Open Stack

Hi Salvatore,

Let me answer those to points.
*> 1) Defining how advanced service implementations (plugin or drivers) will
 serve API requests, keeping in mind that for the same kind of service
there might be multiple implementations available at the same time*
That part of "service insertion" seems to be quite clear.

*> 2) Defining the APIs and related logic for defining how advanced service
fit in the logical topology (service insertion modes) and which services
(type and nature) should be available to tenants.*
When I was talking about device management I primarily meant "informing
LBaaS about LB device: where it is located and how it is connected".
I still feel that's related to what you're talking about in (2). Our view
is based on existing LBaaS workflow and I'm trying to map it to your
proposal or understand the basic differences.

So the questions will be:
1) Why do we want to extend router resource?
Why do we need to know whether router provides certain resource or not?
Currently LBaaS can provide LB service if it has appropriate device, it
doesn't depend on any router.
Is it for adv svc quota management only?

2) Why do we need to associate adv. service with a certain router?
Did you mean we associate particular adv service appliance with a router?
E.g. say we have device LB1 associated with router1, device LB2 associated
with router2, is that what you meant?
If so, doest it makes sense to have many-to-many relationship between adv
service appliances and routers?
If that's what you meant, then it's a part of "device management",
e.g. "informing LBaaS about LB device: where it is located and how it is
connected".
In this case when tenant request LB for certain network, Quantum will
collect all available devices for the network (e.g. all devices attached to
corresponding router) and chose the device to deploy LB for the tenant.

Thanks,
Eugene.


On Wed, Oct 31, 2012 at 11:49 PM, Salvatore Orlando <sorlando at nicira.com>wrote:

> A few more comments inline!
>
> Salvatore
>
> On 31 October 2012 19:21, Eugene Nikanorov <enikanorov at mirantis.com>wrote:
>
>> Salvatore, thanks for detailed reply.
>>
>> But still there are unclear points for me :(
>>
>> 1. What does mean "advanced service is created". Don't we always have all
>> advanced services which are provided by plugins configured in quantum.conf?
>> I mean if we configured lbaas plugin in quantum.conf then tenant may call
>> corresponding tenant API to request LB service. Is my understanding correct?
>>
>
> My mistake - english is not my language, unfortunately! I was referring to
> a tenant creating an instance of an advanced service, e.g.: POST
> /{whatever-the-prefix-is}/lb
>
>>
>> 2. What happens when tenant calls /routers/<r_id>/enable_service ?
>>
>
> This is the most optional bit of the service insertion specification.
> Assume we have a router associated with a service type which gives you LB
> & Firewall. This means you can in theory create Load Balancers and Firewall
> associated with that router. A tenant however might decide to turn off that
> capability; frankly I do not see this as something necessary - it was in
> the specification just for completeness.
>
>
>>
>> Once again, I've tried to map this "insertion" to the workflow of how a
>> tenant gets a service, but you're saying it's not about it, so I'm trying
>> to understand how services insertion affects our design and code at all.
>>
>
> Oh well - as you were talking about "device management" I understood you
> were talking about managing the pool of resources, physical or virtual,
> which provide the service to the tenant. If this is actually what you
> meant, I can confirm service insertion has nothing to do with it.
> Service insertion tries to address the following problems
>
> 1) Defining how advanced service implementations (plugin or drivers) will serve
> API requests, keeping in mind that for the same kind of service there
> might be multiple implementations available at the same time
> 2) Defining the APIs and related logic for defining how advanced service
> fit in the logical topology (service insertion modes) and which services
> (type and nature) should be available to tenants.
>
> Let me explain the above two points with an example (sorry if that's
> boring)
>
> 1) When a requests for a LB comes in, we need to understand how to
> dispatch it in the Quantum's plugin layer so that ultimately results in the
> configuration of the appropriate type of device (e.g.: a NetScaler or an HA
> Proxy instance).
> 2) When a tenant creates a load balancer, we might want to associate it
> with a logical router (and hence the load balancer and the default gateway
> are the same thing) or we want to have it kind of standalone, acting
> independently from any logical router. Also when a LB is created we might
> specify a "service type" which could map to things such as Bronze, Silver,
> and Gold - which ultimately will lead to the selection of a provider versus
> another one.
>
>
>>
>> Thanks,
>> Eugene.
>>
>>
>> On Wed, Oct 31, 2012 at 9:14 PM, Salvatore Orlando <sorlando at nicira.com>wrote:
>>
>>> Hi Eugene,
>>>
>>> thanks for your feedback.
>>> Please see my replies inline.
>>>
>>> On 31 October 2012 13:32, Eugene Nikanorov <enikanorov at mirantis.com>wrote:
>>>
>>>> Hi Salvatore,
>>>>
>>>> I'd like to give some feedback/questions based on yesterday's meeting
>>>> discussion and your renewed
>>>> http://wiki.openstack.org/Quantum/ServiceInsertion page.
>>>>
>>>> First of all, I think it's worth to fix the terminology just to avoid
>>>> any confusion:
>>>>
>>>> - extension (API extension) - set of REST calls
>>>> - plugin - code that implements certain API, works with quantum
>>>> database, pushes calls to agents
>>>> - core plugin - code that implements core API (networks, subnets,
>>>> ports, L3)
>>>> - agent - listens to commands from plugin, applies configuration to
>>>> particular device type, ex: ovs agent, L3 agent
>>>> - driver - code that applies conf to particular device type. That is
>>>> just another layer needed to support different device types. Example:
>>>> Loadbalancing agent may have several drivers to talk to different LB
>>>> devices.
>>>>
>>>
>>> Everything agreed, with the only exception that some flexibility might
>>> be allowed in the definition of agents/drivers. It is possible to think of
>>> a plugin which directly dispatches commands to drivers, rather than relying
>>> on agents. But this is probably just a detail.
>>>
>>>>
>>>> Some thoughts on the Service Insertion proposal:
>>>>
>>>> 1. It seems that multiplugin approach is the right way to move further
>>>> compared to "mixin" approach where we inject and modify code of the core
>>>> plugin.
>>>> This will preserve plugin independency while require some changes to
>>>> infrastructure (plugin loading, extension management).
>>>>
>>>
>>> I agree on the changes to the infrastructure. I'd like to understand a
>>> little bit better what degree o plugin independency you'd like to achieve.
>>>
>>>
>>>>
>>>> 2. Having several implementations of the same service type.
>>>> If all services of the certain type implement the same calls, then
>>>> something should allow to route the call to particular plugin.
>>>> The options include:
>>>>   1)  passing particular service impl as a url parameter
>>>>   2)  having a prefix in uri for certain svc type:
>>>> /lb_svc/lbaas_impl1/call.json, /lb_svc/lbaas_impl2/call.json
>>>>   3)  having (tenant, service implementation) assosiation in DB that
>>>> will allow to route a call automatically. But this makes 1 to 1 relation,
>>>> e.g. tenant will have only 1 impl of service available
>>>>
>>>
>>> In the list above there's no mention of the service_type concept we
