root / docs / networks.rst @ 36f338d0
History | View | Annotate | Download (18.2 kB)
1 | b11446c1 | Constantinos Venetsanopoulos | .. _networks: |
---|---|---|---|
2 | b11446c1 | Constantinos Venetsanopoulos | |
3 | b11446c1 | Constantinos Venetsanopoulos | Network Service (part of Cyclades) |
4 | b11446c1 | Constantinos Venetsanopoulos | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
5 | b11446c1 | Constantinos Venetsanopoulos | |
6 | b11446c1 | Constantinos Venetsanopoulos | Network setup overview |
7 | b11446c1 | Constantinos Venetsanopoulos | ====================== |
8 | b11446c1 | Constantinos Venetsanopoulos | |
9 | b11446c1 | Constantinos Venetsanopoulos | Currently the Network Service is part of Cyclades and comes along with the |
10 | b11446c1 | Constantinos Venetsanopoulos | Cyclades software components. |
11 | b11446c1 | Constantinos Venetsanopoulos | |
12 | b11446c1 | Constantinos Venetsanopoulos | Networking is deployment-specific and must be customized based on the specific |
13 | b11446c1 | Constantinos Venetsanopoulos | needs of the system administrator. However, to do so, the administrator needs |
14 | b11446c1 | Constantinos Venetsanopoulos | to understand how each level handles Virtual Networks, to be able to setup the |
15 | b11446c1 | Constantinos Venetsanopoulos | backend appropriately. |
16 | b11446c1 | Constantinos Venetsanopoulos | |
17 | 8f0fc472 | Dimitris Aragiorgis | Since v0.11 Synnefo supports multiple Ganeti clusters (backends). Having in |
18 | 8f0fc472 | Dimitris Aragiorgis | mind that every backend has its locality, there is a high possibility each |
19 | 8f0fc472 | Dimitris Aragiorgis | cluster to have different infrastracture (wires, routers, subnets, gateways, |
20 | 8f0fc472 | Dimitris Aragiorgis | etc.). |
21 | 8f0fc472 | Dimitris Aragiorgis | |
22 | 8f0fc472 | Dimitris Aragiorgis | In the following sections we investigate in a top-down approach, the way |
23 | 8f0fc472 | Dimitris Aragiorgis | networks are defined from the Cyclades, Ganeti, and Backend persperctive. |
24 | 8f0fc472 | Dimitris Aragiorgis | |
25 | b11446c1 | Constantinos Venetsanopoulos | Network @ Cyclades level |
26 | b11446c1 | Constantinos Venetsanopoulos | ------------------------ |
27 | b11446c1 | Constantinos Venetsanopoulos | |
28 | 5031beee | Christos Stavrakakis | Cyclades networks support a range of different options to cover the specific |
29 | 5031beee | Christos Stavrakakis | needs of each deployment. |
30 | 5031beee | Christos Stavrakakis | |
31 | 5031beee | Christos Stavrakakis | First of all, as far as visibility and accessibility is concerned, a network |
32 | 5031beee | Christos Stavrakakis | can be either `public` or `private`. Public networks are created by the |
33 | 5031beee | Christos Stavrakakis | administrator via the command line interface (`snf-manage`) and are visible to |
34 | 5031beee | Christos Stavrakakis | all end-users. On the other hand, private networks are created by the end-user |
35 | 5031beee | Christos Stavrakakis | from the Web UI or the kamaki client and provide isolated Layer 2 connectivity |
36 | 5031beee | Christos Stavrakakis | to the end-user. |
37 | 5031beee | Christos Stavrakakis | |
38 | 5031beee | Christos Stavrakakis | Both networks can have an IPv4 subnet or/and an IPv6 subnet along with the |
39 | 5031beee | Christos Stavrakakis | corresponding gateway. For IPv4 networks, if the `--dhcp` option is set, |
40 | 5031beee | Christos Stavrakakis | Cyclades will treat the IPv4 subnet as an IP pool, and will assign to each VM |
41 | 5031beee | Christos Stavrakakis | that is connected to this network an IPv4 address from this pool. |
42 | 5031beee | Christos Stavrakakis | |
43 | 5031beee | Christos Stavrakakis | A public network can also be marked as a floating IP pool with the |
44 | 5031beee | Christos Stavrakakis | `--floating-ip-pool` option. Floating IPs, are IPv4 addresses that can be |
45 | 5031beee | Christos Stavrakakis | dynamically by added and removed from running VMs. A user can reserve and |
46 | 5031beee | Christos Stavrakakis | release a floating IP address that he can later add and remove it from running |
47 | 5031beee | Christos Stavrakakis | VMs. Also the user can release a floating IP if it not used by any of his |
48 | 5031beee | Christos Stavrakakis | VMs. |
49 | 5031beee | Christos Stavrakakis | |
50 | 5031beee | Christos Stavrakakis | Private networks and floating IPs must be accessible from all instances across |
51 | 5031beee | Christos Stavrakakis | all Ganeti backends. So, such networks must exist in all backends, and |
