Difference between revisions of "Blueprint-aws-vpc-support"
Rudrarugge (talk | contribs) (→2. Who/Why/What) |
Rudrarugge (talk | contribs) |
||
Line 15: | Line 15: | ||
This feature will be used by tenants for creating a VPC environment equivalent to Amazon VPC. | This feature will be used by tenants for creating a VPC environment equivalent to Amazon VPC. | ||
− | === <span class="c20"> | + | === <span class="c20">VPC maps to Openstack Project</span> === |
<span></span> | <span></span> | ||
Line 23: | Line 23: | ||
<span>VPC would closely match to a Project in Openstack. Project is a container for all the items listed in a VPC. VPC level cidr_block would need to be stored in the project – this information is passed through to the relevant plugins.</span> | <span>VPC would closely match to a Project in Openstack. Project is a container for all the items listed in a VPC. VPC level cidr_block would need to be stored in the project – this information is passed through to the relevant plugins.</span> | ||
− | ==== <span class="c11"> | + | ==== <span class="c11">CreateVpc </span> ==== |
<span>Request contains CidrBlock as required params. </span> | <span>Request contains CidrBlock as required params. </span> | ||
Line 41: | Line 41: | ||
* <span>Return VpcId and state as "available" if all steps are successful</span> | * <span>Return VpcId and state as "available" if all steps are successful</span> | ||
− | ==== <span class="c11"> | + | ==== <span class="c11">DescribeVpc </span> ==== |
<span>Optional params: vpcid and filters</span> | <span>Optional params: vpcid and filters</span> | ||
Line 55: | Line 55: | ||
* <span>Return VPC details</span> | * <span>Return VPC details</span> | ||
− | ==== <span class="c11"> | + | ==== <span class="c11">DeleteVpc </span> ==== |
<span>Required params: vpcid</span> | <span>Required params: vpcid</span> | ||
Line 68: | Line 68: | ||
* <span>Return true if successful else false</span> | * <span>Return true if successful else false</span> | ||
− | === <span> | + | === <span></span><span>VPC Subnet maps to Openstack Network</span> === |
<span>Subnets in VPC are equivalent to defining networks with a cidr block.</span> | <span>Subnets in VPC are equivalent to defining networks with a cidr block.</span> | ||
− | ==== <span> | + | ==== <span>CreateSubnet </span> ==== |
<span>Request contains VpcId and CidrBlock as required params</span> | <span>Request contains VpcId and CidrBlock as required params</span> | ||
Line 90: | Line 90: | ||
− | ==== <span> | + | ==== <span>DescribeSubnets</span> ==== |
<span>Optional params: subnetid and filters</span> | <span>Optional params: subnetid and filters</span> | ||
Line 105: | Line 105: | ||
<span></span> | <span></span> | ||
− | ==== <span> | + | ==== <span>DeleteSubnet </span> ==== |
<span>Required param: subnetid</span> | <span>Required param: subnetid</span> | ||
Line 126: | Line 126: | ||
<span></span> | <span></span> | ||
− | === <span> | + | === <span>VPC DHCP Options maps to Openstack Network IPAM</span> === |
<span>These APIs are dependent on the Network IPam objects to be added at a domain level. Network IPAM object needs to be added to Quantum/Openstack. This can be done as part of this blueprint or a separate Network IPAM blueprint.</span> | <span>These APIs are dependent on the Network IPam objects to be added at a domain level. Network IPAM object needs to be added to Quantum/Openstack. This can be done as part of this blueprint or a separate Network IPAM blueprint.</span> | ||
− | ==== <span> | + | ==== <span>CreateDhcpOptions </span> ==== |
<span>Request contains DHCP key, value pairs as params</span> | <span>Request contains DHCP key, value pairs as params</span> | ||
Line 142: | Line 142: | ||
* <span>Return DhcpOptionsId and list of DHCP options</span> | * <span>Return DhcpOptionsId and list of DHCP options</span> | ||
− | ==== <span> | + | ==== <span>AssociateDhcpOptions </span> ==== |
<span>Request contains DhcpOptionsId and VpcId to associate with</span> | <span>Request contains DhcpOptionsId and VpcId to associate with</span> | ||
Line 156: | Line 156: | ||
− | ==== <span> | + | ==== <span>DescribeDhcpOptions</span> ==== |
<span>Optional params: DhcpOptionsId and filters</span> | <span>Optional params: DhcpOptionsId and filters</span> | ||
Line 170: | Line 170: | ||
− | ==== <span> | + | ==== <span>DeleteDhcpOptions</span> ==== |
<span>Required param: DhcpOptionsId</span> | <span>Required param: DhcpOptionsId</span> | ||
Line 182: | Line 182: | ||
