Revision a19cbc67

b/docs/design/cyclades-networking.rst
1
===================
2
Cyclades Networking
3
===================
4

  
5
Networks
6
========
7

  
8
A Cyclades network is a virtual network that can be, depending on it's Network
9
Flavor, either an isolated Layer-2 broadcast domain or a Layer-3 network.
10
Networks can either be private or public. Private networks are reserved for the
11
user who created it, while public networks are created by the administrator and
12
are visible to all users. Also, networks can be marked with the
13
`--router:external` attribute to indicate that are external networks (public
14
internet)
15

  
16
Currently there are four available Networks Flavors:
17

  
18
* IP_ONLY: A Layer-3 network where host routes traffic to the external network.
19
* PHYSICAL_VLAN: A Layer-2 network where a physical VLAN is assigned to the
20
  network.
21
* MAC_FILTERED: A Layer-2 network. All networks of this type share the same
22
  physical VLAN, but isolation is achieved by filtering rules based on a
23
  unique MAC prefix that is assigned to each network.
24

  
25
The administrator can limit which networks can be created via API with the
26
`API_ENABLED_NETOWRK_FLAVORS` setting.
27

  
28
The attributes for network objects are the following:
29

  
30
* id: A string representing the UUID for the network.
31
* name: A human readable name.
32
* status: String representing the state of the network. Possible values for the
33
  state include: ACTIVE, DOWN, BUILD, ERROR or 'SNF:DRAINED' (no new ports
34
  or floating IPs can be created from this network).
35
* subnets: List of subnet UUIDs that are associated with this network.
36
* public: Whether network is visible to other users or not.
37
* user_id/tenant_id: The UUID of the owner of the network.
38
* admin_state_up: Boolean value indicating the administrative state of the
39
  network. If 'down' the network does not forward packets.
40
* router:external: Whether the network is connected to an external router or
41
  not. (/router API extension)
42
* SNF:floating_ip_pool: Whether the network can be used to allocate floating
43
  IPs.
44

  
45
Note: The 'admin_state_up' value is used only for compatibility with Neutron
46
API. It will be read-only, and will always be True.
47

  
48
Create a new network
49
^^^^^^^^^^^^^^^^^^^^
50

  
51
Method: POST
52

  
53
URI: /networks
54

  
55
The body of the request must contain the 'type' of the network. Also it can
56
contain a 'name' attribute.
57

  
58
List Networks
59
^^^^^^^^^^^^^
60

  
61
Method: GET
62

  
63
URI: /networks
64

  
65
Get details about a network
66
^^^^^^^^^^^^^^^^^^^^^^^^^^^
67

  
68
METHOD: GET
69

  
70
URI: /networks/$(network_id)
71

  
72
Example response:
73

  
74
+-----------------+-----------------------------------+
75
| Field           | Value                             |
76
+=================+===================================+
77
| admin_state_up  | True                              |
78
+-----------------+-----------------------------------+
79
| id              | 42                                |
80
+-----------------+-----------------------------------+
81
| name            | Test_network                      |
82
+-----------------+-----------------------------------+
83
| network_type    | MAC_FILTERED                      |
84
+-----------------+-----------------------------------+
85
| router:external | False                             |
86
+-----------------+-----------------------------------+
87
| public          | False                             |
88
+-----------------+-----------------------------------+
89
| status          | ACTIVE                            |
90
+-----------------+-----------------------------------+
91
| subnets         | []                                |
92
+-----------------+-----------------------------------+
93
| SNF:floating_ip | False                             |
94
+-----------------+-----------------------------------+
95
| user_id         | 1012fd8c72284c00b133832cd179f896  |
96
+-----------------+-----------------------------------+
97
| tenant_id       | 1012fd8c72284c00b133832cd179f896  |
98
+-----------------+-----------------------------------+
99