52 | 5031beee | Christos Stavrakakis | are dynamically created when new Ganeti backends are added. Specially for |
53 | 5031beee | Christos Stavrakakis | private networks, to avoid the overhead of creating the network to all |
54 | 5031beee | Christos Stavrakakis | backends, Cyclades create these networks on demand, when an instance that |
55 | 5031beee | Christos Stavrakakis | lives in a backend tries to connect to this network. |
56 | 5031beee | Christos Stavrakakis | |
57 | 5031beee | Christos Stavrakakis | The administrator may also want to connect instances to some network, without |
58 | 5031beee | Christos Stavrakakis | supporting floating IPs (e.g. to enforce each VM to be connected to a specific |
59 | 5031beee | Christos Stavrakakis | network). This can be achieved by setting the `DEFAULT_INSTANCE_NETWORKS` |
60 | 5031beee | Christos Stavrakakis | setting to the list of the selected networks. The special keyword |
61 | 5031beee | Christos Stavrakakis | `SNF:ANY_PUBLIC` may be used as a network identifier, to indicate to the system |
62 | 5031beee | Christos Stavrakakis | to peak any of the public networks that has a free IP address. Public networks |
63 | 5031beee | Christos Stavrakakis | that are not floating IP pools, do not need to exist to all Ganeti backends, |
64 | 5031beee | Christos Stavrakakis | since the Cyclades backend allocator, will route spawned vms to a Ganeti |
65 | 5031beee | Christos Stavrakakis | backend that the selected networks exist. The administrator can choose in |
66 | 5031beee | Christos Stavrakakis | which backends to create the network via the `--backends` command line option. |
67 | 5031beee | Christos Stavrakakis | |
68 | 5031beee | Christos Stavrakakis | Another distinction between networks is their flavor. Flavor is a way to |
69 | 5031beee | Christos Stavrakakis | abstract infrastructure specific options, that are used to ensure connectivity |
70 | 5031beee | Christos Stavrakakis | and isolation to the VMs connected to the network. It is a set of options that |
71 | 5031beee | Christos Stavrakakis | eventually will guide scripts to set up rules, while creating virtual |
72 | 5031beee | Christos Stavrakakis | interfaces in the node level. Each of these flavors define attributes that will |
73 | 5031beee | Christos Stavrakakis | be used at Ganeti level to create the physical network. These attributes are: |
74 | 5031beee | Christos Stavrakakis | |
75 | 5031beee | Christos Stavrakakis | * ``mode``: Whether the network is in 'bridged' or 'routed' mode. |
76 | 5031beee | Christos Stavrakakis | * ``link``: Bridge for 'bridged' networks and routing table for 'routed' |
77 | 5031beee | Christos Stavrakakis | networks. e.g. 'br100', 'rt200' |
78 | 5031beee | Christos Stavrakakis | * ``mac_prefix``: A MAC prefix for the network. e.g. 'aa:00:05' |
79 | 5031beee | Christos Stavrakakis | * ``tags``: A list of tags to be used at the Ganeti level. |
80 | 8f0fc472 | Dimitris Aragiorgis | |
81 | 8f0fc472 | Dimitris Aragiorgis | To ensure L2 isolation, Synnefo supports two different mechanisms (see also Node |
82 | 8f0fc472 | Dimitris Aragiorgis | Level section): |
83 | 8f0fc472 | Dimitris Aragiorgis | |
84 | 5031beee | Christos Stavrakakis | * assigning one physical VLAN per network |
85 | 5031beee | Christos Stavrakakis | * assigning one MAC prefix per network, so that every NIC attached to this |
86 | 5031beee | Christos Stavrakakis | network will have this prefix. Isolation is then achieved by filtering |
87 | 5031beee | Christos Stavrakakis | rules (via `ebtables`) based on a specific mask (ff:ff:f0:00:00:00, see Node |
88 | 5031beee | Christos Stavrakakis | Level section for more details). |
89 | 8f0fc472 | Dimitris Aragiorgis | |
90 | 8f0fc472 | Dimitris Aragiorgis | Having this in mind and in order to prevent assignment of duplicate VLAN/MAC |
91 | 8f0fc472 | Dimitris Aragiorgis | prefix to different networks, Synnefo supports two types of Pools: |
92 | 8f0fc472 | Dimitris Aragiorgis | |
93 | 5031beee | Christos Stavrakakis | - Bridge Pool (corresponding to a number of VLANs bridged to those bridges) |
94 | 5031beee | Christos Stavrakakis | - MAC prefix Pool |
95 | b11446c1 | Constantinos Venetsanopoulos | |
96 | 5031beee | Christos Stavrakakis | For Pool handling refer to the corresponding doc section. To use this pools, |
97 | 5031beee | Christos Stavrakakis | set either `--link` or `--mac-prefix` to the reserved keyword `pool`. |
98 | b11446c1 | Constantinos Venetsanopoulos | |
99 | 8f0fc472 | Dimitris Aragiorgis | Existing network flavors are the following: |
