[Question] Do I must separate management network and overlay network?
Hi, That is an example only, if you don't need provider network, you would like to use only overlay networks like geneve, you can use only the suggested 2 interfaces, one for management and one for traffic. Lajos Katona (lajoskatona) 박경원 <park0kyung0won@dgist.ac.kr> ezt írta (időpont: 2022. ápr. 8., P, 7:07):
Hello everyone
I'm trying to setup openstack cluster with openvswitch, following the guide in link below
https://docs.openstack.org/neutron/yoga/admin/deploy-ovs-selfservice.html
Diagram in the link above states that compute nodes should have three interfaces(management, overlay and provider)
My question is, do I really need separated management network and overlay network? (I only have two switches)
It seems like overlay traffic between VMs in virtual network are encapsulated with GENEVE, will not escape to management network.
Is there any possible security risk of using the same network for both overlay and management? (not performance concerns but security)
Thank you in advance!
On 4/8/22 06:59, 박경원 wrote:
Hello everyone
I'm trying to setup openstack cluster with openvswitch, following the guide in link below
https://docs.openstack.org/neutron/yoga/admin/deploy-ovs-selfservice.html <https://docs.openstack.org/neutron/yoga/admin/deploy-ovs-selfservice.html>
Diagram in the link above states that compute nodes should have three interfaces(management, overlay and provider)
My question is, do I really need separated management network and overlay network? (I only have two switches)
You don't *have* to, but it's possible. The only difference in the setup is if the ml2 config file list a different IP address than the management IP, but it's ok if both are the same (it will continue to work).
It seems like overlay traffic between VMs in virtual network are encapsulated with GENEVE, will not escape to management network.
The traffic wont escape. It's just that if one VM floods the management network, your operations may become difficult. Alternatively, you can use the same wire, but with different subnets, and setup QoS in your switch, if you identified this may be a problem. That being said, with modern networking (like 2x 25 Gbits/s becoming very common), this isn't much of a problem anymore. I hope this helps, Cheers, Thomas Goirand (zigo)
participants (3)
-
Lajos Katona
-
Thomas Goirand
-
박경원