Open Stack

Sasha,
thanks for contributing to the discussion! I will start with answering
Eugene's questions. Some comments on the points you've raised can be found
inline.

Eugene: When I was talking about device management I primarily meant
"informing LBaaS about LB device: where it is located and how it is
connected".
I still feel that's related to what you're talking about in (2). Our view
is based on existing LBaaS workflow and I'm trying to map it to your
proposal or understand the basic differences.

Salvatore: While to some extent it is true that the "service type"
ultimately determines the LB device, this does not happen directly. The
service type identifies a "class" of devices, whereas the actual mapping of
a logical load balancer to its concrete realization (which at some point
must happen) is left to the plugin. From the tenant perspective, there is
no interest in knowing any detail of the device serving the request
(physical or virtual, vendor X vs vendor Y, etc.); all the tenant needs to
know is that the chosen device satisfies its requirements.

Eugene: So the questions will be:
1) Why do we want to extend router resource?

Salvatore: We are not looking for extending the router resource. When we
say that we insert an advanced service on a router, what we are really
saying, to borrow Sasha's terminology, is that we are providing LB
capabilities in a given L3 domain. The load balancer attached to a router
will have access to the L3 domain of that router.

Eugene: Why do we need to know whether router provides certain resource or
not?

Salvatore: Not sure I understand this question. The router does not provide
any kind of resource; more specifically we are not proposing that advanced
services should be provided as a sub-resource of a router. The point we're
making is that if one chooses to attach a service in routed mode - this
means that service will run where the default gateway for your logical
topology is, and so all the other services attached in routed mode. Then
the service type should be the same for all the services, and can easily be
specified by the router itself.

Concrete examples are a VM that provides a bunch of services, from L3
forwarding to Load Balancing; as an example thing of the cloudstack's
"Virtual Router"; another possible example is an integrated appliance such
as an application delivery controller; the simple possible example is to
think about Quantum's l3 agent augmented with more agents which perform
firewall configuration with iptables and load balancing with haproxy.

Eugene: Currently LBaaS can provide LB service if it has appropriate
device, it doesn't depend on any router.
Is it for adv svc quota management only?

Salvatore: From my understanding the current LBaaS API proposal (
http://wiki.openstack.org/Quantum/LBaaS/API_1.0) focuses exclusively on the
tenant-side APIs, where device details are hidden, as one might expect.
Unfortunately I've not been involved with LBaaS discussion as I should have
so far, so I'm not aware of any API proposal or POC code for device
management. Nevertheless I am confident that none of what we're proposing
we'll add unwanted constraints on tenant-facing APIs
.
Eugene: 2) Why do we need to associate adv. service with a certain router?

Salvatore: This is not necessary; it's an alternative to the "standalone",
"out-of-path", or "floating" mode.

Eugene: Did you mean we associate particular adv service appliance with a
router?
E.g. say we have device LB1 associated with router1, device LB2 associated
with router2, is that what you meant?

Salvatore: Yes, but none of this would surface to tenant. Also the choice
of LB1 and LB2 is up to the plugin, rather than to the Quantum API layer.
For instance a plugin might decide to not allocate any device to a router
until a load balancer has actually been associated with it; another plugin
might instead spin up a "router VM" for each logical Quantum router and
then configure advanced services such as load balancing on that VM.

Eugene: If so, doest it makes sense to have many-to-many relationship
between adv service appliances and routers?
If that's what you meant, then it's a part of "device management",
e.g. "informing LBaaS about LB device: where it is located and how it is
connected".
In this case when tenant request LB for certain network, Quantum will
collect all available devices for the network (e.g. all devices attached to
corresponding router) and chose the device to deploy LB for the tenant.