100 | b11446c1 | Constantinos Venetsanopoulos | |
101 | 026b4844 | Christos Stavrakakis | ============== ======= =============================== ====================== ================== |
102 | 026b4844 | Christos Stavrakakis | Flavor Name Mode Link MAC prefix Tags |
103 | 026b4844 | Christos Stavrakakis | ============== ======= =============================== ====================== ================== |
104 | 026b4844 | Christos Stavrakakis | IP_LESS_ROUTED routed ``DEFAULT_ROUTING_TABLE`` ``DEFAULT_MAC_PREFIX`` 'ip-less-routed' |
105 | 026b4844 | Christos Stavrakakis | MAC_FILTERED bridged ``DEFAULT_MAC_FILTERED_BRIDGE`` 'pool' 'private'filtered' |
106 | 026b4844 | Christos Stavrakakis | PHYSICAL_VLAN bridged 'pool' ``DEFAULT_MAC_PREFIX`` 'physical-vlan' |
107 | 026b4844 | Christos Stavrakakis | CUSTOM bridged ``DEFAULT_BRIDGE`` ``DEFAULT_MAC_PREFIX`` |
108 | 026b4844 | Christos Stavrakakis | ============== ======= =============================== ====================== ================== |
109 | b11446c1 | Constantinos Venetsanopoulos | |
110 | 5031beee | Christos Stavrakakis | ``DEFAULT_ROUTING_TABLE``, ``DEFAULT_MAC_PREFIX``, ``DEFAULT_BRIDGE``, |
111 | 5031beee | Christos Stavrakakis | ``DEFAULT_MAC_FILTERED_BRIDGE`` are all configurable settings in |
112 | 5031beee | Christos Stavrakakis | ``/etc/synnefo/20-snf-cyclades-app-api.conf``. 'pool' is used to denote that a |
113 | 5031beee | Christos Stavrakakis | link or MAC prefix will be allocated from the corresponding Pool. Finally, |
114 | 5031beee | Christos Stavrakakis | most of these attributes, may be overridden when creating networks with |
115 | 5031beee | Christos Stavrakakis | `snf-manage network-create command`. |
116 | 026b4844 | Christos Stavrakakis | |
117 | 026b4844 | Christos Stavrakakis | The administrator is able to create any of the above flavors |
118 | f30db88d | Constantinos Venetsanopoulos | and override their default values by explicitly passing mode, link, etc. using |
119 | f30db88d | Constantinos Venetsanopoulos | the `snf-manage network-create` command. |
120 | f30db88d | Constantinos Venetsanopoulos | |
121 | 5031beee | Christos Stavrakakis | The administrator can create networks of any flavor, but end-users is allowed |
122 | 5031beee | Christos Stavrakakis | to create via API only networks with flavors that are set in the |
123 | 5031beee | Christos Stavrakakis | `API_ENABLED_NETWORK_FLAVORS` setting. |
124 | b11446c1 | Constantinos Venetsanopoulos | |
125 | b11446c1 | Constantinos Venetsanopoulos | Network @ Ganeti level |
126 | b11446c1 | Constantinos Venetsanopoulos | ---------------------- |
127 | b11446c1 | Constantinos Venetsanopoulos | |
128 | f30db88d | Constantinos Venetsanopoulos | Currently, stable Ganeti does not support IP Pool management. However, the |
129 | f30db88d | Constantinos Venetsanopoulos | functionality has been merged in the official Ganeti master branch and will |
130 | f30db88d | Constantinos Venetsanopoulos | appear on Ganeti 2.7.0. So, you can either checkout the Ganeti master branch |
131 | f30db88d | Constantinos Venetsanopoulos | and build your packages, or clone our local repo |
132 | f30db88d | Constantinos Venetsanopoulos | https://code.grnet.gr/git/ganeti-local and checkout the |
133 | f30db88d | Constantinos Venetsanopoulos | `stable-2.6-ippool-hotplug-esi` branch. This is the Ganeti stable branch with |
134 | f30db88d | Constantinos Venetsanopoulos | IP pool management, Hotplugging and ExtStorage Interface features merged on top |
135 | f30db88d | Constantinos Venetsanopoulos | of it. The last two features are not a hard Synnefo requirement, but will |
136 | f30db88d | Constantinos Venetsanopoulos | enable you to do neat things when you get experienced with Synnefo. They are |
137 | f30db88d | Constantinos Venetsanopoulos | going to be pushed for review upstream sometime soon. |
138 | b11446c1 | Constantinos Venetsanopoulos | |
139 | 8f0fc472 | Dimitris Aragiorgis | Any network created in Synnefo is also created in one (for public networks) or |
140 | 8f0fc472 | Dimitris Aragiorgis | all (for private networks) Ganeti backends. In Ganeti a network can have the |
141 | 8f0fc472 | Dimitris Aragiorgis | following options: |
142 | b11446c1 | Constantinos Venetsanopoulos | |
143 | 8f0fc472 | Dimitris Aragiorgis | - network (192.168.0.0/24, mandatory) |
144 | 8f0fc472 | Dimitris Aragiorgis | - gateway (192.168.0.1) |
145 | 8f0fc472 | Dimitris Aragiorgis | - network6 (2001:648:2ffc:1201::/64) |