* <span>If match succesful then delete network else return false.</span> | * <span>If match succesful then delete network else return false.</span> | ||
− | === <span> | + | === <span>EC2 Instance API changes</span> === |
<span>EC2 Instance level APIs already exist in the Openstack Grizzly release. There is one change required to add support for launching instance with a particular VPC subnet.</span> | <span>EC2 Instance level APIs already exist in the Openstack Grizzly release. There is one change required to add support for launching instance with a particular VPC subnet.</span> | ||
− | ==== <span> | + | ==== <span></span><span>RunInstances</span> ==== |
<span>Request contains one additional parameter called VPC SubnetId</span> | <span>Request contains one additional parameter called VPC SubnetId</span> | ||
Line 200: | Line 200: | ||
* <span>Launch the VM/Instance with the Network</span> | * <span>Launch the VM/Instance with the Network</span> | ||
− | === <span> | + | === <span>VPC Network ACL maps to Openstack Network Policy</span> === |
<span>These APIs map to the quantum APIs for network policy. This is currently work in progress and is supported via Quantum extensions</span> | <span>These APIs map to the quantum APIs for network policy. This is currently work in progress and is supported via Quantum extensions</span> | ||
− | ==== <span> | + | ==== <span>CreateNetworkAcl</span> ==== |
<span>Required param: VpcId</span> | <span>Required param: VpcId</span> | ||
Line 220: | Line 220: | ||
− | ==== <span> | + | ==== <span>DeleteNetworkAcl</span> ==== |
<span>Required param NetworkAclId</span> | <span>Required param NetworkAclId</span> | ||
Line 237: | Line 237: | ||
− | ==== <span> | + | ==== <span>ReplaceNetworkAclAssociation</span> ==== |
<span>Required param AssociationId, NetworkAclId</span> | <span>Required param AssociationId, NetworkAclId</span> | ||
Line 254: | Line 254: | ||
− | ==== <span> | + | ==== <span></span><span>CreateNetworkAclEntry</span> ==== |
<span>Required params:</span><span>Â NetworkAclId, RuleNumber, 5-tuple , direction</span> | <span>Required params:</span><span>Â NetworkAclId, RuleNumber, 5-tuple , direction</span> | ||
Line 271: | Line 271: | ||
− | ==== <span> | + | ==== <span>DeleteNetworkAclEntry</span> ==== |
<span>Required params: NetworkAclId, RuleNumber</span> | <span>Required params: NetworkAclId, RuleNumber</span> | ||
Line 290: | Line 290: | ||
− | ==== <span> | + | ==== <span>ReplaceNetworkAclEntry</span> ==== |
<span>Required params: NetworkAclId, RuleNumber, 5 tuple, direction</span> | <span>Required params: NetworkAclId, RuleNumber, 5 tuple, direction</span> | ||
Line 306: | Line 306: | ||
* <span>Return true if successful else false</span> | * <span>Return true if successful else false</span> | ||
− | === <span> | + | === <span>VPC Allocate Address maps to Openstack Floating IPs</span> === |
<span>All VPC address APIs map to the Openstack floating IP APIs. These APIs have been enhanced by Amazon for VPC support in addition to the pre-existing EC2 support. When domain is passed as VPC then we will use Quantum floating IP APIs.</span> | <span>All VPC address APIs map to the Openstack floating IP APIs. These APIs have been enhanced by Amazon for VPC support in addition to the pre-existing EC2 support. When domain is passed as VPC then we will use Quantum floating IP APIs.</span> | ||
Line 314: | Line 314: | ||
<span>In addition administrator needs to pre-provision a network which can be used as a floating IP pool.</span> | <span>In addition administrator needs to pre-provision a network which can be used as a floating IP pool.</span> | ||
− | ==== <span> | + | ==== <span>AllocateAddress</span> ==== |
<span>Required params: Domain - vpc</span> | <span>Required params: Domain - vpc</span> | ||
Line 331: | Line 331: | ||
− | ==== <span> | + | ==== <span>ReleaseAddress</span> ==== |
<span>Required params: AllocationId or FloatingIp</span> | <span>Required params: AllocationId or FloatingIp</span> | ||
Line 347: | Line 347: | ||
− | ==== <span> | + | ==== <span>AssociateAddress</span> ==== |
<span>Required params: InstanceId, AllocationId or FloatingIp</span> | <span>Required params: InstanceId, AllocationId or FloatingIp</span> | ||
Line 368: | Line 368: | ||
− | ==== <span> | + | ==== <span>DisassociateAddress</span> ==== |
<span>Required params: AllocationId or FloatingIp</span> | <span>Required params: AllocationId or FloatingIp</span> | ||
Line 385: | Line 385: | ||
− | ==== <span> | + | ==== <span>DescribeAddress</span> ==== |
<span>Optional params: FloatingIp and filters</span> | <span>Optional params: FloatingIp and filters</span> | ||
