<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>My use case is supporting mixed hardware environments with hardware that has greater network capabilities and hardware without these capabilities without limiting my all my equipment to the lowest common feature set. The use case I’m describing will have
some nodes configured with the neutron multi-tenant driver (generic hardware, smart switch) and some nodes configured with a custom neutron multi-tenant+cisco magic network driver (cisco hardware, smart switch).</div>
<div><br>
</div>
<div>Perhaps a it’ll be clearer to understand why we need the driver in the patches if I give a description of the network drivers and why we’re adding them, and how I see the the current patches working in an upgrade scenario: </div>
<div><br>
</div>
<div><b>Flat</b></div>
<div>This matches the existing networking implementation in Ironic today, but with added validation on conductor start to ensure that Ironic is configured correctly (cleaning_network_uuid set) to support this feature.</div>
<div><br>
</div>
<div><b>None</b></div>
<div>This is what standalone users have been faking by setting the DHCP provider to None for a long time. The reason this worked before is because DHCP providers did more than just set DHCP options and actually started configuring the cleaning network, this
job is now superseded by the network provider, so we need a true no-op driver for when configuring cleaning networks is deprecated out of the DHCP provider interface.</div>
<div><br>
</div>
<div><b>Neutron</b></div>
<div>Multi-tenant neutron network support</div>
<div><br>
</div>
<div>The problem I see is that the existing networking behaviour in Ironic is implicit and affected by different things (DHCP Provider, cleaning enabled/disabled etc, what driver I’ve configured on the node). I believe that the upgrade process can be handled
in a sane way by doing a data migration as part of the upgrade and maintaining awareness about what configuration options a user has set and what that means their previous configuration actually was, for example:</div>
<div><br>
</div>
<div>DHCP Provider: None -> No neutron integration -> Configure existing nodes to None to match what they’ve actually been getting because of their configuration</div>
<div>DHCP Provider: Neutron -> Existing neutron integration -> Configure existing nodes to Flat to match what they’ve been getting because of their configuration</div>
<div><br>
</div>
<div>That was the easy part, to make existing nodes continue to work as before. Now we have to consider what happens when we create a new node in Ironic after we’ve upgraded, and I think that Ironic should behave as such:</div>
<div><br>
</div>
<div>DHCP Provider: None, No network interface in request -> Still no expressed neutron integration -> Configure node to None because no neutron integration expressed</div>
<div>DHCP Provider: Neutron, No network interface in request -> Basic neutron integration implied by DHCP provider -> Configure node to Flat to match how Ironic works today</div>
<div>DHCP Provider: Neutron, network interface in request -> Basic neutron integration implied by DHCP provider, but network interface in request takes priority -> Configure node to requested network interface</div>
<div><br>
</div>
<div>I suggest we maintain this behaviour for at least a cycle to allow for people to upgrade and maintain current functionality and then we can work out what we want to do with DHCP providers and the default network interface configuration.</div>
<div><br>
</div>
<div>I personally hate the current DHCP provider concept and once we introduce the new network interfaces and deprecate cleaning from the existing DHCP providers I believe we should consider the DHCP provider's usefulness. We have to maintain the current driver
interface as it is today for backward compatibility for those who have out of tree DHCP providers. But I believe that it is heavily tied to both the network interface you pick for a node, and also the PXE boot interface (we do not need DHCP options set for
virtual media boot for example). I personally have been considering whether it should actually be configured has part of the driver_info when a node is configured for PXE boot or have the logic merged into the network interfaces itself.</div>
<div><br>
</div>
<div>Sam</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div>
<div>On 28/06/2016 18:28, "Vladyslav Drok" <<a href="mailto:vdrok@mirantis.com">vdrok@mirantis.com</a>> wrote:</div>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div>
<div dir="ltr">
<div class="gmail_default" style="font-size:large">Thanks for bringing this up Dmitry, here are my thoughts on this.</div>
<div class="gmail_default" style="font-size:large"><br>
</div>
<div class="gmail_default" style="font-size:large">Another case is an out-of-tree network driver, that can basically do whatever an operator needs to, and may have some parameters defined in driver_info as is the case for most of other interfaces ironic drivers
have.</div>
<div class="gmail_default" style="font-size:large"><br>
</div>
<div class="gmail_default" style="font-size:large">I think neutron and flat drivers coexistence in the same deployment is unlikely, but neutron and none or flat and none seems to be valid case. As for nova, this might be as easy as adding an availability zone
with nodes that have network isolation enabled.</div>
<div class="gmail_default" style="font-size:large"><br>
</div>
<div class="gmail_default" style="font-size:large">Also, with all the driver composition work, I think we don't want to have some weird things like dhcp providers anymore and go further with interfaces. And if it is an interface, it should be considered as
such (the basic spec containing most of the requirements is merged, and we can use it to make network interface as close to the spec as possible, while not going too far, as multitenancy slipping another release would be very bad). There might be some caveats
with backwards compatibility in this particular case, but they're all solvable.</div>
<div class="gmail_default" style="font-size:large"><br>
</div>
<div class="gmail_default" style="font-size:large">Thanks,</div>
<div class="gmail_default" style="font-size:large">Vlad</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Jun 28, 2016 at 7:08 PM, Mathieu Mitchell <span dir="ltr">
<<a href="mailto:mmitchell@internap.com" target="_blank">mmitchell@internap.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Following discussion on IRC, here are my thoughts:<br>
<br>
The proposed network_interface allows choosing a "driver" for the network part of a node. The values could be something like "nobody", "neutron-flat networking" and "neutron-tenant separation".<br>
<br>
I think this choice should be left per-node. My reasoning is that you could have a bunch of nodes for which you have complete Neutron support, through for example an ML2 plugin. These nodes would be configured using one of the "neutron-*" modes.<br>
<br>
On the other hand, that same Ironic installation could also manage nodes for which the switches are unmanaged, or manually configured. In such case, you would probably want to use the "nobody" mode.<br>
<br>
An important point is to expose this "capability" to Nova as you might want to offer nodes with neutron integration differently from "any node". I am unsure if the capability should be the value of the network_interface or a boolean "neutron integration?".
Thoughts?<span class="HOEnZb"><font color="#888888"><br>
<br>
Mathieu</font></span>
<div class="HOEnZb">
<div class="h5"><br>
<br>
On 2016-06-28 11:32 AM, Dmitry Tantsur wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi folks!<br>
<br>
I was reviewing <a href="https://review.openstack.org/317391" rel="noreferrer" target="_blank">
https://review.openstack.org/317391</a> and realized I don't<br>
quite understand why we want to have node.network_interface. What's the<br>
real life use case for it?<br>
<br>
Do we expect some nodes to use Neutron, some - not?<br>
<br>
Do we expect some nodes to benefit from network separation, some - not?<br>
There may be a use case here, but then we have to expose this field to<br>
Nova for scheduling, so that users can request a "secure" node or a<br>
"less secure" one. If we don't do that, Nova will pick at random, which<br>
makes the use case unclear again.<br>
If we do that, the whole work goes substantially beyond what we were<br>
trying to do initially: isolate tenants from the provisioning network<br>
and from each other.<br>
<br>
Flexibility it good, but the patches raise upgrade concerns, because<br>
it's unclear how to provide a good default for the new field. And anyway<br>
it makes the whole thing much more complex than it could be.<br>
<br>
Any hints are welcome.<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>