146 | 8f0fc472 | Dimitris Aragiorgis | - gateway6 (2001:648:2ffc:1201::1) |
147 | 8f0fc472 | Dimitris Aragiorgis | - mac_prefix (aa:00:01) |
148 | 8f0fc472 | Dimitris Aragiorgis | - type (private, public) |
149 | 8f0fc472 | Dimitris Aragiorgis | - tags |
150 | b11446c1 | Constantinos Venetsanopoulos | |
151 | 8f0fc472 | Dimitris Aragiorgis | Networks in Ganeti cannot be used unless they are connected to a nodegroup in |
152 | 8f0fc472 | Dimitris Aragiorgis | order to define the connectivity mode and link. Synnefo, after creating a |
153 | 8f0fc472 | Dimitris Aragiorgis | network, connects it to all nodegroups of the Ganeti cluster(s) with the given |
154 | 8f0fc472 | Dimitris Aragiorgis | mode and link (defined in the network flavor). |
155 | 8f0fc472 | Dimitris Aragiorgis | |
156 | 8f0fc472 | Dimitris Aragiorgis | Ganeti makes use of environment variables to inform scripts about each NIC's |
157 | 8f0fc472 | Dimitris Aragiorgis | setup. `kvm-vif-script` that comes with `snf-network` sets up the nfdhcpd lease and |
158 | 8f0fc472 | Dimitris Aragiorgis | applies any rules needed depending on the network's mode, link, mac_prefix and |
159 | 8f0fc472 | Dimitris Aragiorgis | tags. |
160 | b11446c1 | Constantinos Venetsanopoulos | |
161 | b11446c1 | Constantinos Venetsanopoulos | Network @ Physical host level |
162 | b11446c1 | Constantinos Venetsanopoulos | ----------------------------- |
163 | b11446c1 | Constantinos Venetsanopoulos | |
164 | 8f0fc472 | Dimitris Aragiorgis | Currently, networking infrastructure must be pre-provisioned before creating |
165 | 8f0fc472 | Dimitris Aragiorgis | networks in Synnefo. According to which flavors you want to support, you should |
166 | 8f0fc472 | Dimitris Aragiorgis | have already setup all your physical hosts correspondingly. This means you |
167 | 8f0fc472 | Dimitris Aragiorgis | need: |
168 | 8f0fc472 | Dimitris Aragiorgis | |
169 | 48f0d8e5 | Dimitris Aragiorgis | - one bridge for the ``CUSTOM`` flavor (br0, see Fig. 1) |
170 | 8f0fc472 | Dimitris Aragiorgis | - one bridge for the ``MAC_FILTERED`` flavor (prv0, see Fig. 2) |
171 | 8f0fc472 | Dimitris Aragiorgis | - a number of bridges and their corresponding VLANs (bridged to them) for |
172 | 8f0fc472 | Dimitris Aragiorgis | the ``PHYSICAL_VLAN`` flavor (prv1..prv100, see Fig. 3) |
173 | 8f0fc472 | Dimitris Aragiorgis | - a routing table for the ``IP_LESS_ROUTED`` flavor (snf_public, see Fig. 4) |
174 | 8f0fc472 | Dimitris Aragiorgis | |
175 | 8f0fc472 | Dimitris Aragiorgis | Please refer to the following figures, which clarify each infrastructure setup |
176 | 8f0fc472 | Dimitris Aragiorgis | and how connectivity and isolation is achieved in every case for every type of |
177 | 8f0fc472 | Dimitris Aragiorgis | network. |
178 | 8f0fc472 | Dimitris Aragiorgis | |
179 | 8f0fc472 | Dimitris Aragiorgis | |
180 | 8f0fc472 | Dimitris Aragiorgis | FLAVORS |
181 | 8f0fc472 | Dimitris Aragiorgis | ======= |
182 | 8f0fc472 | Dimitris Aragiorgis | |
183 | 8f0fc472 | Dimitris Aragiorgis | As mentioned earlier supported flavors are: |
184 | 8f0fc472 | Dimitris Aragiorgis | |
185 | 48f0d8e5 | Dimitris Aragiorgis | - CUSTOM |
186 | 8f0fc472 | Dimitris Aragiorgis | - IP_LESS_ROUTED |
187 | 8f0fc472 | Dimitris Aragiorgis | - MAC_FILTERED |
188 | 8f0fc472 | Dimitris Aragiorgis | - PHYSICAL_VLAN |
189 | 8f0fc472 | Dimitris Aragiorgis | |
190 | 8f0fc472 | Dimitris Aragiorgis | In the following sections we mention what configuration imposes each flavor from |
191 | 8f0fc472 | Dimitris Aragiorgis | Synnefo, Ganeti and Physical host perspective. |
192 | 8f0fc472 | Dimitris Aragiorgis | |
193 | 8f0fc472 | Dimitris Aragiorgis | |
194 | 8f0fc472 | Dimitris Aragiorgis | |
195 | 48f0d8e5 | Dimitris Aragiorgis | DEFAULT SCENARIO |
196 | 48f0d8e5 | Dimitris Aragiorgis | ---------------- |
197 | 8f0fc472 | Dimitris Aragiorgis | |
198 | 48f0d8e5 | Dimitris Aragiorgis | In this case we will bridge all primary interfaces of the VMs on one bridge that must |
199 | 48f0d8e5 | Dimitris Aragiorgis | be the same collition domain with the router. The router sould then forward packets |
200 | 48f0d8e5 | Dimitris Aragiorgis | (if a public IPv4 Subnet is available) or do NAT in order to provide internet access to |
201 | 48f0d8e5 | Dimitris Aragiorgis | the VMs. |
202 | 8f0fc472 | Dimitris Aragiorgis | |
203 | 48f0d8e5 | Dimitris Aragiorgis | To this end we will use the CUSTOM flavor and pre-provision in each Ganeti |
204 | 48f0d8e5 | Dimitris Aragiorgis | node one bridge (e.g. ``br100``). If we assume that ``eth1`` is the physical interface |