  
100
Delete a network
101
^^^^^^^^^^^^^^^^
102

  
103
METHOD: DELETE
104

  
105
URI:  /networks/$(network_id)
106

  
107
The network cannot be deleted if there are any Ports connected to it or
108
any FloatingIPs reserved from this network. The subnets that are connected
109
to this network are automatically deleted upon network deletion.
110

  
111
Update a network
112
^^^^^^^^^^^^^^^^
113

  
114
METHOD: PUT
115

  
116
URI:  /networks/$(network_id)
117

  
118
Only the name of the network can be updated.
119

  
120

  
121
Subnets
122
=======
123

  
124
A subnet represents L3-Layer characteristics of the network that is associated
125
with. Specifically, it represents an IP address block that is used in order to
126
assign addresses to virtual machines. A subnet is associated with a network
127
when created.
128

  
129

  
130
The attributes for subnet objects are the following:
131

  
132
* id: A string representing the UUID for the subnet.
133
* name: A human readable name.
134
* network_id: The UUID of the network that the subnet is associated with.
135
* ip_version: The IP version of the subnet. Can either be 4 or 6, default is 4.
136
* cidr: cidr representing IP range for this subnet, based on the IP version.
137
* gateway_ip: Default gateway used by devices in this subnet. If not specified
138
  the gateway will be the first available IP address. Set to None in order to
139
  get no gateway.
140
* enable_dhcp(CR): Boolean value indicating whether nfdhcpd is enabled for this
141
  subnet or not.
142
* enable_slaac: Boolean value indicating whether SLAAC is enabled for this
143
  subnet or not.
144
* allocation_pools(CR): Subranges of cidr available for dynamic allocation.
145
  A list of dictionaries of the form {"start": "192.168.2.0", "end": 192.168.2.10"}
146
* user_id/tenant_id: The UUID of the owner of the network.
147
* host_routes(R): List of routes that should be used by devices with IPs from
148
  this subnet.
149
* dns_nameservers(R): List of DNS name servers used by hosts in this subnet.
150

  
151
Note: 'host_routes' and 'dns_nameservers' is used only for compatibility with
152
Neutron. These values will be read-only and always be [].
153

  
154

  
155
Create a Subnet
156
^^^^^^^^^^^^^^^
157

  
158
METHOD: POST
159

  
160
URI:  /subnets/
161

  
162
To create a subnet the user must specify the network_id and the cidr for the
163
subnet. If the CIDR is an IPv6 subnet, the user must set the ip_version to 6.
164
If allocation pools overlap, or gateway overlaps with allocation_pools then 409
165
conflict is returned.
166

  
167
Finally, the user can create maximum one subnet of each ip_version, meaning
168
that a network can have no subnets, or one IPv4 subnet or one IPv6 subnet, or
169
one IPv4 and one IPv6 subnet. Also the user cannot create a subnet for a
170
network that has or had a port connected to it.
171

