Open Stack

Hi John,

Thanks your reply.

Seems you have covered everything :)
The development work can be broken down in 3 parts:
1, add ovn driver to networking-sfc
2, provide APIs in networking-ovn for networking-sfc 
3, implement the sfc in ovn

So what about we take part 1 and part 2, and you take part 3? because we 
are familiar with networking-sfc and networking-ovn and we can do it 
faster:)





Regards,
Juno Zhu
IBM China Development Labs (CDL) Cloud IaaS Lab
Email: nazhu at cn.ibm.com
5F, Building 10, 399 Keyuan Road, Zhangjiang Hi-Tech Park, Pudong New 
District, Shanghai, China (201203)



From:   John McDowall <jmcdowall at paloaltonetworks.com>
To:     Na Zhu/China/IBM at IBMCN
Cc:     Ryan Moats <rmoats at us.ibm.com>, OpenStack Development Mailing List 
<openstack-dev at lists.openstack.org>, "discuss at openvswitch.org" 
<discuss at openvswitch.org>, Srilatha Tangirala <srilatta at us.ibm.com>
Date:   2016/06/01 23:26
Subject:        Re: [ovs-discuss] [OVN] [networking-ovn] [networking-sfc] 
SFC andOVN



Na/Srilatha,

Great, I am working from three repos:

https://github.com/doonhammer/networking-sfc
https://github.com/doonhammer/networking-ovn
https://github.com/doonhammer/ovs

I had an original prototype working that used an API I created. Since 
then, based on feedback from everyone I have been moving the API to the 
networking-sfc model and then supporting that API in networking-ovn and 
ovs/ovn. I have created a new driver in networking-sfc for ovn.

I am in the process of moving networking-ovn and ovs to support the sfc 
model. Basically I am intending to pass a deep copy of the port-chain 
(sample attached, sfc_dict.py) from the ovn driver in networking-sfc to 
networking-ovn.  This , as Ryan pointed out will minimize the dependancies 
between networking-sfc and networking-ovn. I have created additional 
schema for ovs/ovn (attached) that will provide the linkage between 
networking-ovn and ovs/ovn. I have the schema in ovs/ovn and I am in the 
process of  updating my code to support it.

Not sure where you guys want to jump in ¨C but I can help in any way you 
need.

Regards

John

From: Na Zhu <nazhu at cn.ibm.com>
Date: Tuesday, May 31, 2016 at 9:02 PM
To: John McDowall <jmcdowall at paloaltonetworks.com>
Cc: Ryan Moats <rmoats at us.ibm.com>, OpenStack Development Mailing List <
openstack-dev at lists.openstack.org>, "discuss at openvswitch.org" <
discuss at openvswitch.org>, Srilatha Tangirala <srilatta at us.ibm.com>
Subject: Re: [ovs-discuss] [OVN] [networking-ovn] [networking-sfc] SFC 
andOVN

+ Add Srilatha.



Regards,
Juno Zhu
IBM China Development Labs (CDL) Cloud IaaS Lab
Email: nazhu at cn.ibm.com
5F, Building 10, 399 Keyuan Road, Zhangjiang Hi-Tech Park, Pudong New 
District, Shanghai, China (201203)



From:        Na Zhu/China/IBM
To:        John McDowall <jmcdowall at paloaltonetworks.com>
Cc:        Ryan Moats <rmoats at us.ibm.com>, OpenStack Development Mailing 
List <openstack-dev at lists.openstack.org>, "discuss at openvswitch.org" <
discuss at openvswitch.org>
Date:        2016/06/01 12:01
Subject:        Re: [ovs-discuss] [OVN] [networking-ovn] [networking-sfc] 
SFC and        OVN


John,

Thanks.

Me and Srilatha (srilatta at us.ibm.com) want to working together with you, I 
know you already did some development works.
Can you tell me what you have done and put the latest code in your private 
repo?
Can we work out a plan and the remaining work?




Regards,
Juno Zhu
IBM China Development Labs (CDL) Cloud IaaS Lab
Email: nazhu at cn.ibm.com
5F, Building 10, 399 Keyuan Road, Zhangjiang Hi-Tech Park, Pudong New 
District, Shanghai, China (201203)




From:        John McDowall <jmcdowall at paloaltonetworks.com>
To:        Ryan Moats <rmoats at us.ibm.com>
Cc:        OpenStack Development Mailing List <
openstack-dev at lists.openstack.org>, "discuss at openvswitch.org" <
discuss at openvswitch.org>
Date:        2016/06/01 08:58
Subject:        Re: [ovs-discuss] [OVN] [networking-ovn] [networking-sfc] 
SFC and        OVN
Sent by:        "discuss" <discuss-bounces at openvswitch.org>



Ryan,

More help is always great :-). As far as who to collaborate, what ever Is 
easiest for everyone ¨C I am pretty flexible.