205 | 48f0d8e5 | Dimitris Aragiorgis | connected to the router, run: |
206 | 8f0fc472 | Dimitris Aragiorgis | |
207 | 8f0fc472 | Dimitris Aragiorgis | .. image:: images/network-bridged.png |
208 | 8f0fc472 | Dimitris Aragiorgis | :align: right |
209 | 8f0fc472 | Dimitris Aragiorgis | :height: 550px |
210 | 8f0fc472 | Dimitris Aragiorgis | :width: 500px |
211 | 8f0fc472 | Dimitris Aragiorgis | |
212 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
213 | 8f0fc472 | Dimitris Aragiorgis | |
214 | 8f0fc472 | Dimitris Aragiorgis | # brctl addbr br100 |
215 | 48f0d8e5 | Dimitris Aragiorgis | # brctl addif br100 eth1 |
216 | 8f0fc472 | Dimitris Aragiorgis | # ip link set br100 up |
217 | 8f0fc472 | Dimitris Aragiorgis | |
218 | 8f0fc472 | Dimitris Aragiorgis | # brctl show |
219 | 8f0fc472 | Dimitris Aragiorgis | bridge name bridge id STP enabled interfaces |
220 | 48f0d8e5 | Dimitris Aragiorgis | br100 8000.8a3c3ede3583 no eth1 |
221 | 8f0fc472 | Dimitris Aragiorgis | |
222 | 8f0fc472 | Dimitris Aragiorgis | |
223 | 8f0fc472 | Dimitris Aragiorgis | |
224 | 8f0fc472 | Dimitris Aragiorgis | Then in Cyclades run: |
225 | 8f0fc472 | Dimitris Aragiorgis | |
226 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
227 | 8f0fc472 | Dimitris Aragiorgis | |
228 | be8c3784 | Christos Stavrakakis | # snf-manage network-create --subnet=5.6.7.0/27 --gateway=5.6.7.1 --subnet6=2001:648:2FFC:1322::/64 --gateway6=2001:648:2FFC:1322::1 --public --dhcp=True --flavor=CUSTOM --link=br100 ----name=default --backend-id=1 |
229 | 8f0fc472 | Dimitris Aragiorgis | |
230 | 8f0fc472 | Dimitris Aragiorgis | # snf-manage network-list |
231 | 8f0fc472 | Dimitris Aragiorgis | id name flavor owner mac_prefix dhcp state link vms public IPv4 Subnet IPv4 Gateway |
232 | 48f0d8e5 | Dimitris Aragiorgis | 1 default CUSTOM True ACTIVE br100 True 5.6.7.0/27 5.6.7.1 |
233 | 8f0fc472 | Dimitris Aragiorgis | |
234 | 8f0fc472 | Dimitris Aragiorgis | This will add a network in Synnefo DB and create a network in Ganeti backend by |
235 | 8f0fc472 | Dimitris Aragiorgis | issuing: |
236 | 8f0fc472 | Dimitris Aragiorgis | |
237 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
238 | 8f0fc472 | Dimitris Aragiorgis | |
239 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network add --network=5.6.7.0/27 --gateway=5.6.7.1 --network6=2001:648:2FFC:1322::/64 --gateway6=2001:648:2FFC:1322::1 --network-type=public --tags=nfdhcpd snf-net-1 |
240 | 8f0fc472 | Dimitris Aragiorgis | |
241 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network connect snf-net-1 default bridged br100 |
242 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network list snf-net-1 |
243 | 8f0fc472 | Dimitris Aragiorgis | Network Subnet Gateway NetworkType MacPrefix GroupList Tags |
244 | 8f0fc472 | Dimitris Aragiorgis | snf-net-1 5.6.7.0/27 5.6.7.1 public None default(bridged, br100) nfdhcpd |
245 | 8f0fc472 | Dimitris Aragiorgis | |
246 | 8f0fc472 | Dimitris Aragiorgis | |
247 | 8f0fc472 | Dimitris Aragiorgis | To enable NAT in a Internal Router if you do not have a public IP range available |
248 | 48f0d8e5 | Dimitris Aragiorgis | but only a public routable IP (e.g 1.2.3.4): |
249 | 8f0fc472 | Dimitris Aragiorgis | |
250 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
251 | 8f0fc472 | Dimitris Aragiorgis | |
252 | 48f0d8e5 | Dimitris Aragiorgis | # ip addr add 5.6.7.1/27 dev eth1 |
253 | 48f0d8e5 | Dimitris Aragiorgis | # iptables -t nat -A POSTROUTING -o eth1 --to-source 1.2.3.4 -j SNAT |
254 | 8f0fc472 | Dimitris Aragiorgis | |
255 | 8f0fc472 | Dimitris Aragiorgis | IP_LESS_ROUTED |
256 | 8f0fc472 | Dimitris Aragiorgis | -------------- |
257 | 8f0fc472 | Dimitris Aragiorgis | |
258 | 8f0fc472 | Dimitris Aragiorgis | .. image:: images/network-routed.png |
259 | 8f0fc472 | Dimitris Aragiorgis | :align: right |
260 | 8f0fc472 | Dimitris Aragiorgis | :height: 580px |
261 | 8f0fc472 | Dimitris Aragiorgis | :width: 500px |
262 | 8f0fc472 | Dimitris Aragiorgis | |
263 | 8f0fc472 | Dimitris Aragiorgis | To create a network with IP_LESS_ROUTED flavor run you have to pre-provision in |
264 | 8f0fc472 | Dimitris Aragiorgis | each Ganeti node one routing table (e.g. ``snf_public``) that will do all the |
265 | 8f0fc472 | Dimitris Aragiorgis | routing from/to the VMs' taps. Additionally you must enable ``Proxy-ARP`` |
266 | 48f0d8e5 | Dimitris Aragiorgis | support. All traffic will be on a single iterface (e.g. ``eth1``). |
267 | 8f0fc472 | Dimitris Aragiorgis | |
268 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
269 | 8f0fc472 | Dimitris Aragiorgis | |