  
172
Note: Bulk creation of subnets, is not supported.
173

  
174
List user subnets
175
^^^^^^^^^^^^^^^^^
176

  
177
METHOD: GET
178

  
179
URI:  /subnets/
180

  
181
Get details about a subnet
182
^^^^^^^^^^^^^^^^^^^^^^^^^^^
183

  
184
METHOD: GET
185

  
186
URI:  /subnets/$(subnet_id)
187

  
188
Example response:
189

  
190
+------------------+--------------------------------------------------+
191
| Field            | Value                                            |
192
+==================+==================================================+
193
| allocation_pools | {"start": "192.168.2.2", "end": "192.168.2.254"} |
194
+------------------+--------------------------------------------------+
195
| cidr             | 192.168.2.0/24                                   |
196
+------------------+--------------------------------------------------+
197
| dns_nameservers  | []                                               |
198
+------------------+--------------------------------------------------+
199
| enable_dhcp      | False                                            |
200
+------------------+--------------------------------------------------+
201
| gateway_ip       | 192.168.2.1                                      |
202
+------------------+--------------------------------------------------+
203
| host_routes      | []                                               |
204
+------------------+--------------------------------------------------+
205
| id               | 49ce3872-446c-43e9-aa22-68dbc2bac0b5             |
206
+------------------+--------------------------------------------------+
207
| ip_version       | 4                                                |
208
+------------------+--------------------------------------------------+
209
| name             | test1                                            |
210
+------------------+--------------------------------------------------+
211
| network_id       | 8fc5e2bf-9c1b-4458-8f71-e38177ed23a5             |
212
+------------------+--------------------------------------------------+
213
| tenant_id        | 11a65261147d462b998eafb7f696f0ba                 |
214
+------------------+--------------------------------------------------+
215
| user_id          | 11a65261147d462b998eafb7f696f0ba                 |
216
+------------------+--------------------------------------------------+
217

  
218

  
219
Delete a subnet
220
^^^^^^^^^^^^^^^^
221

  
222
METHOD: DELETE
223

  
224
URI:  /subnets/$(subnet_id)
225

  
226
We do not allow deletion of subnets. Subnets will be deleted when the network
227
is deleted. This call will return 400 (badRequest).
228

  
229

  
230
Update a subnet
231
^^^^^^^^^^^^^^^^
232

  
233
METHOD: PUT
234

  
235
URI:  /subnets/$(subnet_id)
236

  
237

  
238
Only the name of the subnet can be updated. This call will return 400 (badRequest)
239
if the user tries to update any other field.
240

  
241

  
242
Ports
243
=====
244

  
245
A port represents a virtual switch port on a network switch. Virtual machines
246
attach their interfaces to ports. A port that is connected to a network
247
gets an IP address for each subnet that is associated with the network. If the
248
network has no subnets, then the port will have no IP.
249

  
250

  
251
The attributes for port objects are the following:
252

  
253
* id: A string representing the UUID for the port.
254
* network_id: The UUID of the network that this port is associated with.
255
* name: A human readable name.
256
* status: String representing the state of the port. Possible values for the
257
  state include: ACTIVE, DOWN, BUILD, ERROR.
258
* mac_address: MAC address.
259
* fixed_ips(R): List of dictionaries subnet_id->ip_address.
260
* device_id(CR): Device using this port (VM id or Router id).
261
* device_owner(CR): Entity using this port. e.g., network:router,
262
  network:router_gateway.
263
* user_id/tenant_id: The UUID of the owner of the port.
264
* security_groups(CRUD): List of security groups IDs associated with this port.
265
* admin_state_up: Boolean value indicating the administrative state of the
266
  port. If 'down' the port does not forward packets.
267

  
268
.. note:: Due to the way ports are implementing to Ganeti, a port will get an
269
  IPv6 address from a subnet only when the state of the port becomes 'ACTIVE'.
270

  
271
.. note:: The 'admin_state_up' value is used only for compatibility with
272
 Neutron API. It will be read-only, and will always be True.
273

  
274
Create a new Port
275
^^^^^^^^^^^^^^^^^^^^
276

  
277
Method: POST
278

  
279
URI: /ports
280

  
281
The body of the request must contain the 'network_id' of the network that
282
the port will be associated with. If the request contains a 'device_Id', the
283
port will be connected to that device.
284

  
285
The new port will get an IPv4 address from each of the subnets that are
286
associated with that network. If the network has an IPv4 subnet the request
287
can also contain the 'fixed_ips' attribute containing a specific IPv4 address
288
to use.
289

  
290
Creating a port to a public network is only supported if the user has a
291
floating IP from this network (see /floatingips extension) and the 'fixed_ip'
292
attribute of the request contains the IPv4 address of this floating IP.
293
Otherwise, badRequest(400) is returned.
294

  
295
Finally, the request can contain the following optional attributes:
296

  
297
* security_groups
298
* name
299

  
300
Example request:
301

  
302
.. code:: json
303

  
304
 {"port": {
305
     "name": "port1",
306
     "network_id": "42",
307
     "device_id": "2",
308
     "fixed_ips": [
309
         {
310
             "ip_address": "192.168.2.20"
311
         }
312
      ]
313
  }
314

