<div dir="ltr"><div><div><div>My $0.2 cents: <br><br>I echo what Maish said with regards to functionality:<br></div>- integration with HEAT is a must from Day -1 (if there is anything like this :) ) otherwise will be hard to gain operators traction. Look it as the entry point for everyone trying to move from Neutron LB<br></div>- white/ black listing traffic based on source port/ network/IP <br></div><div>- multiple FIPs associated with 1 LB, the use case is: say i have 1 LB open for port tcp 80 & udp 88 listening on 2 FIPs (even registered into a DNS) and 2 different set of clients consuming this interfaces - frontend and backend <br><br></div><div>Dani<br></div><div><br><br></div>Dani<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 21, 2015 at 10:45 PM, Brandon Logan <span dir="ltr"><<a href="mailto:brandon.logan@rackspace.com" target="_blank">brandon.logan@rackspace.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" style="font-size:12pt;color:#000000;background-color:#ffffff;font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Right now its all or nothing as far as tcp ports go. It currently does not have the functionality of white/black listinging traffic originating from a specific network.<br>
</p>
<div style="color:rgb(33,33,33)">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Maish Saidel-Keesing <<a href="mailto:maishsk@maishsk.com" target="_blank">maishsk@maishsk.com</a>><br>
<b>Sent:</b> Thursday, May 21, 2015 7:45 AM<br>
<b>To:</b> <a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a><div><div class="h5"><br>
<b>Subject:</b> Re: [openstack-dev] [lbaas] [octavia] [barbican] Relationship between Octavia and Barbican and Octavia 1.0 questions</div></div></font>
<div> </div>
</div><div><div class="h5">
<div>
<div lang="x-unicode">Thanks Brandon<br>
<br>
<div>On 05/20/15 22:58, Brandon Logan wrote:<br>
</div>
<blockquote type="cite">
<p>Just to add a few things,<br>
</p>
<p>Barbican is not yet implemented in Octavia, though the code is there, we just need to spend a few hours hooking it all up and testing it out.<br>
</p>
<p><br>
</p>
<p>Also, the security groups are used by octavia right now so that only the ports on the listener are accessible. Basically if a loadbalancer has listeners on ports 80 and 443, the vip ports will only allow traffic on those ports. It shouldn't allow other
traffic.<br>
</p>
</blockquote>
That is great to hear. I assume that if we are using security groups we will also be able to define rules regarding which networks the listeners are allowed to accept traffic from?
<br>
<br>
Is that assumption correct? <br>
<blockquote type="cite">
<p></p>
<p><br>
</p>
<p>Thanks,<br>
</p>
<p>Brandon<br>
</p>
<div style="word-wrap:break-word">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Doug Wiegley
<a href="mailto:dougwig@parksidesoftware.com" target="_blank"><dougwig@parksidesoftware.com></a><br>
<b>Sent:</b> Thursday, May 21, 2015 12:49 AM<br>
<b>To:</b> <a href="mailto:maishsk+openstack@maishsk.com" target="_blank">
maishsk+openstack@maishsk.com</a>; OpenStack Development Mailing List (not for usage questions); Maish Saidel-Keesing<br>
<b>Subject:</b> Re: [openstack-dev] [lbaas] [octavia] [barbican] Relationship between Octavia and Barbican and Octavia 1.0 questions</font>
<div> </div>
</div>
<div>Hi Maish,
<div><br>
</div>
<div>Thanks for the feedback, some answers below. Please also be aware of the lbaas use cases session tomorrow at 9am (yuck, I know), <a href="https://etherpad.openstack.org/p/YVR-neutron-lbaas-use-cases" target="_blank">https://etherpad.openstack.org/p/YVR-neutron-lbaas-use-cases</a></div>
<div><br>
</div>
<div><br>
<div>
<blockquote type="cite">
<div>On May 19, 2015, at 12:05 AM, Maish Saidel-Keesing <<a href="mailto:maishsk@maishsk.com" target="_blank">maishsk@maishsk.com</a>> wrote:</div>
<br>
<div>
<div bgcolor="#FFFFFF">Hello all,<br>
<br>
Going over today's presentation "Load Balancing as a Service, Kilo and Beyond"[1] (great presentation!!) - there are a few questions I have regarding the future release:<br>
<br>
For Octavia 1.0:<br>
<br>
1. Can someone explain to me how the flow would work for spinning up a a new Amphora with regards to interaction between Neutron, LBaaS and Barbican?<br>
Same question as well regarding how the standby is created and its relationship with Barbican.<br>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>The lbaas API runs inside neutron-server. The general flow is:</div>
<div><br>
</div>
<div>- User interacts with neutron CLI/API or horizon (in liberty), and creates an LB.</div>
<div>- Lbaas plugin in neutron creates logical models, fetches cert data from barbican, and calls the backend lbaas driver.</div>
<div>- The backend driver does what it needs to to instantiate the LB. Today this is a synchronous call that waits for the nova boot, but by Liberty, it will likely be an async call to the octavia controller to finish the job.</div>
<div><br>
</div>
<div>Once Octavia has control, it is doing:</div>
<div><br>
</div>
<div>- Get REST calls for objects,</div>
<div>- Talk to nova, spin up an amphora image,</div>
<div>- Talk to neutron, plumb in the networks,</div>
<div>- Send the amphora its config.</div>
<br>
<blockquote type="cite">
<div>
<div bgcolor="#FFFFFF"><br>
2. Will the orchestration (Heat) also be implemented when Octavia 1.0 is released or only further down the line?<br>
If not what would you suggest be the way to orchestrate LBaaS until this is ready?<br>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>We need to talk to the Heat folks and coordinate this, which we are planning to do soon.</div>
<br>
<blockquote type="cite">
<div>
<div bgcolor="#FFFFFF"><br>
3. Is there some kind of hook into Security groups also planned for the Amphora to also protect the Load Balancer?<br>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Not at present, but I recorded this in the feature list on the etherpad above.</div>
<br>
<blockquote type="cite">
<div>
<div bgcolor="#FFFFFF"><br>
I think that based on the answers to these questions above - additional questions will follow.<br>
<br>
Thanks<br>
<br>
[1] <a href="https://www.youtube.com/watch?v=-eAKur8lErU" target="_blank">
https://www.youtube.com/watch?v=-eAKur8lErU</a><br>
<div>-- <br>
Best Regards,<br>
Maish Saidel-Keesing</div>
</div>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org" target="_blank">
OpenStack-dev-request@lists.openstack.org</a>?subject:unsubscribe<br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
<br>
<div>-- <br>
Best Regards,<br>
Maish Saidel-Keesing</div>
</div>
</div>
</div></div></div>
</div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>