270 | 8f0fc472 | Dimitris Aragiorgis | # echo 1 > /proc/sys/net/ipv4/conf/ip_fowarding |
271 | 8f0fc472 | Dimitris Aragiorgis | # echo 10 snf_public >> /etc/iproute2/rt_tables |
272 | 48f0d8e5 | Dimitris Aragiorgis | # ip route add 5.6.7.0/27 dev eth1 |
273 | 48f0d8e5 | Dimitris Aragiorgis | # ip route add 5.6.7.0/27 dev eth1 table snf_public |
274 | 48f0d8e5 | Dimitris Aragiorgis | # ip route add default via 5.6.7.1 dev eth1 table snf_public |
275 | 48f0d8e5 | Dimitris Aragiorgis | # ip rule add iif eth1 lookup snf_public |
276 | 48f0d8e5 | Dimitris Aragiorgis | # arptables -A OUTPUT -o eth1 --opcode 1 --mangle-ip-s 5.6.7.30 # last ip in Subnet |
277 | 8f0fc472 | Dimitris Aragiorgis | |
278 | 8f0fc472 | Dimitris Aragiorgis | Then in Cyclades run: |
279 | 8f0fc472 | Dimitris Aragiorgis | |
280 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
281 | 8f0fc472 | Dimitris Aragiorgis | |
282 | be8c3784 | Christos Stavrakakis | # snf-manage network-create --subnet=5.6.7.0/27 --gateway=5.6.7.1 --subnet6=2001:648:2FFC:1322::/64 --gateway6=2001:648:2FFC:1322::1 --public --dhcp=True --flavor=IP_LESS_ROUTED --name=routed --backend-id=1 |
283 | 8f0fc472 | Dimitris Aragiorgis | |
284 | 8f0fc472 | Dimitris Aragiorgis | # snf-manage network-list |
285 | 8f0fc472 | Dimitris Aragiorgis | id name flavor owner mac_prefix dhcp state link vms public IPv4 Subnet IPv4 Gateway |
286 | 8f0fc472 | Dimitris Aragiorgis | 2 routed IP_LESS_ROUTED True ACTIVE snf_public True 5.6.7.0/27 5.6.7.1 |
287 | 8f0fc472 | Dimitris Aragiorgis | |
288 | 8f0fc472 | Dimitris Aragiorgis | |
289 | 8f0fc472 | Dimitris Aragiorgis | This will add a network in Synnefo DB and create a network in Ganeti backend by |
290 | 8f0fc472 | Dimitris Aragiorgis | issuing: |
291 | 8f0fc472 | Dimitris Aragiorgis | |
292 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
293 | 8f0fc472 | Dimitris Aragiorgis | |
294 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network add --network=5.6.7.0/27 --gateway=5.6.7.1 --network6=2001:648:2FFC:1322::/64 --gateway6=2001:648:2FFC:1322::1 --network-type=public --tags=nfdhcpd,ip-less-routed snf-net-2 |
295 | 8f0fc472 | Dimitris Aragiorgis | |
296 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network connect snf-net-2 default bridged br100 |
297 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network list snf-net-2 |
298 | 8f0fc472 | Dimitris Aragiorgis | Network Subnet Gateway NetworkType MacPrefix GroupList Tags |
299 | 8f0fc472 | Dimitris Aragiorgis | dimara-net-1 62.217.123.128/27 62.217.123.129 public None default(routed, snf_public) nfdhcpd,ip-less-routed |
300 | 8f0fc472 | Dimitris Aragiorgis | |
301 | 8f0fc472 | Dimitris Aragiorgis | |
302 | 8f0fc472 | Dimitris Aragiorgis | |
303 | 8f0fc472 | Dimitris Aragiorgis | |
304 | 8f0fc472 | Dimitris Aragiorgis | MAC_FILTERED |
305 | 8f0fc472 | Dimitris Aragiorgis | ------------ |
306 | 8f0fc472 | Dimitris Aragiorgis | |
307 | 8f0fc472 | Dimitris Aragiorgis | |
308 | 8f0fc472 | Dimitris Aragiorgis | To create a network with MAC_FILTERED flavor you have to pre-provision in each Ganeti |
309 | 48f0d8e5 | Dimitris Aragiorgis | node one bridge (e.g. ``prv0``) that will be bridged with one interface (e.g. ``eth2``) |
310 | 48f0d8e5 | Dimitris Aragiorgis | across the whole cluster. |
311 | 8f0fc472 | Dimitris Aragiorgis | |
312 | 8f0fc472 | Dimitris Aragiorgis | .. image:: images/network-mac.png |
313 | 8f0fc472 | Dimitris Aragiorgis | :align: right |
314 | 8f0fc472 | Dimitris Aragiorgis | :height: 500px |
315 | 8f0fc472 | Dimitris Aragiorgis | :width: 500px |
316 | 8f0fc472 | Dimitris Aragiorgis | |
317 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
318 | 8f0fc472 | Dimitris Aragiorgis | |
319 | 8f0fc472 | Dimitris Aragiorgis | # brctl addbr prv0 |
320 | 48f0d8e5 | Dimitris Aragiorgis | # brctl addif prv0 eth2 |
321 | 8f0fc472 | Dimitris Aragiorgis | # ip link set prv0 up |
322 | 8f0fc472 | Dimitris Aragiorgis | |
323 | 8f0fc472 | Dimitris Aragiorgis | # brctl show |
324 | 8f0fc472 | Dimitris Aragiorgis | bridge name bridge id STP enabled interfaces |
325 | 48f0d8e5 | Dimitris Aragiorgis | prv0 8000.8a3c3ede3583 no eth2 |
326 | 8f0fc472 | Dimitris Aragiorgis | |
327 | 8f0fc472 | Dimitris Aragiorgis | |
328 | 8f0fc472 | Dimitris Aragiorgis | |
329 | 8f0fc472 | Dimitris Aragiorgis | Then in Cyclades first create a pool for MAC prefixes by running: |
330 | 8f0fc472 | Dimitris Aragiorgis | |
331 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
332 | 8f0fc472 | Dimitris Aragiorgis | |
333 | 48f0d8e5 | Dimitris Aragiorgis | # snf-manage pool-create --type=mac-prefix --base=aa:00:0 --size=65536 |