  
315

  
316

  
317
List ports
318
^^^^^^^^^^^^^
319

  
320
Method: GET
321

  
322
URI: /ports
323

  
324
Get details about a port
325
^^^^^^^^^^^^^^^^^^^^^^^^^^^
326

  
327
METHOD: GET
328

  
329
URI:  /ports/$(port_id)
330

  
331
Example response:
332

  
333
+-----------------------+---------------------------------------------------------------------------------+
334
| Field                 | Value                                                                           |
335
+=======================+=================================================================================+
336
| admin_state_up        | True                                                                            |
337
+-----------------------+---------------------------------------------------------------------------------+
338
| device_id             | 39a02a66-33be-478a-8e9f-012141258678                                            |
339
+-----------------------+---------------------------------------------------------------------------------+
340
| device_owner          | network:router_interface                                                        |
341
+-----------------------+---------------------------------------------------------------------------------+
342
| fixed_ips             | {"subnet_id": "2313705f-68c1-4e16-80e3-c9fd8c0a5170", "ip_address": "10.0.2.1"} |
343
+-----------------------+---------------------------------------------------------------------------------+
344
| id                    | ff15e3fe-7b39-4adc-ae98-a7e29588977e                                            |
345
+-----------------------+---------------------------------------------------------------------------------+
346
| mac_address           | fa:16:3e:c1:63:06                                                               |
347
+-----------------------+---------------------------------------------------------------------------------+
348
| name                  | "test_port"                                                                     |
349
+-----------------------+---------------------------------------------------------------------------------+
350
| network_id            | 2f04b49f-ca49-4b93-9139-11a4eca35fdd                                            |
351
+-----------------------+---------------------------------------------------------------------------------+
352
| security_groups       | []                                                                              |
353
+-----------------------+---------------------------------------------------------------------------------+
354
| status                | DOWN                                                                            |
355
+-----------------------+---------------------------------------------------------------------------------+
356
| tenant_id             | 1012fd8c72284c00b133832cd179f896                                                |
357
+-----------------------+---------------------------------------------------------------------------------+
358
| user_id               | 1012fd8c72284c00b133832cd179f896                                                |
359
+-----------------------+---------------------------------------------------------------------------------+
360

  
361
Delete a port
362
^^^^^^^^^^^^^^^^
363

  
364
METHOD: DELETE
365

  
366
URI:  /ports/$(port_id)
367

  
368
Deleting a port from a public network is only allowed if the port has
369
been creating using a floating IP address.
370

  
371
Update a port
372
^^^^^^^^^^^^^^^^
373

  
374
METHOD: PUT
375

  
376
URI:  /ports/$(port_id)
377

  
378
Only the name of the port can be updated.
379

  
380

  
381

  
382
Floating IPs
383
============
384

  
385
Floating IPs are addresses on external networks (and so can be defined only on
386
networks on which the attribute `router:external` has been set to True) that
387
are marked as floating IP pools (`SNF:floating_ip_pool`). In the Neutron API,
388
floating IPs are associated with specific ports and IP addresses on private
389
networks and are used to allow an instance from a private network to access the
390
external network. Cyclades are able to associate a floating IP with an instance
391
without the restriction that the instance must already have a port and a
392
private IP from a private network. In order to avoid this limitation of Neutron
393
API, Cyclades are using a slightly modified and extended API.
394

  
395
The attributes of floating IP objects are the following:
396

  
397
* id: A string representing the UUID for the floating IP.
398
* floating_network_id: The UUID of the external network with which the floating
399
  IP is associated.
400
* floating_ip_address: The IPv4 address of the floating IP.
401
* fixed_ip_address: The value of this option is always `None`.
402
* port_id: The port that is currently using this floating IP.
403
* instance_id: The device that is currently using this floating IP.
404
* user_id/tenant_id: The UUID of the owner of the floating IP.
405