Salvatore: I think your workflow is quite correct. I just was not regarding
the process of selecting a particular device as "device management" as well.
With the only exception that the strategy for finding available devices
should be left to the plugin rather than to the Quantum service. Also I
don't want to risk confusion between logical and physical realms. "all
devices attached to the corresponding router" sounds like you're referring
to your physical infrastructure, and that is not the case.
So the same workflow you described, might be translated as:
- tenant creates LB using Quantum LBaaS API
- Quantum analyzes service type in tenant request
- Quantum forwards request to appropriate plugin or driver (the or is
mandatory as this is another design point still under review)
- The selected plugin or driver chooses the appropriate device and
associates tenant's logical LB with its concrete realization
- The selected plugin or driver configures load balancing using
device-specific interface


On 1 November 2012 21:03, Sasha Ratkovic <sasharatkovic at juniper.net> wrote:

>  Eugene, Salvatore, thanks for great discussion!
>
>  I am also looking forward to the answer regarding the semantics of
> associating "service" to (logical) "router".
>
>  I also have some questions/clarifications below inline (way below, hence
> in green) , related to your earlier exchanges …
>
>  Thanks,
> Sasha
>
>   From: Eugene Nikanorov <enikanorov at mirantis.com>
> Reply-To: OpenStack Development Mailing List <
> openstack-dev at lists.openstack.org>
> Date: Thursday, November 1, 2012 5:20 AM
> To: "openstack-dev at lists.openstack.org" <openstack-dev at lists.openstack.org
> >
> Subject: Re: [openstack-dev] [Quantum][LBaaS] Advanced Services Insertion
>
>  Hi Salvatore,
>
>  Let me answer those to points.
> *> 1) Defining how advanced service implementations (plugin or drivers)
> will serve API requests, keeping in mind that for the same kind of
> service there might be multiple implementations available at the same time
> *
> That part of "service insertion" seems to be quite clear.
>
>  *> 2) Defining the APIs and related logic for defining how advanced
> service fit in the logical topology (service insertion modes) and which
> services (type and nature) should be available to tenants.*
> When I was talking about device management I primarily meant "informing
> LBaaS about LB device: where it is located and how it is connected".
> I still feel that's related to what you're talking about in (2). Our view
> is based on existing LBaaS workflow and I'm trying to map it to your
> proposal or understand the basic differences.
>
>  So the questions will be:
> 1) Why do we want to extend router resource?
> Why do we need to know whether router provides certain resource or not?
> Currently LBaaS can provide LB service if it has appropriate device, it
> doesn't depend on any router.
> Is it for adv svc quota management only?
>
>  2) Why do we need to associate adv. service with a certain router?
> Did you mean we associate particular adv service appliance with a router?
> E.g. say we have device LB1 associated with router1, device LB2 associated
> with router2, is that what you meant?
> If so, doest it makes sense to have many-to-many relationship between adv
> service appliances and routers?
> If that's what you meant, then it's a part of "device management",
> e.g. "informing LBaaS about LB device: where it is located and how it is
> connected".
> In this case when tenant request LB for certain network, Quantum will
> collect all available devices for the network (e.g. all devices attached to
> corresponding router) and chose the device to deploy LB for the tenant.
>
>  Thanks,
> Eugene.
>
>
> On Wed, Oct 31, 2012 at 11:49 PM, Salvatore Orlando <sorlando at nicira.com>wrote:
>
>> A few more comments inline!
>>
>>  Salvatore
>>
>>  On 31 October 2012 19:21, Eugene Nikanorov <enikanorov at mirantis.com>wrote:
>>
>>> Salvatore, thanks for detailed reply.
>>>
>>>  But still there are unclear points for me :(
>>>
>>>  1. What does mean "advanced service is created". Don't we always have
>>> all advanced services which are provided by plugins configured in
>>> quantum.conf? I mean if we configured lbaas plugin in quantum.conf then
>>> tenant may call corresponding tenant API to request LB service. Is my
>>> understanding correct?
>>>
>>
>>  My mistake - english is not my language, unfortunately! I was referring