Regards

John

From: Ryan Moats <rmoats at us.ibm.com>
Date: Tuesday, May 31, 2016 at 1:59 PM
To: John McDowall <jmcdowall at paloaltonetworks.com>
Cc: Ben Pfaff <blp at ovn.org>, "discuss at openvswitch.org" <
discuss at openvswitch.org>, Justin Pettit <jpettit at ovn.org>, OpenStack 
Development Mailing List <openstack-dev at lists.openstack.org>, Russell 
Bryant <russell at ovn.org>
Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
John McDowall <jmcdowall at paloaltonetworks.com> wrote on 05/31/2016 
03:21:30 PM:

> From: John McDowall <jmcdowall at paloaltonetworks.com>
> To: Ryan Moats/Omaha/IBM at IBMUS
> Cc: Ben Pfaff <blp at ovn.org>, "discuss at openvswitch.org" 
> <discuss at openvswitch.org>, Justin Pettit <jpettit at ovn.org>, 
> "OpenStack Development Mailing List" <openstack-
> dev at lists.openstack.org>, Russell Bryant <russell at ovn.org>
> Date: 05/31/2016 03:22 PM
> Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> 
> Ryan,
> 
> Let me add the tables to OVN for SFC. That will give us a working 
> system to prototype the flow classifier approach on. Hopefully I can
> get something done by end of week.
> 
> Regards
> 
> John

I've got some internal folks that are willing to help with writing code 
(as
I will be once I clear my current firefights) so the question of how to
collaborate with code now arises...

Are you comfortable with putting the changes on r.o.o as WiP and 
patchworks
as RFC and work through the review process or would you rather work via
forks and pull requests in github?

