Open Stack

We are considering adding network classes “rules” to LBaaS.
In this case, such network classes could als be used to white/black list traffic.

From: Brandon Logan [mailto:brandon.logan at RACKSPACE.COM]
Sent: Friday, May 22, 2015 12:46 AM
To: openstack-dev at lists.openstack.org; maishsk+openstack at maishsk.com
Subject: Re: [openstack-dev] [lbaas] [octavia] [barbican] Relationship between Octavia and Barbican and Octavia 1.0 questions


​Right now its all or nothing as far as tcp ports go.  It currently does not have the functionality of white/black listinging traffic originating from a specific network.

________________________________
From: Maish Saidel-Keesing <maishsk at maishsk.com<mailto:maishsk at maishsk.com>>
Sent: Thursday, May 21, 2015 7:45 AM
To: openstack-dev at lists.openstack.org<mailto:openstack-dev at lists.openstack.org>
Subject: Re: [openstack-dev] [lbaas] [octavia] [barbican] Relationship between Octavia and Barbican and Octavia 1.0 questions

Thanks Brandon
On 05/20/15 22:58, Brandon Logan wrote:

​Just to add a few things,

Barbican is not yet implemented in Octavia, though the code is there, we just need to spend a few hours hooking it all up and testing it out.



Also, the security groups are used by octavia right now so that only the ports on the listener are accessible.  Basically if a loadbalancer has listeners on ports 80 and 443, the vip ports will only allow traffic on those ports.  It shouldn't allow other traffic.
That is great to hear. I assume that if we are using security groups we will also be able to define rules regarding which networks the listeners are allowed to accept traffic from?

Is that assumption correct?




Thanks,

Brandon

________________________________
From: Doug Wiegley <dougwig at parksidesoftware.com><mailto:dougwig at parksidesoftware.com>
Sent: Thursday, May 21, 2015 12:49 AM
To: maishsk+openstack at maishsk.com<mailto:maishsk+openstack at maishsk.com>; OpenStack Development Mailing List (not for usage questions); Maish Saidel-Keesing
Subject: Re: [openstack-dev] [lbaas] [octavia] [barbican] Relationship between Octavia and Barbican and Octavia 1.0 questions

Hi Maish,

Thanks for the feedback, some answers below.  Please also be aware of the lbaas use cases session tomorrow at 9am (yuck, I know), https://etherpad.openstack.org/p/YVR-neutron-lbaas-use-cases


On May 19, 2015, at 12:05 AM, Maish Saidel-Keesing <maishsk at maishsk.com<mailto:maishsk at maishsk.com>> wrote:

Hello all,

Going over today's presentation "Load Balancing as a Service, Kilo and Beyond"[1] (great presentation!!) - there are a few questions I have regarding the future release:

For Octavia 1.0:

1. Can someone explain to me how the flow would work for spinning up a a new Amphora with regards to interaction between Neutron, LBaaS and Barbican?
Same question as well regarding how the standby is created and its relationship with Barbican.

The lbaas API runs inside neutron-server.  The general flow is:

- User interacts with neutron CLI/API or horizon (in liberty), and creates an LB.
- Lbaas plugin in neutron creates logical models, fetches cert data from barbican, and calls the backend lbaas driver.
- The backend driver does what it needs to to instantiate the LB. Today this is a synchronous call that waits for the nova boot, but by Liberty, it will likely be an async call to the octavia controller to finish the job.

Once Octavia has control, it is doing:

- Get REST calls for objects,
- Talk to nova, spin up an amphora image,
- Talk to neutron, plumb in the networks,
- Send the amphora its config.



2. Will the orchestration (Heat) also be implemented when Octavia 1.0 is released or only further down the line?
If not what would you suggest be the way to orchestrate LBaaS until this is ready?

We need to talk to the Heat folks and coordinate this, which we are planning to do soon.



3. Is there some kind of hook into Security groups also planned for the Amphora to also protect the Load Balancer?

Not at present, but I recorded this in the feature list on the etherpad above.



I think that based on the answers to these questions above - additional questions will follow.

Thanks

[1] https://www.youtube.com/watch?v=-eAKur8lErU
--
Best Regards,
Maish Saidel-Keesing
__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: OpenStack-dev-request at lists.openstack.org<mailto:OpenStack-dev-request at lists.openstack.org>?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev


--
Best Regards,
Maish Saidel-Keesing
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20150526/dac710f8/attachment.html>