Line 399: | Line 399: | ||
* <span>Return the list</span> | * <span>Return the list</span> | ||
− | === <span> | + | === <span>VPC Security Group maps to Openstack Security Group</span> === |
<span>All VPC security group APIs map to the Openstack security group APIs. A default security group is created when a VPC is created. All instances are associated with the default security group until the association is changed. </span> | <span>All VPC security group APIs map to the Openstack security group APIs. A default security group is created when a VPC is created. All instances are associated with the default security group until the association is changed. </span> | ||
Line 409: | Line 409: | ||
<span></span> | <span></span> | ||
− | ==== <span> | + | ==== <span>CreateSecurityGroup</span> ==== |
− | ==== <span> | + | ==== <span>DescribeSecurityGroups</span> ==== |
− | ==== <span> | + | ==== <span>DeleteSecurityGroup</span> ==== |
− | ==== <span> | + | ==== <span>AuthoriseSecurityGroupIngress</span> ==== |
− | ==== <span> | + | ==== <span>RevokeSecurityGroupIngress</span> ==== |
− | ==== <span> | + | ==== <span>AuthoriseSecurityGroupEgress</span> ==== |
− | ==== <span> | + | ==== <span>RevokeSecurityGroupEgress</span> ==== |
− | ==== <span> | + | ==== <span>DescribeSecurityGroup</span> ==== |
− | ==== <span> | + | ==== <span>RunInstances</span> ==== |
<span></span> | <span></span> | ||
− | === <span> | + | === <span>VPC route table [new changes needed in Openstack]</span> === |
− | ==== <span> | + | ==== <span>CreateRouteTable</span> ==== |
− | ==== <span> | + | ==== <span>DescribeRouteTables</span> ==== |
− | ==== <span> | + | ==== <span>DeleteRouteTable</span> ==== |
− | ==== <span> | + | ==== <span>ReplaceRouteTableAssociation</span> ==== |
− | ==== <span> | + | ==== <span>DisassociateRouteTable</span> ==== |
− | ==== <span> | + | ==== <span>CreateRoute</span> ==== |
− | ==== <span> | + | ==== <span>DeleteRoute</span> ==== |
− | ==== <span> | + | ==== <span>ReplaceRoute</span> ==== |
<span></span> | <span></span> |
Revision as of 22:34, 12 November 2013
Contents
- 1 Overview
- 2 Who/Why/What
- 3 VPC maps to Openstack Project
- 4 VPC Subnet maps to Openstack Network
- 5 VPC DHCP Options maps to Openstack Network IPAM
- 6 EC2 Instance API changes
- 7 VPC Network ACL maps to Openstack Network Policy
- 8 VPC Allocate Address maps to Openstack Floating IPs
- 9 VPC Security Group maps to Openstack Security Group
- 10 VPC route table [new changes needed in Openstack]
Overview
Havana release of Openstack, supports EC2 API translation to Nova, Quantum, Keystone calls. Using EC2 APIs user can launch VMs, assign IP addresses to VMs and so on. This blueprint enhances the EC2 APIs to support the amazon VPC APIs.
Who/Why/What
Who This feature will be used by tenants for creating a VPC environment equivalent to Amazon VPC.
VPC maps to Openstack Project
VPC represents a virtual private cloud. It’s a container where all the networking resides – subnets, security groups, instance association to subnets, DHCP configuration, routing tables, gateway (vpn, nat, regular).
VPC would closely match to a Project in Openstack. Project is a container for all the items listed in a VPC. VPC level cidr_block would need to be stored in the project – this information is passed through to the relevant plugins.
CreateVpc
Request contains CidrBlock as required params.
InstanceTenancy as optional params
Return value is a VpcId and state of the VPC
In Openstack the request would translate into the following actions:
- Create a unique id for the project such as vpc-a23aad23
- Create the project with this name using keystone API
- Use cidr_block then create an IPAM object in the project using Quantum API.
- Use Quantum API to create default network ACL, default route table and default security group
- Return VpcId and state as "available" if all steps are successful
DescribeVpc
Optional params: vpcid and filters
Return value is all VPC related information [state, cidrblock, dhcp, etc]
In Openstack the request would translate into the following actions:
- Use keystone APIs to fetch all project information
- Apply filters to create list of only requested information
- Return VPC details
DeleteVpc
Required params: vpcid
Return true if deleted else false
In Openstack the request would translate into the following actions:
- Use keystone API to delete the project
- Return true if successful else false
VPC Subnet maps to Openstack Network
Subnets in VPC are equivalent to defining networks with a cidr block.
