<div>Context for openstack-mailing list: </div><div><br></div><div>This is a thread from the netstack list about integrating VPN capability with Quantum. Wanted larger community feedback.</div><div><br></div><div>-----------------</div>
<div><br></div>Hi Debo,<div><br></div><div>Based on our discussion Tuesday, it sounds like some nova folks don't see nova cloudpipe as a path worth investing in long-term, in which case I agree that it doesn't make sense for the Quantum team to integrate with it. I'd like to get a more general nod on that from the rest of the community though, particularly the nova devs, so I am CC'ing the wider openstack list. </div>
<div><br></div><div>Creating a pluggable VPN API + service either as a standalone-service or as a "sub-service" of Quantum has always been the long-term plan, so if there is no short-term nova plan, jumping to that directly makes sense. Finishing this in Essex seems ambitious to me, but given its importance to achieve "nova-network parity" for Quantum I'd love to see it happen. If we could have a "proposed" API (perhaps as a Quantum extension) and at least one open-source implementation (as well as any proprietary implementations) in time for the main essex release I think we would be in great shape. </div>
<div><br></div><div>Thanks!</div><div><br></div><div>Dan</div><div> <br><br><div class="gmail_quote">On Wed, Jan 4, 2012 at 11:17 PM, Debo Dutta (dedutta) <span dir="ltr"><<a href="mailto:dedutta@cisco.com">dedutta@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal">Hi <u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">After some offline discussions with Dan and Soren it was felt that we need to have this discussion on the ML. <u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Context: goal of the CP is to enable auth-ed access to a network managed by Nova /Quantum and not publicly accessible from the Internet. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">There are 2 ways to do CP: <u></u><u></u></p><p><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>Tweaks in Nova and Quantum rework to get CP to work. Nova-manage will spin up the CP VM but on a specific Quantum network. <i>We could get this into E3. <u></u><u></u></i></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>Soren felt that a clean solution should be independent of Nova and be inside Quantum since the fact that we spin a CP VM is an artifact of the way the legacy CP was implemented and that may not be the ideal way going forward. From that perspective the above workaround planned would be a distraction and potentially would need to be refactored. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">If we choose the 2<sup>nd</sup> route, then we will need to coverge on the quantum API for VPN service. The design will incorporate a pluggable driver for the following scenarios a) HW VPN devices b) VM based soft VPNs like openvpn. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Question to the elite netstack group: <u></u><u></u></p><p><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>Does anyone have a strong preference for the tweak that was planned<u></u><u></u></p>
<p><u></u><span style="font-family:Symbol"><span>·<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>For the 2<sup>nd</sup> route (i.e. API + pluggable modules), the API could be as simple as <u></u><u></u></p>
<p style="margin-left:1.0in"><u></u><span style="font-family:"Courier New""><span>o<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>VPN.connect(args)/VPN.disconnect()<u></u><u></u></p>
<p style="margin-left:1.0in"><u></u><span style="font-family:"Courier New""><span>o<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>VPN.config(VPNConfig)<u></u><u></u></p><p style="margin-left:1.5in">
<u></u><span style="font-family:Wingdings"><span>§<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>Split tunneling configuring options …. <u></u><u></u></p><p style="margin-left:1.0in"><u></u><span style="font-family:"Courier New""><span>o<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>Network.attach_vpn_instance(VPN) and detach<u></u><u></u></p>
<p style="margin-left:1.0in"><u></u><span style="font-family:"Courier New""><span>o<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>Network.enable_vpn … instantiates a VPN instance and attaches to the network<u></u><u></u></p>
<p style="margin-left:1.0in"><u></u><span style="font-family:"Courier New""><span>o<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u>VPN object could be either SoftVPN or HardVPN<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">I asked Soren if the CP tweak is critical for Quantum to be the default manager and his opinion is a “no” and he favors a solution that is more flexible and generic. I think if we choose the 2<sup>nd</sup> route, we should still have a working VPN solution by E, maybe as an addon and not part of E3. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thoughts? Opinions? Flames?<u></u><u></u></p><p style="margin-left:1.0in"><u></u> <u></u></p><p class="MsoNormal">Regards<u></u><u></u></p><p class="MsoNormal">
Debo<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>Dan Wendlandt <div>Nicira Networks: <a href="http://www.nicira.com" target="_blank">www.nicira.com</a><br>
<div>twitter: danwendlandt<br>~~~~~~~~~~~~~~~~~~~~~~~~~~~<br></div></div><br>
</div>