>> to a tenant creating an instance of an advanced service, e.g.: POST
>> /{whatever-the-prefix-is}/lb
>>
>>>
>>>  2. What happens when tenant calls /routers/<r_id>/enable_service ?
>>>
>>
>>  This is the most optional bit of the service insertion specification.
>> Assume we have a router associated with a service type which gives you LB
>> & Firewall. This means you can in theory create Load Balancers and Firewall
>> associated with that router. A tenant however might decide to turn off that
>> capability; frankly I do not see this as something necessary - it was in
>> the specification just for completeness.
>>
>>
>>>
>>>  Once again, I've tried to map this "insertion" to the workflow of how
>>> a tenant gets a service, but you're saying it's not about it, so I'm trying
>>> to understand how services insertion affects our design and code at all.
>>>
>>
>>  Oh well - as you were talking about "device management" I understood
>> you were talking about managing the pool of resources, physical or virtual,
>> which provide the service to the tenant. If this is actually what you
>> meant, I can confirm service insertion has nothing to do with it.
>> Service insertion tries to address the following problems
>>
>>  1) Defining how advanced service implementations (plugin or drivers)
>> will serve APIrequests, keeping in mind that for the same kind of
>> service there might be multiple implementations available at the same time
>> 2) Defining the APIs and related logic for defining how advanced service
>> fit in the logical topology (service insertion modes) and which services
>> (type and nature) should be available to tenants.
>>
>>  Let me explain the above two points with an example (sorry if that's
>> boring)
>>
>>  1) When a requests for a LB comes in, we need to understand how to
>> dispatch it in the Quantum's plugin layer so that ultimately results in the
>> configuration of the appropriate type of device (e.g.: a NetScaler or an HA
>> Proxy instance).
>> 2) When a tenant creates a load balancer, we might want to associate it
>> with a logical router (and hence the load balancer and the default gateway
>> are the same thing) or we want to have it kind of standalone, acting
>> independently from any logical router. Also when a LB is created we might
>> specify a "service type" which could map to things such as Bronze, Silver,
>> and Gold - which ultimately will lead to the selection of a provider versus
>> another one.
>>
>>
>>>
>>>  Thanks,
>>> Eugene.
>>>
>>>
>>> On Wed, Oct 31, 2012 at 9:14 PM, Salvatore Orlando <sorlando at nicira.com>wrote:
>>>
>>>> Hi Eugene,
>>>>
>>>>  thanks for your feedback.
>>>> Please see my replies inline.
>>>>
>>>>  On 31 October 2012 13:32, Eugene Nikanorov <enikanorov at mirantis.com>wrote:
>>>>
>>>>> Hi Salvatore,
>>>>>
>>>>>  I'd like to give some feedback/questions based on yesterday's
>>>>> meeting discussion and your renewed
>>>>> http://wiki.openstack.org/Quantum/ServiceInsertion page.
>>>>>
>>>>>  First of all, I think it's worth to fix the terminology just to
>>>>> avoid any confusion:
>>>>>
>>>>>  - extension (API extension) - set of REST calls
>>>>> - plugin - code that implements certain API, works with quantum
>>>>> database, pushes calls to agents
>>>>> - core plugin - code that implements core API (networks, subnets,
>>>>> ports, L3)
>>>>> - agent - listens to commands from plugin, applies configuration to
>>>>> particular device type, ex: ovs agent, L3 agent
>>>>> - driver - code that applies conf to particular device type. That is
>>>>> just another layer needed to support different device types. Example:
>>>>> Loadbalancing agent may have several drivers to talk to different LB
>>>>> devices.
>>>>>
>>>>
>>>>  Everything agreed, with the only exception that some flexibility
>>>> might be allowed in the definition of agents/drivers. It is possible to
>>>> think of a plugin which directly dispatches commands to drivers, rather
>>>> than relying on agents. But this is probably just a detail.
>>>>
>>>
>
>  And very important detail, I think. Given the mention of "layer" in
> Eugene's terminology ( btw, thanks Eugene for initiating the "terminology"
> discussion ), was the intention that agent would expose "device_type" APIs
> (service resource abstraction) and drivers would map that to "device_type_vendor"
> API?  This essentially takes this "multi service" insertion discussion into
> equally important "multi vendor" discussion.
>