CreateSubnet
Request contains VpcId and CidrBlock as required params
Return value is a SubnetId
In Openstack the request would translate into the following actions:
- Select a UUID and map it to an VPC id such as subnet-abcd1234
- Get the project based on the passed VpcId
- Get the Network IPAM object for the project to read the VPC level CidrBlock.
- Ensure that the passed subnet level CidrBlock is valid in the VPC level CidrBlock.
- Use Quantum APIs to create a network with this SubnetId and CidrBlock
- Return SubnetId and state as available if all steps are successful
DescribeSubnets
Optional params: subnetid and filters
Return value is all subnet related information [state, address-count]
In Openstack the request would translate into the following actions:
- Use quantum APIs to read the networks
- Return network information to be returned based on filters
DeleteSubnet
Required param: subnetid
Return value is true or false
In Openstack the request would translate into the following actions:
- Use quantum APIs to get the list of networks
- For each network map its UUID to subnetID and compare with passed subnetid.
- If match succesful then delete network else return false.
VPC DHCP Options maps to Openstack Network IPAM
These APIs are dependent on the Network IPam objects to be added at a domain level. Network IPAM object needs to be added to Quantum/Openstack. This can be done as part of this blueprint or a separate Network IPAM blueprint.
CreateDhcpOptions
Request contains DHCP key, value pairs as params
Return value is a DhcpOptionsId and list of options
In Openstack the request would translate into the following actions:
- Create UUID and map to DhcpOptionsId such as dopt-abcd1234
- Use Quantum APIs to create network IPAM with DHCP options. This network IPAM object can be created at the domain level.
- Return DhcpOptionsId and list of DHCP options
AssociateDhcpOptions
Request contains DhcpOptionsId and VpcId to associate with
Return value is a DhcpOptionsId and list of options
In Openstack the request would translate into the following actions:
- Get the project based on the passed VpcId
- Get the network IPAM which contains the passed DhcpOptionsId
- Associate these dhcp options to the project
DescribeDhcpOptions
Optional params: DhcpOptionsId and filters
Return value is a list of dhcp options information
In Openstack the request would translate into the following actions:
- Use quantum API to get all dhcp options
- Match based on filters and id
- Return the list
DeleteDhcpOptions
Required param: DhcpOptionsId
Return value is true or false
In Openstack the request would translate into the following actions:
- Use quantum APIs to get the list of ipams
- For each ipam map its UUID to DhcpOptionsId and compare with passed DhcpOptionsId.
- If match succesful then delete network else return false.
EC2 Instance API changes
EC2 Instance level APIs already exist in the Openstack Grizzly release. There is one change required to add support for launching instance with a particular VPC subnet.
RunInstances
Request contains one additional parameter called VPC SubnetId
Return value is regular response of RunInstances
In Openstack the request would translate into the following actions:
- Get the VpcId/Project associated with the passed SubnetId
- Get the Network associated with the associated SubnetId
- Launch the VM/Instance with the Network
VPC Network ACL maps to Openstack Network Policy
These APIs map to the quantum APIs for network policy. This is currently work in progress and is supported via Quantum extensions
CreateNetworkAcl
Required param: VpcId
Response contains NetworkAclId and ingress, egress default ACLs
In Openstack the request would translate into the following actions:
- Get the Project based on VpcId
- Create UUID and map to NetworkAclId such as acl-abcd1234
- Use Quantum APIs to create network policy using name as NetworkAclId
- Use Quantum APIs to add ingress and egress default rules with rule-id being 32767
DeleteNetworkAcl
Required param NetworkAclId
Response is true or false
In Openstack the request would translate into the following actions:
- Check if NetworkPolicy is attached to a network
- If still attached then return false
- Else use Quantum API to delete the Network Policy based on NetworkAclId
- Return true or false based on status
ReplaceNetworkAclAssociation
Required param AssociationId, NetworkAclId
Response is newAssociationId
In Openstack the request would translate into the following actions:
- Use Quantum to read  the network policy based on NetworkAclId
- Find the network based on AssociatedId that this policy is attached to. To do this we use network UUID as associated ID
- Use Quantum to remove the policy attachment
- Use Quantum to attach the new policy
- Return the new association ID
CreateNetworkAclEntry
Required params:Â NetworkAclId, RuleNumber, 5-tuple , direction
Response status with true or false
In Openstack the request would translate into the following actions:
- Use Quantum to get  the Network Policy using NetworkAclId
- Use Quantum APIs to read all the rules in the Network Policy.