  
406

  
407
Floating IPs can be used via the /ports API. In order to attach a floating IP
408
to a server, the user must create a port that specified the IPv4 address
409
of the floating IP in the `fixed_ips` attribute of the port creation request.
410
Also, the floating IP can be detached from the server by destroying the
411
port that the floating IP is attached to.
412

  
413
Create(reserve) a floating IP
414
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
415

  
416
METHOD: POST
417

  
418
URI: /floatingips
419

  
420
The body of the request contains the id of the external network
421
(`floating_network_id`). If no address is specified (`floating_ip_address`),
422
an address will automatically be allocated from the pool addresses of the
423
external network.
424

  
425
List floating IPs
426
^^^^^^^^^^^^^^^^^
427

  
428
METHOD: GET
429

  
430
URI: /floatingips
431

  
432
Show a floating IP
433
^^^^^^^^^^^^^^^^^^
434

  
435
METHOD: GET
436

  
437
URI: /floatingips/$(floatingip_id)
438

  
439
Example response:
440

  
441
.. code-block:: console
442

  
443
 {
444
   "floatingip": {
445
     "id": "5923c02a-a162-4044-a432-9e52d6d819ce",
446
     "floating_ip_address": 192.168.1.227,
447
     "floating_network_id": 00983314-2f3c-43e9-acb0-9fd7cdb32231,
448
     "router_id": null,
449
     "device_id": 42,
450
     "tenant_id: "1012fd8c72284c00b133832cd179f896",
451
     "user_id": "1012fd8c72284c00b133832cd179f896"
452
   }
453
 }
454

  
455

  
456
Delete a Floating IP
457
^^^^^^^^^^^^^^^^^^^^
458

  
459
METHOD: DELETE
460

  
461
URI: /floatingips/$(floatingip_id)
462

  
463
This operation removes(releases) the floating IP. If it associated with a
464
device(port), the port is automatically removed.
465

  
466

  
467
Routers
468
=======
469

  
470

  
471
.. note:: This section contains a draft design document for virtual routers,
472
 and currently there is no implementation for this API.
473

  
474
A router is a logical entity that can be used to:
475

  
476
* interconnect subnets and forward traffic among them, and
477
* NAT internal traffic to external networks.
478

  
479
A router is associated with subnets through interfaces. The router gets an
480
interface with each subnet that is associated with. By default, the IP address
481
of such interface is the gateway of the subnet. Besides the interfaces, the
482
router also gets a Port for each network that is associated with (through
483
the corresponding subnets). These ports are created automatically when
484
interfaces are added to the router, have as device_owner the router, and
485
can not be managed with the Port API.
486

  
487
Besides the internal subnets, the router, can also be associated with an
488
external network in order to NAT traffic from internal networks to the external
489
one. The id of the external network is specified in the `external_gateway_info`
490
attribute of the network, and a port will be created for the router with an
491
IP address from the range of the public network. Besides the network id, the
492
user can also specify a floating IP from this network, to use as the router IP.
493
This port can also not be managed with the Port API.
494

  
495
The attributes for Router objects are the following:
496

  
497
* id: A string representing the UUID for the router.
498
* name: A human readable name.
499
* status: String representing the state of the network. Possible values for the
500
  state include: ACTIVE, DOWN, BUILD, ERROR.
501
* user_id/tenant_id: The UUID of the owner of the router.
502
* admin_state_up: Boolean value indicating the administrative state of the
503
  router. If 'down' the router does not forward packets.
504
* external_gateway_info: Dictionary with the information about the external
505
  gateway for the router.
506

  
507
Create a new router
508
^^^^^^^^^^^^^^^^^^^^
509

  
510
Method: POST
511

  
512
URI: /routers
513

  
514
The body of the request contains the name of the router. The new router that
515
is created does not have any internal interface and so it is not associated
516
with any subnet.
517