In a nutshell, the goal is to make Quantum both multi service and multi
vendor. The terminology between agent and drivers needs to be explained
better, and I would look like to use Quantum DHCP as an example. DHCP
directly depends from the Quantum core plugin. It has an agent, which
receives notification from the core plugin, and retrieves detailed
information from it (such as IP allocation ranges); the agent then uses
drivers for performing the actual configuration that will bring the DHCP
service up. At the moment we only have a dnsmasq driver, but it is my
understanding that a driver for ISC DHCP is underway too.


>
>
>
>>>>>  Some thoughts on the Service Insertion proposal:
>>>>>
>>>>>  1. It seems that multiplugin approach is the right way to move
>>>>> further compared to "mixin" approach where we inject and modify code of the
>>>>> core plugin.
>>>>> This will preserve plugin independency while require some changes to
>>>>> infrastructure (plugin loading, extension management).
>>>>>
>>>>
>>>>  I agree on the changes to the infrastructure. I'd like to understand
>>>> a little bit better what degree o plugin independency you'd like to achieve.
>>>>
>>>
>  If "multi plugin" approach is chosen,  with each plugin having its own
> db (per definition above), it becomes extremely important to have some way
> for plugins to have coherently manage resources that may have their
> representations reside in both dbs. ( Say "port" in core API is sort of
> extended in LBaaS as "pool member" - I.e. Adding/deleting the port impacts
> obviously pool member). Is this a valid concern?
>

I agree it's an important point, but probably not a huge concern. The
plugins will be independent but not ignore each other. So I think it is
still ok for a LB pool member to reference a port id from Quantum core. In
Quantum core you can use the device_owner and the device_id fields to mark
that port as used by a specific advanced service. We currently use those
fields to prevent tenants from performing operations on the core API which
will cause disruption to other services.


>
>>>>
>>>>>
>>>>>  2. Having several implementations of the same service type.
>>>>> If all services of the certain type implement the same calls, then
>>>>> something should allow to route the call to particular plugin.
>>>>> The options include:
>>>>>   1)  passing particular service impl as a url parameter
>>>>>   2)  having a prefix in uri for certain svc type:
>>>>> /lb_svc/lbaas_impl1/call.json, /lb_svc/lbaas_impl2/call.json
>>>>>   3)  having (tenant, service implementation) assosiation in DB that
>>>>> will allow to route a call automatically. But this makes 1 to 1 relation,
>>>>> e.g. tenant will have only 1 impl of service available
>>>>>
>>>>
>>>>  In the list above there's no mention of the service_type concept we
>>>> discuss at the summit and which is also presented on the serviceinsertion
>>>> wiki page. Do you deem it totally unreasonable?
>>>>
>>>>
>>>>>
>>>>>  My preference is (2): first of all, it "splits" whole API between
>>>>> core API and Adv Svc API, and also does so for different service type
>>>>> implementations.
>>>>> Although URIs may not be so short as we want them, that could prevent
>>>>> from naming collisions between different service types.
>>>>>
>>>>
>>>>  I have some concerns about this approach, and the length of the URI
>>>> is not one of them. The particular implementation of a load balancing
>>>> plugin is directly surfaced, meaning that a user cannot transparently move
>>>> from one plugin to another without having to rewrite their client
>>>> applications - as this proposal implies that /lb_svc/lbaas_impl1 might have
>>>> different spec from /lb_svc/lbaas_impl2. Also, one might wonder what's the
>>>> point in this case of going through quantum at all: one can just send the
>>>> calls to an endpoint which performs URL rewriting and then forwards the
>>>> call to appropriate final endpoint. Finally, it is my opinion that this
>>>> solution is tantamount to saying that you want multiple LBaaS solutions at
>>>> the same time in the same cloud; I won't argue that this is not a
>>>> reasonable use case, but I'd prefer Quantum to present a single LBaaS
>>>> interface rather than harbouring multiple solutions.
>>>>
>>>
>  Is is viable to have these different service implementations "advertise"
> properties  of that implementation, via an attribute (TBD) of the service
> object (VIF in case of LBaaS) so that tenant uses that information to chose
> implementation? In other words, choosing that property of the "service"
> object indicates the hint as to which implementation to use. Plugin then
> does the routing, and there are no APIs/URIs per implementation.
>

I like the idea that different providers might advertise special properties
of their implementation. In Quantum we use API extensions for
plugin-specific features, and it is my opinion that this mechanisms can be
extended (with some work) to advanced services. The tenant could query the
"service type" to see what extensions are supported.
Then using them as a mechanism for selecting the appropriate provider is
something we can discuss. Surely if only "provider X" supports extension
"fooX" and then it makes sense that if you use fooX in your request you
want to use provider X. But there will still be cases of ambiguity, where a
requests might be served by several providers... and I do not know how we
should handle them.