334 | 8f0fc472 | Dimitris Aragiorgis | |
335 | 8f0fc472 | Dimitris Aragiorgis | and the create the network: |
336 | 8f0fc472 | Dimitris Aragiorgis | |
337 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
338 | 8f0fc472 | Dimitris Aragiorgis | |
339 | be8c3784 | Christos Stavrakakis | # snf-manage network-create --subnet=192.168.1.0/24 --gateway=192.168.1.0/24 --dhcp=True --flavor=MAC_FILTERED --link=prv0 --name=mac --backend-id=1 |
340 | 8f0fc472 | Dimitris Aragiorgis | # snf-manage network-list |
341 | 8f0fc472 | Dimitris Aragiorgis | id name flavor owner mac_prefix dhcp state link vms public IPv4 Subnet IPv4 Gateway |
342 | 8f0fc472 | Dimitris Aragiorgis | 3 mac MAC_FILTERED aa:00:01 True ACTIVE prv0 False 192.168.1.0/24 192.168.1.1 |
343 | 8f0fc472 | Dimitris Aragiorgis | |
344 | 48f0d8e5 | Dimitris Aragiorgis | Edit the synnefo setting `DEFAULT_MAC_FILTERED_BRIDGE` to `prv0`. |
345 | 48f0d8e5 | Dimitris Aragiorgis | |
346 | 8f0fc472 | Dimitris Aragiorgis | This will add a network in Synnefo DB and create a network in Ganeti backend by |
347 | 8f0fc472 | Dimitris Aragiorgis | issuing: |
348 | 8f0fc472 | Dimitris Aragiorgis | |
349 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
350 | 8f0fc472 | Dimitris Aragiorgis | |
351 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network add --network=192.168.1.0/24 --gateway=192.168.1.1 --network-type=private --tags=nfdhcpd,private-filtered snf-net-3 |
352 | 8f0fc472 | Dimitris Aragiorgis | |
353 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network connect snf-net-3 default bridged prv0 |
354 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network list snf-net-3 |
355 | 8f0fc472 | Dimitris Aragiorgis | Network Subnet Gateway NetworkType MacPrefix GroupList Tags |
356 | 8f0fc472 | Dimitris Aragiorgis | snf-net-3 192.168.1.0/24 192.168.1.1 private aa:00:01 default(bridged, prv0) nfdhcpd,private-filtered |
357 | 8f0fc472 | Dimitris Aragiorgis | |
358 | 8f0fc472 | Dimitris Aragiorgis | |
359 | 8f0fc472 | Dimitris Aragiorgis | |
360 | 8f0fc472 | Dimitris Aragiorgis | |
361 | 8f0fc472 | Dimitris Aragiorgis | |
362 | 8f0fc472 | Dimitris Aragiorgis | |
363 | 8f0fc472 | Dimitris Aragiorgis | PHYSICAL_VLAN |
364 | 8f0fc472 | Dimitris Aragiorgis | ------------- |
365 | 48f0d8e5 | Dimitris Aragiorgis | |
366 | 48f0d8e5 | Dimitris Aragiorgis | |
367 | 8f0fc472 | Dimitris Aragiorgis | To create a network with PHYSICAL_VALN flavor you have to pre-provision in each Ganeti |
368 | 8f0fc472 | Dimitris Aragiorgis | node a range of bridges (e.g. ``prv1..20``) that will be bridged with the corresponding VLANs (e.g. ``401..420``) |
369 | 48f0d8e5 | Dimitris Aragiorgis | across the whole cluster. To this end if we assume that ``eth3`` is the interface to use, run: |
370 | 8f0fc472 | Dimitris Aragiorgis | |
371 | 8f0fc472 | Dimitris Aragiorgis | .. image:: images/network-vlan.png |
372 | 8f0fc472 | Dimitris Aragiorgis | :align: right |
373 | 8f0fc472 | Dimitris Aragiorgis | :height: 480px |
374 | 8f0fc472 | Dimitris Aragiorgis | :width: 500px |
375 | 8f0fc472 | Dimitris Aragiorgis | |
376 | 8f0fc472 | Dimitris Aragiorgis | |
377 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
378 | 8f0fc472 | Dimitris Aragiorgis | |
379 | 8f0fc472 | Dimitris Aragiorgis | # for i in {1..20}; do |
380 | 48f0d8e5 | Dimitris Aragiorgis | br=prv$i ; vlanid=$((400+i)) ; vlan=eth3.$vlanid |
381 | 8f0fc472 | Dimitris Aragiorgis | brctl addbr $br ; ip link set $br up |
382 | 8f0fc472 | Dimitris Aragiorgis | vconfig add eth0 vlanid ; ip link set vlan up |
383 | 8f0fc472 | Dimitris Aragiorgis | brctl addif $br $vlan |
384 | 8f0fc472 | Dimitris Aragiorgis | done |
385 | 8f0fc472 | Dimitris Aragiorgis | # brctl show |
386 | 8f0fc472 | Dimitris Aragiorgis | bridge name bridge id STP enabled interfaces |
387 | 48f0d8e5 | Dimitris Aragiorgis | prv1 8000.8a3c3ede3583 no eth3.401 |
388 | 48f0d8e5 | Dimitris Aragiorgis | prv2 8000.8a3c3ede3583 no eth3.402 |
389 | 8f0fc472 | Dimitris Aragiorgis | ... |
390 | 8f0fc472 | Dimitris Aragiorgis | |
391 | 8f0fc472 | Dimitris Aragiorgis | |
392 | 8f0fc472 | Dimitris Aragiorgis | Then in Cyclades first create a pool for bridges by running: |
393 | 8f0fc472 | Dimitris Aragiorgis | |
394 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
395 | 8f0fc472 | Dimitris Aragiorgis | |
396 | 8f0fc472 | Dimitris Aragiorgis | # snf-manage pool-create --type=bridge --base=prv --size=20 |
397 | 8f0fc472 | Dimitris Aragiorgis | |
398 | 8f0fc472 | Dimitris Aragiorgis | and the create the network: |