>>> discuss at the summit and which is also presented on the serviceinsertion
>>> wiki page. Do you deem it totally unreasonable?
>>>
>>>
>>>>
>>>> My preference is (2): first of all, it "splits" whole API between core
>>>> API and Adv Svc API, and also does so for different service type
>>>> implementations.
>>>> Although URIs may not be so short as we want them, that could prevent
>>>> from naming collisions between different service types.
>>>>
>>>
>>> I have some concerns about this approach, and the length of the URI is
>>> not one of them. The particular implementation of a load balancing plugin
>>> is directly surfaced, meaning that a user cannot transparently move from
>>> one plugin to another without having to rewrite their client applications -
>>> as this proposal implies that /lb_svc/lbaas_impl1 might have different spec
>>> from /lb_svc/lbaas_impl2. Also, one might wonder what's the point in this
>>> case of going through quantum at all: one can just send the calls to an
>>> endpoint which performs URL rewriting and then forwards the call to
>>> appropriate final endpoint. Finally, it is my opinion that this solution is
>>> tantamount to saying that you want multiple LBaaS solutions at the same
>>> time in the same cloud; I won't argue that this is not a reasonable use
>>> case, but I'd prefer Quantum to present a single LBaaS interface rather
>>> than harbouring multiple solutions.
>>>
>>>
>>>>
>>>> 3. Service Insertion:
>>>> I was thinking about routed/floating-mode insertion and there is a
>>>> certain thing I don't understand: the workflow.
>>>> It seems that the whole thing is somehow close to what we used to call
>>>> "device management" in mirantis implementaion of lbaas, but it doesn't look
>>>> like solving all device management tasks.
>>>>
>>>
>>> Actually, I don't think it is related at all to device management -
>>> assuming that I understand what you mean by device management. We are using
>>> this terminology to talk about insertion in the logical model, not the
>>> physical model. I think I clarified in the specification that we don't want
>>> to address device management in the service insertion blueprint. It is my
>>> opinion that this task is specific to particular advances services. For the
>>> LBaaS case, it necessarily requires a knowledge of physical and virtual
>>> appliance that I honestly do not have... so I'll gladly leave it to the
>>> load balancing experts :)
>>>
>>>
>>>>
>>>> So in our implementation of LBaaS the workflow was as following:
>>>> 1) admin creates the device. Essentially it's just an instruction to
>>>> LBaaS of where is the device (it's address), which type is it and
>>>> credentials to manage it.
>>>>
>>> 2) tenant creates VIP. During this operation LBaaS chooses the most
>>>> appropriate device from the list of available and makes appropriate device
>>>> configuration
>>>>
>>>
>>> I think it is a reasonable workflow and goes back to the discussion
>>> around "capabilities" we were having during last week's call. I hope we
>>> agree that this is specific to LBaaS - I don't think service insertion has
>>> anything to do with it, as it looks just after the "logical" topology.
>>>
>>>
>>>> If we're talking about workflow within Quantum it could look like
>>>> following (scenario 1 - shared HW device):
>>>> 1) admin creates the device. The same as in lbaas - address, type,
>>>> credentials
>>>> 2) tenant creates VIP: Quantum LBaaS plugin chooses the device,
>>>> configures connectivity between the device and tenant network (possibly
>>>> with l3 router configuration),
>>>> configures loadbalancer according to provided VIP parameters, possibly
>>>> assigns floating IP from external network
>>>>
>>>
>>> The solutions for "stiching" a device to a quantum network vary with the
>>> nature of the device, and with the way in which the service is inserted in
>>> the logical topology. I think what you said above is valid; in addition to
>>> that you might consider also other possibilities:
>>> 1) using nova to plug services in quantum - which would work nicely for
>>> physical appliances
>>> 2) leveraging an underlying layer-2 agent (which would be the same thing
>>> the l3 agent does)
>>> 3) using the "provider networks" capability. This capability, in a
>>> nutshell, will allow you map a Quantum network, regardless of the
>>> technology Quantum uses.
>>> 4) having a "translator" across service types (for instance GRE to VLAN
>>> or VXLAN to VLAN) - we don't have yet this on Quantum, but Kyle from Cisco
>>> has a very interesting blueprint on this topic:
>>> https://blueprints.launchpad.net/quantum/+spec/quantum-network-segment-translation
>>>
>>>>
>>>> If we're talking about private balancer with Quantum, then:
>>>> 1) tenant creates the device. This could be a launch of VM with HA
>>>> Proxy within tenant for instance.
>>>> 2) tenant creates VIP: LBaaS configures loadbalancer according to
>>>> provided VIP parameters, possibly assigns floating IP from external
>>>> network. No other actions required
>>>>
>>>
>>> Yeah... I agree there might be a case where a tenant creates a device.
>>> This is why we never make a clear distinction between tenant and admin
>>> APIs, but leave it configurable through the policy engine.
>>>
>>>
>>>>
>>>> It would be great if you explain how service assignments for
>>>> routers maps to device management scenarios and what exact workflow will
>>>> be.
>>>>
>>>
>>> I hope my explanation is satisfactory - which basically is that service
>>> insertion and device management have nothing in common.
>>>
>>>
>>>>
>>>> Thanks,
>>>> Eugene.
>>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20121101/ee0dc9b7/attachment-0001.html>