<div dir="ltr">I have the feeling that the discussion is diverging a bit.<div><br></div><div>John is correctly stating that with pluggable IPAM it should be possible, in theory to write a driver which interfaces to any DHCP server, providing it the information it needs to distribute addresses assigned by Neutron. This is possible in theory even if the DHCP server does not expose any sort of API - as an example you might write a driver which writes into configuration files and then restarts or reloads the DHCP server as needed, which is not very different from what we do today with Dnsmasq.</div><div><br></div><div>However, it seems to me that the gist of Padmanabhan's question is whether neutron should allow completely out of band IP address management. Neutron is evolving in a direction where this would be possible only if one considers it as a simple service for building virtualised layer-2 segments. Unless some form of interaction with the entity which manages IPs is envisioned, it would not be possible to use neutron's security and routing services.</div><div>Also, another aspect to factor in is nova. I have not checked this in a while, but I seem to recall it was not able to boot a VM with network interfaces if it did not obtain also IP addresses for such interfaces - and those IPs are indeed fetched from neutron's port info.</div><div>If I got Padmanabhan's point right then we need to discuss if and how out of band address mgmt and distribution should be supported in Neutron.</div><div><br></div><div>Regards,</div><div>Salvatore</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 5 February 2015 at 15:20, John Belamaric <span dir="ltr"><<a href="mailto:jbelamaric@infoblox.com" target="_blank">jbelamaric@infoblox.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>The pluggable IPAM [1] is intended to support the scenario you described below. That is, a fixed IP is provided for the port by IPAM, and then the DHCP server is programmed to return that IP for that MAC or DUID (for IPv6). If I understand correctly, your
concern then is:</div>
<div><br>
</div>
<div>1) The DHCP server may not allow such programming;</div>
<div>2) The DHCP server may not be able to provide an IP allocation via any means other than DHCP (ie, no API to pre-allocate the IP)</div>
<div><br>
</div>
<div>I would think then, what you are asking for is the ability to attach an interface to a layer 2 network without also giving it an IP in any subnet(s) that are on that network. Seems like a reasonable request, but I am not sure what would be involved in
implementing that.</div>
<div><br>
</div>
<div>Additionally, we would need some mechanism to update the port with the IP after it is allocated via the DHCP server. Otherwise, I don't think all the iptables rules and such will be properly configured, so you probably won't be able to pass traffic beyond
the local subnet. Not sure on that though.</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div style="font-family:HelveticaNeue,'Helvetica Neue',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px;background-color:rgb(255,255,255)">
[1] - <a rel="nofollow" shape="rect" href="http://specs.openstack.org/openstack/neutron-specs/specs/kilo/neutron-ipam.html" target="_blank">http://specs.openstack.org/openstack/neutron-specs/specs/kilo/neutron-ipam.html</a></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt"><span class="">
<span style="font-weight:bold">From: </span>Padmanabhan Krishnan <<a href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Padmanabhan Krishnan <<a href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>><br>
</span><span style="font-weight:bold">Date: </span>Thursday, February 5, 2015 at 1:47 AM<span class=""><br>
<span style="font-weight:bold">To: </span>John Belamaric <<a href="mailto:jbelamaric@infoblox.com" target="_blank">jbelamaric@infoblox.com</a>>, "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [Neutron] fixed ip info shown for port even when dhcp is disabled<br>
</span></div>
<div><br>
</div>
<div>
<div>
<div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div dir="ltr"></div>
<div>Hi John,</div>
<div>Sure, this may not be in the scope of IPAM as originally proposed in [1]. Am just trying to see if there can be a solution for this scenario using IPAM.</div>
<div><br clear="none">
</div>
<div>What I had in mind is also a centrally managed IPAM and not each VM allocating its own IP address. Let me clarify.</div>
<div> </div>
<div>It's not an uncommon requirement to use a commercial DHCP server in an enterprise/DC. I am referring to it as external DHCP server from Openstack's perspective.</div>
<div>One scenario of deployment is when IPAM is done through Openstack and in which case, the <MAC, IP, optionally segment> can be programmed in the external DHCP server, assuming they have standard API's
for that. Then, the VM will get the openstack assigned IP address from the DHCP server when it boots up. You also suggested this and sure, it's not a problem here.</div>
<div><br clear="none">
</div>