Ryan

> From: Ryan Moats <rmoats at us.ibm.com>
> Date: Tuesday, May 31, 2016 at 10:17 AM
> To: John McDowall <jmcdowall at paloaltonetworks.com>
> Cc: Ben Pfaff <blp at ovn.org>, "discuss at openvswitch.org" <
> discuss at openvswitch.org>, Justin Pettit <jpettit at ovn.org>, OpenStack
> Development Mailing List <openstack-dev at lists.openstack.org>, Russell 
Bryant <
> russell at ovn.org>
> Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> 
> John McDowall <jmcdowall at paloaltonetworks.com> wrote on 05/26/2016 
> 11:08:43 AM:
> 
> > From: John McDowall <jmcdowall at paloaltonetworks.com>
> > To: Ryan Moats/Omaha/IBM at IBMUS
> > Cc: Ben Pfaff <blp at ovn.org>, "discuss at openvswitch.org" 
> > <discuss at openvswitch.org>, Justin Pettit <jpettit at ovn.org>, 
> > "OpenStack Development Mailing List" <openstack-
> > dev at lists.openstack.org>, Russell Bryant <russell at ovn.org>
> > Date: 05/26/2016 11:09 AM
> > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > 
> > Ryan,
> > 
> > My (incomplete) throughts about the flow-classifier are:
> > 
> > 1)  ACL¡¯s are more about denying access, while the flow classifier 
> > is more about steering selected traffic to a path, so we would need 
> > to deny-all except allowed flows.
> > 2)  The networking-sfc team has done a nice job with the drivers so 
> > ovn has its own flow-classifier driver which allows us to align the 
> > flow-classifier with the matches supported in ovs/ovn, which could 
> > be an advantage.
> 
> The ACL table has a very simple flow-classifier structure and I'd
> like to see if that can be re-used for the purpose of the SFC classifier
> (read that I feel the Logical_Flow_Classifier table is too complex).
> My initial thoughts were to look at extending the action column and
> using the external-ids field to differentiate between legacy ACLs and
> those that are used to intercept traffic and route it to an SFC.
> 
> > 
> > What were your thoughts on the schema it adds a lot of tables and a 
> > lot of commands ¨C cannot think of anyway around it
> 
> In this case, I think that the other tables are reasonable and I'm 
> uncomfortable trying to stretch the existing tables to cover that
> information...
> 
> Ryan
> 
> > 
> > Regards
> > 
> > John
> > 
> > From: Ryan Moats <rmoats at us.ibm.com>
> > Date: Wednesday, May 25, 2016 at 9:12 PM
> > To: John McDowall <jmcdowall at paloaltonetworks.com>
> > Cc: Ben Pfaff <blp at ovn.org>, "discuss at openvswitch.org" <
> > discuss at openvswitch.org>, Justin Pettit <jpettit at ovn.org>, OpenStack
> > Development Mailing List <openstack-dev at lists.openstack.org>, 
> Russell Bryant <
> > russell at ovn.org>
> > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > 
> > John McDowall <jmcdowall at paloaltonetworks.com> wrote on 05/25/2016 
> > 07:27:46 PM:
> > 
> > > From: John McDowall <jmcdowall at paloaltonetworks.com>
> > > To: Ryan Moats/Omaha/IBM at IBMUS
> > > Cc: "discuss at openvswitch.org" <discuss at openvswitch.org>, "OpenStack 
> > > Development Mailing List" <openstack-dev at lists.openstack.org>, Ben 
> > > Pfaff <blp at ovn.org>, Justin Pettit <jpettit at ovn.org>, Russell Bryant
> > > <russell at ovn.org>
> > > Date: 05/25/2016 07:28 PM
> > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > > 
> > > Ryan,
> > > 
> > > Ok ¨C I will let the experts weigh in on load balancing.
> > > 
> > > In the meantime I have attached a couple of files to show where I am
> > > going. The first is sfc_dict.py and is a representation of the dict 
> > > I am passing from SFC to OVN. This will then translate to the 
> > > attached ovn-nb schema file.
> > > 
> > > One of my concerns is that SFC almost doubles the size of the ovn-nb
> > > schema but I could not think of any other way of doing it.
> > > 
> > > Thoughts?
> > > 
> > > John
> > 
> > The dictionary looks fine for a starting point, and the more I look
> > at the classifier, the more I wonder if we can't do something with
> > the current ACL table to avoid duplication in the NB database
> > definition...
> > 
> > Ryan
> > 
> > > From: Ryan Moats <rmoats at us.ibm.com>
> > > Date: Wednesday, May 25, 2016 at 7:27 AM
> > > To: John McDowall <jmcdowall at paloaltonetworks.com>
> > > Cc: "discuss at openvswitch.org" <discuss at openvswitch.org>, OpenStack 
> > > Development Mailing List <openstack-dev at lists.openstack.org>, Ben 
Pfaff <
> > > blp at ovn.org>, Justin Pettit <jpettit at ovn.org>, Russell Bryant <
> > russell at ovn.org
> > > >
> > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > > 
> > > John McDowall <jmcdowall at paloaltonetworks.com> wrote on 05/24/2016 
> > > 06:33:05 PM:
> > > 
> > > > From: John McDowall <jmcdowall at paloaltonetworks.com>
> > > > To: Ryan Moats/Omaha/IBM at IBMUS
> > > > Cc: "discuss at openvswitch.org" <discuss at openvswitch.org>, 
"OpenStack 
> > > > Development Mailing List" <openstack-dev at lists.openstack.org>
> > > > Date: 05/24/2016 06:33 PM
> > > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > > > 
> > > > Ryan,
> > > > 
> > > > Thanks for getting back to me and pointing me in a more OVS like 
> > > > direction. What you say makes sense, let me hack something 
together.
> > > > I have been a little distracted getting some use cases together. 
The
> > > > other area is how to better map the flow-classifier I have been 
> > > > thinking about it a little, but I will leave it till after we get 
> > > > the chains done.
> > > > 
> > > > Your load-balancing comment was very interesting ¨C I saw some 
> > > > patches for load-balancing a few months ago but nothing since. It 
> > > > would be great if we could align with load-balancing as that would 

> > > > make a really powerful solution.
> > > > 
> > > > Regards
> > > > 
> > > > John
> > > 
> > > John-
> > > 
> > > For the load balancing, I believe that you'll want to look at
> > > openvswitch's select group, as that should let you set up multiple
> > > buckets for each egress port in the port pairs that make up a port
> > > group.
> > > 
> > > As I understand it, Table 0 identifies the logical port and logical
> > > flow. I'm worried that this means we'll end up with separate bucket
> > > rules for each ingress port of the port pairs that make up a port
> > > group, leading to a cardinality product in the number of rules.
> > > I'm trying to think of a way where Table 0 could identify the packet
> > > as being part of a particular port group, and then I'd only need one
> > > set of bucket rules to figure out the egress side.  However, the
> > > amount of free metadata space is limited and so before we go down
> > > this path, I'm going to pull Justin, Ben and Russell in to see if
> > > they buy into this idea or if they can think of an alternative.
> > > 
> > > Ryan
> > > 
> > > > 
> > > > From: Ryan Moats <rmoats at us.ibm.com>
> > > > Date: Monday, May 23, 2016 at 9:06 PM
> > > > To: John McDowall <jmcdowall at paloaltonetworks.com>
> > > > Cc: "discuss at openvswitch.org" <discuss at openvswitch.org>, OpenStack 