- Insert the new rule at the correct location based on rule-number
- Write the complete list of rules back in the NetworkPolicy
- Return true if successful else false
DeleteNetworkAclEntry
Required params: NetworkAclId, RuleNumber
Optional params: Egress
Response status with true or false
In Openstack the request would translate into the following actions:
- Use Quantum to get  the Network Policy using NetworkAclId
- Use Quantum APIs to read all the rules in the Network Policy.
- Delete the rule that matches the rule number. If egress is specified then delete only egress rule else delete ingress rule
- Write the complete list of rules back in the NetworkPolicy
- Return true if successful else false
ReplaceNetworkAclEntry
Required params: NetworkAclId, RuleNumber, 5 tuple, direction
Response status with true or false
In Openstack the request would translate into the following actions:
- Use Quantum to get  the Network Policy using NetworkAclId
- Use Quantum APIs to read all the rules in the Network Policy.
- Update the rule that matches the rule number with the new information
- Write the complete list of rules back in the NetworkPolicy
- Return true if successful else false
VPC Allocate Address maps to Openstack Floating IPs
All VPC address APIs map to the Openstack floating IP APIs. These APIs have been enhanced by Amazon for VPC support in addition to the pre-existing EC2 support. When domain is passed as VPC then we will use Quantum floating IP APIs.
In addition administrator needs to pre-provision a network which can be used as a floating IP pool.
AllocateAddress
Required params: Domain - vpc
Response contains FloatingIP
In Openstack the request would translate into the following actions:
- Use Quantum APIs to get the list of networks
- For each network compare network name with “public†to get public network of FloatingIP.
- If match successful then use Quantum API to create a FloatingIP from public network pool.
- Return FloatingIP if successful else return Exception
ReleaseAddress
Required params: AllocationId or FloatingIp
Response is true or false
In Openstack the request would translate into the following actions:
- Use Quantum APIs to get the list of Floating IPs
- For each Floating IP If AllocationId is given then map the FloatingIp uuid to AllocationId and compare with given AllocationId else If FloatingIp is given compare it with FloatingIp
- If match successful then use Quantum API to delete the FloatingIp from public network pool.
- Return true if successful else exception
AssociateAddress
Required params: InstanceId, AllocationId or FloatingIp
Response is AllocationId
In Openstack the request would translate into the following actions:
- Map the given InstanceId to Instance uuid using ec2utils
- Use Compute APIs to fetch list of fixed Ips for using Instance uuid
- If multiple fixed IPs select the first fixed IP
- Use Quantum APIs to get the list of Floating IPs
- For each Public IP If AllocationId is given then map the FloatingIp uuid to AllocationId and compare with given AllocationId else If FloatingIp is given compare it with FloatingIp
- Use Quantum APIs to get the list of Ports using for the given instance using Instance uuid
- Use Quantum APIs to associate FloatingIp to all fetched ports
- Use ec2utils to generate AssociationId from FloatingIp uuid
- Return Association if successful else exception
DisassociateAddress
Required params: AllocationId or FloatingIp
Response is true or false
In Openstack the request would translate into the following actions:
- Use Quantum APIs to get the list of Floating IPs
- For each FloatingIp If AllocationId is given then map the FloatingIp uuid to AllocationId and compare with given AllocationId else If FloatingIp is given compare it with FloatingIp
- If match successful then use Quantum API to update the FloatingIp ports to None to disassociate FloatingIp
- Return true if successful else exception
DescribeAddress
Optional params: FloatingIp and filters
Return value is a list of Floating IP information
In Openstack the request would translate into the following actions:
- Use quantum API to get all FloatingIP
- Match based on filters and id
- Return the list
VPC Security Group maps to Openstack Security Group
All VPC security group APIs map to the Openstack security group APIs. A default security group is created when a VPC is created. All instances are associated with the default security group until the association is changed.
Amazon passed the keywork EC2-VPC for calls that need to be handled by Quantum.
CreateSecurityGroup
DescribeSecurityGroups
DeleteSecurityGroup
AuthoriseSecurityGroupIngress
RevokeSecurityGroupIngress
AuthoriseSecurityGroupEgress
RevokeSecurityGroupEgress
DescribeSecurityGroup
RunInstances
VPC route table [new changes needed in Openstack]
CreateRouteTable
DescribeRouteTables
DeleteRouteTable
ReplaceRouteTableAssociation
DisassociateRouteTable
CreateRoute
DeleteRoute
ReplaceRoute