<div>Now, another scenario and that's of interest is when IPAM itself is done directly using the commercial DHCP server for various reasons. I am just trying to see how this model will work (or can be extended
to work) for this case. What's the role of pluggable IPAM [1] in this scenario? If at all there's a way to tell the external DHCP server, do your own allocation and return an IP address for me for this <MAC, segment>, then this IP address can be returned during
the allocate_ip API by the pluggable IPAM? But, I am not sure, an external DHCP server will have this flexibility.</div>
<div>Then, in such scenarios, the only way is to not allocate an IP address during create_port. When the VM comes up and sends a DHCP request the commercial DHCP server responds with an address. The pluggable
IPAM then can use its own method, and when it discovers the IP address of the VM, it can call to update_port with the IP address.</div>
<div>Any other way?</div>
<div><br clear="none">
</div>
<div>[1] - <a rel="nofollow" shape="rect" href="http://specs.openstack.org/openstack/neutron-specs/specs/kilo/neutron-ipam.html" target="_blank">http://specs.openstack.org/openstack/neutron-specs/specs/kilo/neutron-ipam.html</a></div>
<div><br clear="none">
</div>
<div>Thanks,</div>
<div>Paddu</div><div><div class="h5">
<div><br>
<br>
</div>
<div style="display:block">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px">
<div dir="ltr"><font face="Arial">On Tuesday, February 3, 2015 8:57 AM, John Belamaric <<a href="mailto:jbelamaric@infoblox.com" target="_blank">jbelamaric@infoblox.com</a>> wrote:<br>
</font></div>
<br>
<br>
<div>
<div>
<div>
<div>Hi Paddu,</div>
<div><br clear="none">
</div>
<div>I think this is less an issue of the pluggable IPAM than it is the Neutron management layer, which requires an IP for a port, as far as I know. If the management layer is updated to allow a port to exist without a known
IP, then an additional IP request type could be added to represent the placeholder you describing.</div>
<div><br clear="none">
</div>
<div>However, doing so leaves IPAM out of the hands of Neutron and out of the hands of the external (presumably authoritative) IPAM system. This could lead to duplicate IP issues since each VM is deciding its own IP without
any centralized coordination. I wouldn't recommend this approach to managing your IP space.</div>
<div><br clear="none">
</div>
<div>John</div>
<div><br clear="none">
</div>
<span></span>
<div>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Padmanabhan Krishnan <<a rel="nofollow" shape="rect" href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>><br clear="none">
<span style="font-weight:bold">Reply-To: </span>Padmanabhan Krishnan <<a rel="nofollow" shape="rect" href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>><br clear="none">
<span style="font-weight:bold">Date: </span>Wednesday, January 28, 2015 at 4:58 PM<br clear="none">
<span style="font-weight:bold">To: </span>John Belamaric <<a rel="nofollow" shape="rect" href="mailto:jbelamaric@infoblox.com" target="_blank">jbelamaric@infoblox.com</a>>, "OpenStack Development Mailing List (not for
usage questions)" <<a rel="nofollow" shape="rect" href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br clear="none">
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [Neutron] fixed ip info shown for port even when dhcp is disabled<br clear="none">
</div>
<div><br clear="none">
</div>
<div>
<div>
<div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div dir="ltr"></div>
<div>
<div>Some follow up questions on this.</div>
<div><br clear="none">
</div>
</div>
<div>
<div dir="ltr">In the specs, i see that during a "create_port", there's provisions to query the external source by "Pluggable IPAM" to return the IP.</div>
</div>
<div>
<div>This works fine for cases where the external source (say, DHCP server) can be queried for the IP address when a launch happens.</div>
<div><br clear="none">
</div>
<div dir="ltr">Is there a provision to have the flexibility of a "late IP assignment"?</div>
<div dir="ltr"><br clear="none">
</div>
</div>
<div>
I am thinking of cases, like the temporary unavailability of external IP source or lack of standard interfaces in which case data packet snooping is used to find the IP address of a VM after launch. Something similar to late binding of IP addresses.</div>
<div>
<div dir="ltr">This means the create_port may not get the IP address from the pluggable IPAM. In that case, launch of a VM (or create_port) shouldn't fail. The Pluggable IPAM should have some provision to
return something equivalent to "unavailable" during create_port and be able to do an update_port when the IP address becomes available.</div>
</div>
<div>
<br clear="none">
</div>
<div>
I don't see that option. Please correct me if I am wrong.</div>
<div>
<br clear="none">
</div>
<div>
Thanks,</div>
<div>
Paddu <br clear="none">
</div>
<div>
<br clear="none">
<br clear="none">
</div>
<div style="display:block">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px">
<div dir="ltr"><font face="Arial">On Thursday, December 18, 2014 7:59 AM, Padmanabhan Krishnan <<a rel="nofollow" shape="rect" href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>>