399 | 8f0fc472 | Dimitris Aragiorgis | |
400 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
401 | 8f0fc472 | Dimitris Aragiorgis | |
402 | be8c3784 | Christos Stavrakakis | # snf-manage network-create --subnet=192.168.1.0/24 --gateway=192.168.1.0/24 --dhcp=True --flavor=PHYSICAL_VLAN --name=vlan --backend-id=1 |
403 | 8f0fc472 | Dimitris Aragiorgis | |
404 | 8f0fc472 | Dimitris Aragiorgis | # snf-manage network-list |
405 | 8f0fc472 | Dimitris Aragiorgis | id name flavor owner mac_prefix dhcp state link vms public IPv4 Subnet IPv4 Gateway |
406 | 8f0fc472 | Dimitris Aragiorgis | 4 vlan PHYSICAL_VLAN True ACTIVE prv1 False 192.168.1.0/24 192.168.1.1 |
407 | 8f0fc472 | Dimitris Aragiorgis | |
408 | 8f0fc472 | Dimitris Aragiorgis | This will add a network in Synnefo DB and create a network in Ganeti backend by |
409 | 8f0fc472 | Dimitris Aragiorgis | issuing: |
410 | 8f0fc472 | Dimitris Aragiorgis | |
411 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
412 | 8f0fc472 | Dimitris Aragiorgis | |
413 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network add --network=192.168.1.0/24 --gateway=192.168.1.1 --network-type=private --tags=nfdhcpd,physica-vlan snf-net-4 |
414 | 8f0fc472 | Dimitris Aragiorgis | |
415 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network connect snf-net-4 default bridged prv1 |
416 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network list snf-net-4 |
417 | 8f0fc472 | Dimitris Aragiorgis | Network Subnet Gateway NetworkType MacPrefix GroupList Tags |
418 | 8f0fc472 | Dimitris Aragiorgis | snf-net-4 192.168.1.0/24 192.168.1.1 private None default(bridged, prv1) nfdhcpd,physical-vlan |
419 | 8f0fc472 | Dimitris Aragiorgis | |
420 | 8f0fc472 | Dimitris Aragiorgis | |
421 | 8f0fc472 | Dimitris Aragiorgis | |
422 | 48f0d8e5 | Dimitris Aragiorgis | ADVANCED SCENARIO |
423 | 48f0d8e5 | Dimitris Aragiorgis | ----------------- |
424 | 8f0fc472 | Dimitris Aragiorgis | |
425 | 8f0fc472 | Dimitris Aragiorgis | To create a network with CUSTOM flavor you have to pass your self mode, link, |
426 | 8f0fc472 | Dimitris Aragiorgis | mac prefix, tags for the network. You are not allowed to use the existing pools |
427 | 8f0fc472 | Dimitris Aragiorgis | (only MAC_FILTERED, PHYSICAL_VLAN use them) so link and mac prefix uniqueness |
428 | 8f0fc472 | Dimitris Aragiorgis | cannot be guaranteed. |
429 | 8f0fc472 | Dimitris Aragiorgis | |
430 | f30db88d | Constantinos Venetsanopoulos | Lets assume a bridge ``br200`` that serves a VPN network to GRNET already exists |
431 | f30db88d | Constantinos Venetsanopoulos | on Ganeti nodes and we want to create for a certain user a private network so |
432 | 8f0fc472 | Dimitris Aragiorgis | that he can access the VPN. Then we run in Cyclades: |
433 | 8f0fc472 | Dimitris Aragiorgis | |
434 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
435 | 8f0fc472 | Dimitris Aragiorgis | |
436 | be8c3784 | Christos Stavrakakis | # snf-manage network-create --subnet=192.168.1.0/24 --gateway=192.168.1.0/24 --dhcp=True --flavor=CUSTOM --mode=bridged --link=br200 --mac-prefix=bb:00:44 --owner=user@grnet.gr --tags=nfdhcpd,vpn --name=vpn --backend-id=1 |
437 | 8f0fc472 | Dimitris Aragiorgis | |
438 | 8f0fc472 | Dimitris Aragiorgis | # snf-manage network-list |
439 | 8f0fc472 | Dimitris Aragiorgis | id name flavor owner mac_prefix dhcp state link vms public IPv4 Subnet IPv4 Gateway |
440 | 8f0fc472 | Dimitris Aragiorgis | 5 vpn CUSTOM user@grnet.gr bb:00:44 True ACTIVE br200 False 192.168.1.0/24 192.168.1.1 |
441 | 8f0fc472 | Dimitris Aragiorgis | |
442 | 8f0fc472 | Dimitris Aragiorgis | This will add a network in Synnefo DB and create a network in Ganeti backend by |
443 | 8f0fc472 | Dimitris Aragiorgis | issuing: |
444 | 8f0fc472 | Dimitris Aragiorgis | |
445 | 8f0fc472 | Dimitris Aragiorgis | .. code-block:: console |
446 | 8f0fc472 | Dimitris Aragiorgis | |
447 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network add --network=192.168.1.0/24 --gateway=192.168.1.1 --network-type=private --tags=nfdhcpd snf-net-5 |
448 | 8f0fc472 | Dimitris Aragiorgis | |
449 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network connect snf-net-5 default bridged br200 |
450 | 8f0fc472 | Dimitris Aragiorgis | # gnt-network list snf-net-5 |
451 | 8f0fc472 | Dimitris Aragiorgis | Network Subnet Gateway NetworkType MacPrefix GroupList Tags |
452 | 8f0fc472 | Dimitris Aragiorgis | snf-net-5 192.168.1.0/24 192.168.1.1 private bb:00:55 default(bridged, br200) nfdhcpd,private-filtered |
453 | 8f0fc472 | Dimitris Aragiorgis |