[Openstack] Could s/o clarify if DHCP and L3 agents *must* be on different hosts if namespaces are disabled ?
Sylvain Bauza
sylvain.bauza at digimind.com
Thu Mar 21 08:18:01 UTC 2013
Hi Gary,
Le 20/03/2013 17:26, Gary Kotton a écrit :
> Yes, this works. The problem is ensuring the network isolation. That
> is, someone can make changes in the routing table on the host which
> will enable one to gain access to the quantum networks. That is why we
> suggest that they run on different hosts. We have a review that is
> open to enable one to enforce this when the agents starts (this is
> disabled by default to ensure backward compatability and to enable one
> to run an all in one setup - for proof of concepts and testing)
>
Damn, makes sense. Once you explain this, the reasons are clear.
>
>>
>> So, am I wrong ? What is the terrible thing which could happe in a
>> next few days if still keeping my environment as it is ?
>
> No, it is not terrible at all.
Great, my mind feels lighter ;-)
More information about the Openstack
mailing list