>
>
>
>>>>
>>>>>
>>>>>  3. Service Insertion:
>>>>> I was thinking about routed/floating-mode insertion and there is a
>>>>> certain thing I don't understand: the workflow.
>>>>> It seems that the whole thing is somehow close to what we used to call
>>>>> "device management" in mirantis implementaion of lbaas, but it doesn't look
>>>>> like solving all device management tasks.
>>>>>
>>>>
>>>>  Actually, I don't think it is related at all to device management -
>>>> assuming that I understand what you mean by device management. We are using
>>>> this terminology to talk about insertion in the logical model, not the
>>>> physical model. I think I clarified in the specification that we don't want
>>>> to address device management in the service insertion blueprint. It is my
>>>> opinion that this task is specific to particular advances services. For the
>>>> LBaaS case, it necessarily requires a knowledge of physical and virtual
>>>> appliance that I honestly do not have... so I'll gladly leave it to the
>>>> load balancing experts :)
>>>>
>>>>
>>>>>
>>>>>  So in our implementation of LBaaS the workflow was as following:
>>>>> 1) admin creates the device. Essentially it's just an instruction to
>>>>> LBaaS of where is the device (it's address), which type is it and
>>>>> credentials to manage it.
>>>>>
>>>>  2) tenant creates VIP. During this operation LBaaS chooses the most
>>>>> appropriate device from the list of available and makes appropriate device
>>>>> configuration
>>>>>
>>>>
>>>>  I think it is a reasonable workflow and goes back to the discussion
>>>> around "capabilities" we were having during last week's call. I hope we
>>>> agree that this is specific to LBaaS - I don't think service insertion has
>>>> anything to do with it, as it looks just after the "logical" topology.
>>>>
>>>
>>>>
>>>>>  If we're talking about workflow within Quantum it could look like
>>>>> following (scenario 1 - shared HW device):
>>>>> 1) admin creates the device. The same as in lbaas - address, type,
>>>>> credentials
>>>>> 2) tenant creates VIP: Quantum LBaaS plugin chooses the device,
>>>>> configures connectivity between the device and tenant network (possibly
>>>>> with l3 router configuration),
>>>>> configures loadbalancer according to provided VIP parameters, possibly
>>>>> assigns floating IP from external network
>>>>>
>>>>
>>>>  The solutions for "stiching" a device to a quantum network vary with
>>>> the nature of the device, and with the way in which the service is inserted
>>>> in the logical topology. I think what you said above is valid; in addition
>>>> to that you might consider also other possibilities:
>>>> 1) using nova to plug services in quantum - which would work nicely for
>>>> physical appliances
>>>> 2) leveraging an underlying layer-2 agent (which would be the same
>>>> thing the l3 agent does)
>>>> 3) using the "provider networks" capability. This capability, in a
>>>> nutshell, will allow you map a Quantum network, regardless of the
>>>> technology Quantum uses.
>>>> 4) having a "translator" across service types (for instance GRE to VLAN
>>>> or VXLAN to VLAN) - we don't have yet this on Quantum, but Kyle from Cisco
>>>> has a very interesting blueprint on this topic:
>>>> https://blueprints.launchpad.net/quantum/+spec/quantum-network-segment-translation
>>>>
>>>>>
>>>>>  If we're talking about private balancer with Quantum, then:
>>>>> 1) tenant creates the device. This could be a launch of VM with HA
>>>>> Proxy within tenant for instance.
>>>>> 2) tenant creates VIP: LBaaS configures loadbalancer according to
>>>>> provided VIP parameters, possibly assigns floating IP from external
>>>>> network. No other actions required
>>>>>
>>>>
>>>>  Yeah... I agree there might be a case where a tenant creates a
>>>> device. This is why we never make a clear distinction between tenant and
>>>> admin APIs, but leave it configurable through the policy engine.
>>>>
>>>>
>>>>>
>>>>>  It would be great if you explain how service assignments for
>>>>> routers maps to device management scenarios and what exact workflow will
>>>>> be.
>>>>>
>>>>
>>>>  I hope my explanation is satisfactory - which basically is that
>>>> service insertion and device management have nothing in common.
>>>>
>>>>
>>>>>
>>>>>  Thanks,
>>>>> Eugene.
>>>>>
>>>>
>>>>
>>>
>>
>
> _______________________________________________
> OpenStack-dev mailing list
> OpenStack-dev at lists.openstack.org
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20121101/d3b9d400/attachment.html>