  
518
Also, the used can specify an external gateway for the router at create time.
519
This is done by specifying the network_id in the `external_gateway_info`
520
attribute. This network must have the attribute `router:external` set to
521
`True`. Besides the id of the network, the used can also specify one of his
522
floating IPs to use. An example request is the following
523

  
524

  
525
.. code-block:: console
526

  
527
  {
528
    "router":
529
    {
530
      "name": "example_router",
531
      "external_gateway_info":
532
      {
533
        "network_id": "42",
534
        "floating_ip_id": "142"
535
      }
536
    }
537
  }
538

  
539
List routers
540
^^^^^^^^^^^^^
541

  
542
Method: GET
543

  
544
URI: /routers
545

  
546
Get details about a router
547
^^^^^^^^^^^^^^^^^^^^^^^^^^^
548

  
549
METHOD: GET
550

  
551
URI: /routers/$(router_id)
552

  
553
Example response:
554

  
555
.. code-block:: console
556

  
557
  {
558
    "id": "5",
559
    "name": "example_router",
560
    "status": "ACTIVE",
561
    "user_id": "1012fd8c72284c00b133832cd179f896",
562
    "tenant_id": "1012fd8c72284c00b133832cd179f896",
563
    "external_gateway_info": {
564
      "network_id": "42",
565
      "floating_ip_id": "142"
566
    }
567
  }
568

  
569
Delete a router
570
^^^^^^^^^^^^^^^^
571

  
572
METHOD: DELETE
573

  
574
URI:  /routers/$(router_id)
575

  
576
This operation removes a logical router;
577
the operation will fail if the router still has some internal interfaces.
578

  
579
Update a router
580
^^^^^^^^^^^^^^^^
581

  
582
METHOD: PUT
583

  
584
URI:  /routers/$(router_id)
585

  
586
Only the `name` of the router and the `external_gateway_info` can be updated.
587

  
588
Add interface to router
589
^^^^^^^^^^^^^^^^^^^^^^^
590

  
591
METHOD: PUT
592

  
593
URI: /routers/$(router_id)/add_router_interface
594

  
595
The body of the request contains only the id of the subnet that the router
596
will be associated to.
597

  
598
Remove interface from router
599
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
600

  
601
METHOD: PUT
602

  
603
URI: /routers/$(router_id)/remove_router_interface
604

  
605
The body of the request contains only the id of the subnet that the router
606
will be detached from.
607

  
608

  
609

  
610

  
611
General Implementation Details
612
==============================
613

  
614
Creation of a network corresponds to only creating a Network object in the
615
Cyclades DB. Also, creation of a subnet corresponds to creation of a Subnet in
616
the Cyclades DB and the of the corresponding allocation pools. The Ganeti
617
network will only be created in the Ganeti backend when a port is connected to
618
this network.  Updating fields of Ganeti networks is really hard (e.g.,
619
changing the dhcp option) or impossible (e.g., changing the subnet). For this
620
reason, if the network has been created in a Ganeti backend, then it will be
621
marked as read-only!
622

  
623
A port is mapped to a Ganeti NIC directly. The port will be created in DB in
624
the "BUILD" state and an OP_INSTANCE_MODIFY will be issued to Ganeti to create
625
the NIC in the specified VM. When the job successfully completes, the NIC will
626
be updated to state "ACTIVE" in the DB. Also the MAC address that was allocated
627
from Ganeti will be stored in the updated NIC.
b/docs/networks.rst
15 15
backend appropriately.
16 16

  
17 17
In the following sections we investigate in a top-down approach, the way
18
networks are defined from the Cyclades, Ganeti, and Backend persperctive.
18
networks are defined from the Cyclades, Ganeti, and Backend persperctive. For
19
an introduction to the concepts of Cyclades networking and the exposed API see
20
:doc:`Cyclades networking design document <design/cyclades-networking>`.
19 21

  
20 22
Network @ Cyclades level
21 23
------------------------

Also available in: Unified diff