wrote:<br clear="none">
</font></div>
<br clear="none">
<br clear="none">
<div>
<div>
<div>
<div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div>Hi John,</div>
<div dir="ltr">Thanks for the pointers. I shall take a look and get back.</div>
<div dir="ltr"><br clear="none">
</div>
<div dir="ltr">Regards,</div>
<div dir="ltr">Paddu<br clear="none">
</div>
<div><span></span></div>
<div>
<br clear="none">
<br clear="none">
</div>
<div>
<div style="display:block">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px">
<div dir="ltr"><font face="Arial">On Thursday, December 18, 2014 6:23 AM, John Belamaric <<a rel="nofollow" shape="rect" href="mailto:jbelamaric@infoblox.com" target="_blank">jbelamaric@infoblox.com</a>>
wrote:<br clear="none">
</font></div>
<br clear="none">
<br clear="none">
<div>
<div>
<div>
<div>Hi Paddu,</div>
<div><br clear="none">
</div>
<div>Take a look at what we are working on in Kilo [1] for external IPAM. While this does not address DHCP specifically, it does allow you to use an external source to allocate the IP that OpenStack uses, which may solve your problem.</div>
<div><br clear="none">
</div>
<div>Another solution to your question is to invert the logic - you need to take the IP allocated by OpenStack and program the DHCP server to provide a fixed IP for that MAC.</div>
<div><br clear="none">
</div>
<div>You may be interested in looking at this Etherpad [2] that Don Kehn put together gathering all the various DHCP blueprints and related info, and also at this BP [3] for including a DHCP relay so we can utilize external DHCP more easily.</div>
<div><br clear="none">
</div>
<div>
<div>[1] <a rel="nofollow" shape="rect" href="https://blueprints.launchpad.net/neutron/+spec/neutron-ipam" target="_blank">
https://blueprints.launchpad.net/neutron/+spec/neutron-ipam</a></div>
</div>
<div>[2] <a rel="nofollow" shape="rect" href="https://etherpad.openstack.org/p/neutron-dhcp-org" target="_blank">https://etherpad.openstack.org/p/neutron-dhcp-org</a></div>
<div>[3] <a rel="nofollow" shape="rect" href="https://blueprints.launchpad.net/neutron/+spec/dhcp-relay" target="_blank">https://blueprints.launchpad.net/neutron/+spec/dhcp-relay</a></div>
<div><br clear="none">
</div>
<div>John</div>
<div><br clear="none">
</div>
<span></span>
<div>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Padmanabhan Krishnan <<a rel="nofollow" shape="rect" href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>><br clear="none">
<span style="font-weight:bold">Reply-To: </span>Padmanabhan Krishnan <<a rel="nofollow" shape="rect" href="mailto:kprad1@yahoo.com" target="_blank">kprad1@yahoo.com</a>>, "OpenStack Development Mailing List (not for usage
questions)" <<a rel="nofollow" shape="rect" href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br clear="none">
<span style="font-weight:bold">Date: </span>Wednesday, December 17, 2014 at 6:06 PM<br clear="none">
<span style="font-weight:bold">To: </span>"<a rel="nofollow" shape="rect" href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>" <<a rel="nofollow" shape="rect" href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br clear="none">
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [Neutron] fixed ip info shown for port even when dhcp is disabled<br clear="none">
</div>
<div><br clear="none">
</div>
<div>
<div>
<div style="color:#000;background-color:#fff;font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div dir="ltr"><span>This means whatever tools the operators are using, it need to make sure the IP address assigned inside the VM matches with Openstack has
assigned to the port.</span></div>
<div dir="ltr"><span>Bringing the question that i had in another thread on the same topic:</span></div>
<div dir="ltr"><br clear="none">
<span></span></div>
<div dir="ltr"><span>If one wants to use the provider DHCP server and not have Openstack's DHCP or L3 agent/DVR, it may not be possible to do so even with
DHCP disabled in Openstack network. Even if the provider DHCP server is configured with the same start/end range in the same subnet, there's no guarantee that it will match with Openstack assigned IP address for bulk VM launches or when there's a failure
case.</span></div>
<div dir="ltr"><span>So, how does one deploy external DHCP with Openstack?</span></div>
<div dir="ltr"><span><br clear="none">
</span></div>
<div dir="ltr"><span>If Openstack hasn't assigned a IP address when DHCP is disabled for a network, can't port_update be done with the provider DHCP specified
IP address to put the anti-spoofing and security rules?</span></div>
<div dir="ltr"><span></span></div>
<div dir="ltr">With Openstack assigned IP address, port_update cannot be done since IP address aren't in sync and can overlap.</div>
<div dir="ltr"><br clear="none">
</div>
<div dir="ltr">Thanks,</div>
<div dir="ltr">Paddu<br clear="none">
</div>
<div><br clear="none">
<br clear="none">
</div>
<div style="display:block">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px">
