Let's talk about this at the team meeting. I think Mark is asking essentially the same thing I was asking in a previous thread last week. <div><br></div><div>Dan</div><div><br></div><div><br><div class="gmail_quote">On Mon, Feb 4, 2013 at 8:48 AM, Ilya Shakhat <span dir="ltr"><<a href="mailto:ishakhat@mirantis.com" target="_blank">ishakhat@mirantis.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Maybe I don't see it quite correctly, but both L3 and DHCP agents operate with processes running on network controller, however HAProxy is VM that is launched on demand by Nova and it is not planned to contain any of OpenStack modules. That's why we faced the need to be able to communicate between host and tenant networks. The most similar code is from 'quantum-debug ping-all', where a new port is created inside target network and then command is executed in shell (using ip netns if needed).<span class="HOEnZb"><font color="#888888"><div>
<br></div></font></span><div><span class="HOEnZb"><font color="#888888">Ilya</font></span><div><div class="h5"><br><br><div class="gmail_quote">2013/2/4 Mark McClain <span dir="ltr"><<a href="mailto:mark.mcclain@dreamhost.com" target="_blank">mark.mcclain@dreamhost.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Why do you need to access tenant VMs? Could you not use namespaces on a network host(s) and let the HAProxy agent manipulate the processes directly. This is how the L3 and DHCP agents work. Namespaces also require less resources than using service VMs.<div>
<br></div><div>mark</div><div><br></div><div><br><div><div><div><div>On Feb 4, 2013, at 8:06 AM, Oleg Bondarev <<a href="mailto:obondarev@mirantis.com" target="_blank">obondarev@mirantis.com</a>> wrote:</div>
<br></div></div><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
<div><div><div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Hi guys,<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Within LBaaS effort we need to configure HAProxy service which is running on one of tenant’s VMs in a certain subnet.<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">
Initially we were planning to configure two interfaces on such HAProxy VMs – one for tenant network and other for provider network – thus having an ability to simply reach the VM by ssh using an ip from provider network.<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">But finally we found this way inappropriate because it overloads provider network and provides an ability to a tenant to access provider network which is not good as well.<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">So I’d like to find a proper way of reaching tenant’s VM to be able to execute commands on it.<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">In Quantum code I found that it can be done by using ‘ip netns exec’ (quantum/debug/debug_agent.py: QuantumDebugAgent.exec_command()) which is close to what I need. Are there any better ways to do it in quantum?<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Thanks,<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">
Oleg<u></u><u></u></div></div></div></div>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" style="color:purple;text-decoration:underline" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" style="color:purple;text-decoration:underline" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></div></blockquote>
</div><br></div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>Dan Wendlandt <div>Nicira, Inc: <a href="http://www.nicira.com" target="_blank">www.nicira.com</a><br><div>twitter: danwendlandt<br>
~~~~~~~~~~~~~~~~~~~~~~~~~~~<br></div></div>
</div>