> > > > Development Mailing List <openstack-dev at lists.openstack.org>
> > > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > > > 
> > > > John McDowall <jmcdowall at paloaltonetworks.com> wrote on 05/18/2016 

> > > > 03:55:14 PM:
> > > > 
> > > > > From: John McDowall <jmcdowall at paloaltonetworks.com>
> > > > > To: Ryan Moats/Omaha/IBM at IBMUS
> > > > > Cc: "discuss at openvswitch.org" <discuss at openvswitch.org>, 
"OpenStack 
> > > > > Development Mailing List" <openstack-dev at lists.openstack.org>
> > > > > Date: 05/18/2016 03:55 PM
> > > > > Subject: Re: [OVN] [networking-ovn] [networking-sfc] SFC and OVN
> > > > > 
> > > > > Ryan,
> > > > > 
> > > > > OK all three repos and now aligned with their masters. I have 
done 
> > > > > some simple level system tests and I can steer traffic to a 
single 
> > > > > VNF.  Note: some additional changes to networking-sfc to 
catch-up 
> > > > > with their changes.
> > > > > 
> > > > > https://github.com/doonhammer/networking-sfc
> > > > > https://github.com/doonhammer/networking-ovn
> > > > > https://github.com/doonhammer/ovs
> > > > > 
> > > > > The next tasks I see are:
> > > > > 
> > > > > 1. Decouple networking-sfc and networking-ovn. I am thinking 
that I 
> > > > > will pass a nested port-chain dictionary holding 
port-pairs/port-
> > > > > pair-groups/flow-classifiers from networking-sfc to 
networking-ovn.
> > > > > 2. Align the interface between networking-ovn and ovs/ovn to 
match 
> > > > > the nested dictionary in 1.
> > > > > 3. Modify the ovn-nb schema and ovn-northd.c to march the port-
> > > chain model.
> > > > > 4. Add ability to support chain of port-pairs
> > > > > 5. Think about flow-classifiers and how best to map them, today 
I 
> > > > > just map the logical-port and ignore everything else.
> > > > > 
> > > > > Any other suggestions/feedback?
> > > > > 
> > > > > Regards
> > > > > 
> > > > > John
> > > > 
> > > > John-
> > > > 
> > > > (Sorry for sending this twice, but I forgot that text/html is not 
liked
> > > > by the mailing lists ...)
> > > > 
> > > > My apologies for not answering this sooner - I was giving a two 
day
> > > > training on Tues/Wed last week and came back to my son graduating
> > > > from HS the next day, so things have been a bit of a whirlwind 
here.
> > > > 
> > > > Looking at the github repos, I like the idea of passing a 
dictionary
> > > > from networking-sfc to networking-ovn. The flow classifiers should
> > > > be relatively straightforward to map to ovs match rules (famous 
last
> > > > words)...
> > > > 
> > > > I've probably missed an orbit here, but in the ovn-northd 
> implementation,
> > > > I was expecting to find service chains in the egress and 
> router pipelines
> > > > in addition to the ingress pipeline (see below for why I thinka 
service
> > > > chain stage in the egress pipeline makes sense ...)
> > > > 
> > > > Also, in the ovn-northd implementation, I'm a little disturbedto 
see the
> > > > ingress side of the service chain sending packets to output ports 
- I
> > > > think that a more scalable (and more "ovs-like" approach) would be 
to
> > > > match the egress side of a port pair in the chaining stage of the
> > > > ingress pipeline, with an action that  set the input port 
register.
> > > > Then the egress pipeline would have a chaining stage where the 
output
> > > > port register would be set based on the ingress port of the next 
port
> > > > pair in the chain and the packet being punted to the proper output 
port
> > > > in the last table.  That should automagically build your function 
chain
> > > > and provide the basis for bucketizing multiple ingress ports for 
the
> > > > next port group to support hash based load balancing.
> > > > 
> > > > Does that make sense?
> > > > 
> > > > Ryan[attachment "ovn-nb.ovsschema.sfc" deleted by Ryan Moats/
> > > Omaha/IBM] [attachment "sfc_dict.py" deleted by Ryan 
Moats/Omaha/IBM] _______________________________________________
discuss mailing list
discuss at openvswitch.org
http://openvswitch.org/mailman/listinfo/discuss
[attachment "ovn-nb.ovsschema.sfc" deleted by Na Zhu/China/IBM] 
[attachment "sfc_dict.py" deleted by Na Zhu/China/IBM] 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20160602/5705cefc/attachment.html>