<div style="font-family:HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:16px">
<div>
<br clear="none">
On 12/16/14 4:30 AM, "Pasquale Porreca" <<a rel="nofollow" shape="rect" href="mailto:pasquale.porreca@dektech.com.au" target="_blank">pasquale.porreca@dektech.com.au</a>><br clear="none">
wrote:<br clear="none">
<br clear="none">
>I understood and I agree that assigning the ip address to the port is<br clear="none">
>not a bug, however showing it to the user, at least in Horizon dashboard<br clear="none">
>where it pops up in the main instance screen without a specific search,<br clear="none">
>can be very confusing.<br clear="none">
><br clear="none">
>On 12/16/14 12:25, Salvatore Orlando wrote:<br clear="none">
>> In Neutron IP address management and distribution are separated<br clear="none">
>>concepts.<br clear="none">
>> IP addresses are assigned to ports even when DHCP is disabled. That IP<br clear="none">
>> address is indeed used to configure anti-spoofing rules and security<br clear="none">
>>groups.<br clear="none">
>> <br clear="none">
>> It is however understandable that one wonders why an IP address is<br clear="none">
>>assigned<br clear="none">
>> to a port if there is no DHCP server to communicate that address.<br clear="none">
>>Operators<br clear="none">
>> might decide to use different tools to ensure the IP address is then<br clear="none">
>> assigned to the instance's ports. On XenServer for instance one could<br clear="none">
>>use a<br clear="none">
>> guest agent reading network configuration from XenStore; as another<br clear="none">
>> example, older versions of Openstack used to inject network<br clear="none">
>>configuration<br clear="none">
>> into the instance file system; I reckon that today's configdrive might<br clear="none">
>>also<br clear="none">
>> be used to configure instance's networking.<br clear="none">
>> <br clear="none">
>> Summarising I don't think this is a bug. Nevertheless if you have any<br clear="none">
>>idea<br clear="none">
>> regarding improvements on the API UX feel free to file a bug report.<br clear="none">
>> <br clear="none">
>> Salvatore<br clear="none">
>> <br clear="none">
>> On 16 December 2014 at 10:41, Pasquale Porreca <<br clear="none">
>> <a rel="nofollow" shape="rect" href="mailto:pasquale.porreca@dektech.com.au" target="_blank">
pasquale.porreca@dektech.com.au</a>> wrote:<br clear="none">
>>><br clear="none">
>>> Is there a specific reason for which a fixed ip is bound to a port on a<br clear="none">
>>> subnet where dhcp is disabled? it is confusing to have this info shown<br clear="none">
>>> when the instance doesn't have actually an ip on that port.<br clear="none">
>>> Should I fill a bug report, or is this a wanted behavior?<br clear="none">
>>><br clear="none">
>>> --<br clear="none">
>>> Pasquale Porreca<br clear="none">
>>><br clear="none">
>>> DEK Technologies<br clear="none">
>>> Via dei Castelli Romani, 22<br clear="none">
>>> 00040 Pomezia (Roma)<br clear="none">
>>><br clear="none">
>>> Mobile <a href="tel:%2B39%203394823805" value="+393394823805" target="_blank">+39 3394823805</a><br clear="none">
>>> Skype paskporr<br clear="none">
>>><br clear="none">
>>> _______________________________________________<br clear="none">
>>> OpenStack-dev mailing list<br clear="none">
>>> <a rel="nofollow" shape="rect" href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">
OpenStack-dev@lists.openstack.org</a><br clear="none">
>>> <a rel="nofollow" shape="rect" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br clear="none">
>>><br clear="none">
>> <br clear="none">
>> <br clear="none">
>> <br clear="none">
>> _______________________________________________<br clear="none">
>> OpenStack-dev mailing list<br clear="none">
>> <a rel="nofollow" shape="rect" href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">
OpenStack-dev@lists.openstack.org</a><br clear="none">
>> <a rel="nofollow" shape="rect" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br clear="none">
>> <br clear="none">
><br clear="none">
>-- <br clear="none">
>Pasquale Porreca<br clear="none">
><br clear="none">
>DEK Technologies<br clear="none">
>Via dei Castelli Romani, 22<br clear="none">
>00040 Pomezia (Roma)<br clear="none">
><br clear="none">
>Mobile <a href="tel:%2B39%203394823805" value="+393394823805" target="_blank">+39 3394823805</a><br clear="none">
>Skype paskporr<br clear="none">
><br clear="none">
>_______________________________________________<br clear="none">
>OpenStack-dev mailing list<br clear="none">
><a rel="nofollow" shape="rect" href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br clear="none">
><a rel="nofollow" shape="rect" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br clear="none">
<br clear="none">
<br clear="none">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br clear="none">
<br clear="none">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br clear="none">
<br clear="none">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<br>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
</div>
</span>
</div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>