>> > - return public networks (--tenant_id, if specified is ignored).<br>
>> ><br>
>> > The drawback is that we will need two calls for knowing all the<br>
>> > networks,<br>
>> > private and public, a tenant has access to. I have a similar dilemma in<br>
>> > the<br>
>> > filter discussion on the spec.<br>
>> > What's your opinion?<br>
>> > [yong sheng gong] with my three logics, we need only one call.<br>
>> ><br>
>> >><br>
>> >> About subnets<br>
>> >><br>
>> >> Only the public networks' owner can operate(create/list/show/update)<br>
>> >> subnets for public network.<br>
>> ><br>
>> ><br>
>> > Correct<br>
>> >><br>
>> >> About create Port<br>
>> >><br>
>> >> Public networks' owner can create port normally, I mean they can<br>
>> >> specify<br>
>> >> fixed_ip, mac and other stuff.<br>
>> >> Other tenant can create port under public network but he cannot specify<br>
>> >> the fixed_ip, mac. How fixed_ip and mac are populated?<br>
>> >><br>
>> >> Are they still allocated auto just the same way when we create the<br>
>> >> normal<br>
>> >> port?<br>
>> ><br>
>> ><br>
>> > Correct, they are autogenerated.<br>
>> ><br>
>> >><br>
>> >> I think we can disallow other tenant to create port under public<br>
>> >> network.<br>
>> >> If they need to use public network's ports, they can get them from<br>
>> >> public<br>
>> >> network's owner.<br>
>> ><br>
>> ><br>
>> > This would simplify a lot the authZ scenario. I am not sure whether this<br>
>> > would work for our use cases.<br>
>> > My concerns are:<br>
>> > 1) If we restrict port creation to the owner of the network we would<br>
>> > probably need the owner to "pre allocate" a number of ports for tenants<br>
>> > to<br>
>> > use<br>
>> > [yong sheng gong] if not pre allocate, the port with specified ip will<br>
>> > not<br>
>> > work since customer tenant cannot create port with specified ip.<br>
>> > 2) We should still allow the PUT operation to normal tenants, as they<br>
>> > will<br>
>> > set the device_id of the VM they've attached to the port.<br>
>> > [yong sheng gong] Yes. PUT is should be allowed on device_id field of<br>
>> > port<br>
>> ><br>
>> > Nevertheless, the proposed change to the design is valuable in my<br>
>> > opinion,<br>
>> > and I am very keen to hear what the other members of the community think<br>
>> > of<br>
>> > it.<br>
>> ><br>
>> >><br>
>> >> So the scenario looks like this:<br>
>> >> 1. public owner creates public network<br>
>> >> 2. public owner creates subnets under the public network<br>
>> >> 3. public owner creates port, with fixed_ip, mac and other stuff<br>
>> >> populated.<br>
>> >> 4. other tenant asks for using the port under the public network<br>
>> >> 5. public owner assigns a port to the customer tenant<br>
>> ><br>
>> ><br>
>> > Do you mean that in this step the ownership of the port object is give<br>
>> > to<br>
>> > the tenant?<br>
>> > [Yong sheng gong] I think ownership is not given up. We just add one<br>
>> > more<br>
>> > field to record who is using this port. After that the 'quantum<br>
>> > port-list<br>
>> > --tenant_id' should also have --public options to show ports assigned to<br>
>> > the<br>
>> > tenant.<br>
>> ><br>
>> >><br>
>> >> 6. customer tenant associates its instance to the port. At this time,<br>
>> >> the<br>
>> >> port's devise_id is populated<br>
>> >><br>
>> >> With this scenario:<br>
>> >> 1. nova integration<br>
>> >> we can specify the ports when booting an instance.<br>
>> >> so except nova boot --nic net-id=privatenetworkid,ipv4-ip=ip1<br>
>> >> we have nova boot --nic port-id=portid.<br>
>> >> where the portid can be a port under a public network and a port under<br>
>> >> a<br>
>> >> private network.<br>
>> >><br>
>> >> Thanks<br>
>> >> Yong Sheng Gong<br>
>> >><br>
>> >> -----openstack-bounces+gongysh=<a href="mailto:cn.ibm.com@lists.launchpad.net" target="_blank">cn.ibm.com@lists.launchpad.net</a> wrote:<br>
>> >> -----<br>
>> >> To: openstack <<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>><br>
>> >> From: Salvatore Orlando<br>
>> >> Sent by: openstack-bounces+gongysh=<a href="mailto:cn.ibm.com@lists.launchpad.net" target="_blank">cn.ibm.com@lists.launchpad.net</a><br>
>> >> Date: 07/12/2012 06:59AM<br>
>> >> Subject: [Openstack] [Quantum] Public Network spec proposal<br>
>> >><br>
>> >><br>
>> >> Hi,<br>
>> >><br>
>> >> A proposal for the implementation of the public networks feature has<br>
>> >> been<br>
>> >> published.<br>
>> >> It can be reached from the quantum-v2-public-networks blueprint page<br>
>> >> [1].<br>
>> >> Feedback is more than welcome!<br>
>> >><br>
>> >> Regards,<br>
>> >> Salvatore<br>
>> >><br>
>> >> [1]:<br>
>> >><br>
>> >> <a href="https://blueprints.launchpad.net/quantum/+spec/quantum-v2-public-networks" target="_blank">https://blueprints.launchpad.net/quantum/+spec/quantum-v2-public-networks</a><br>
>> >> _______________________________________________<br>
>> >> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> >> Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
>> >> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> >> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
>> ><br>
>> ><br>
>> ><br>
>> ><br>
>> > _______________________________________________<br>
>> > Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> > Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
>> > Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> > More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
>> ><br>
>><br>
>> _______________________________________________<br>
>> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
>> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
>> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
><br>
><br>
><br>
><br>
> --<br>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
> Dan Wendlandt<br>
> Nicira, Inc: <a href="http://www.nicira.com/" target="_blank">www.nicira.com</a><br>
> twitter: danwendlandt<br>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
><br>
</div></div></blockquote></div><br></div>
_______________________________________________<br>Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</blockquote></div><br></div></div></div></div></div></div><br>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><br></div>