Jump to: navigation, search

Difference between revisions of "Meetings/VPNaaS"

(Bucket List)
(Important)
 
(88 intermediate revisions by 5 users not shown)
Line 1: Line 1:
 
= Meetings =
 
= Meetings =
  
* Weekly on Tuesdays at 1500 UTC
+
* On-demand on Tuesdays at 1600 UTC
* IRC channel: #openstack-meeting-4
+
* IRC channel: #openstack-meeting-3
 
* Chair: pc_m (Paul Michali)
 
* Chair: pc_m (Paul Michali)
  
Well, this is embarrassing...
+
There currently are no planned VPNaaS meetings. If there is an important aspect to discuss, you can either add an on-demand topic to the Neutron IRC meeting, or hold an on-demand meeting in the above reserved channel. If doing the latter, please update the agenda, and next meeting date on this page, and post a notice on the openstack-dev mailing list with ample time for people to allocate time to attend (you may want to request a quorum).
  
We haven't been having much turn out for the meetings over the past several weeks. As a result, I sent a questionnaire out on February 24th to see if how we wanted to move forward with meetings. Well, there was an issue with my return address and the message never posted to the openstack-dev mailing list (and I didn't get a bounced mail response).  Thinking there was no interest (sorry), I took the default action and gave VPN status as part of the March 2nd Neutron meeting.
 
  
Mathieu mentioned that he didn't see the email, so I re-sent the survey out. We'll have a meeting today, at the normal time and can discuss. Also, I'll give another week to see what people think and we can decide how to handle meetings forward going.
+
Next meeting: TBD
  
 
= Logs and Minutes=
 
= Logs and Minutes=
Line 15: Line 14:
  
 
= Agenda =
 
= Agenda =
 +
Updated Oct 5th, 2015
  
Updated February 23rd, 2015
+
* Local multiple subnet
  
 
== Announcements ==
 
== Announcements ==
 +
* Endpoint group server and client code is upstreamed.
 +
* Devstack plugin for neutronclient commit to make voting.
 +
* Multiple local subnet feature and CLI pushed for review.
  
* DevStack support for StrongSwan is now upstreamed.
+
== Multiple Local Subnets ==
* Directory structure change for functional test area is upstreamed.
+
Server changes (#link https://review.openstack.org/#/c/230164) and Neutron client (#link https://review.openstack.org/#/c/231133) are out for review. Please look them over.
* VPN agent refactoring has started - goal is to eliminate dependency on L3 agent.
 
* New functional job being created for StrongSwan (out for review) - will run in experimental mode.
 
* StrongSwan implementation is out for review - will target Ubuntu initially.
 
  
== Functional Testing ==
+
Will work on follow-up commits for functional tests, API documentation, and additional validation.
Plan is to have tests/functional/ hold shared functional test modules, tests/functional/openswan/ to hold OpenSwan specific tests, and tests/functional/strongswan/ to hold StrongSwan specific tests.
 
  
A new check-neutron-vpnaas-dsvm-functional-sswan is being created, to set up DevStack for StrongSwan operation.
+
DevRef: https://review.openstack.org/#/c/191944
  
The post-test-gate.sh script needs to be modified for support of scenario testing (159746).
+
== Bugs under Review ==
  
== Bugs ==
+
Current bugs: [https://bugs.launchpad.net/neutron/+bugs?field.searchtext=vpnaas&search=Search&field.status%3Alist=NEW&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=FIXCOMMITTED&field.assignee=&field.bug_reporter=&field.omit_dupes=on&field.has_patch=&field.has_no_package=&orderby=status&start=0 VPN bugs]
Current bugs: [https://review.openstack.org/#/q/status:open+project:openstack/neutron-vpnaas,n,z VPNaaS bugs]
 
  
We need to get StrongSwan commit tested out and reviewed, so please help out (https://review.openstack.org/144391). This commit will now only address Ubuntu, and a separate commit (later) will address Fedora support (as there are some differences).
+
Current reviews:  [https://review.openstack.org/#/q/status:open+project:openstack/neutron-vpnaas,n,z VPNaaS reviews]
  
Bring up any other bugs of interest.
+
== Open Discussion ==
  
 
== Bucket List ==
 
== Bucket List ==
Here are some ideas for tasks that need to be done (feel free to work on them - put your name by any you choose)...
+
Here is a list of features/fixes/enhancements that could be done for VPNaaS, with a subjective assessment of the importance of each:
* The 'docs' target needs to be implemented for our repo (doc file was removed from Neutron).
+
 
* The old netconn-api documentation needs to be migrated to WADL so can be included into Reference API Wiki.
+
=== Very Important ===
* Coverage, especially in database modules, is lacking.
+
* Certificate support for IPSec (Barbican - see what LBaaS did to use certificate). - RFE created. VPNaaS isn't practical for production use with pre-shared keys, IMHO. (https://bugs.launchpad.net/neutron/+bug/1459427)
* Need functional tests for OpenSwan device driver
+
* Removing direct dependency on Neutron, causing breakages occasionally (neutron-lib).
* Refactor duplication out of device driver code (OpenSwan, StrongSwan, Cisco, Vyatta)
+
 
 +
=== Important ===
 +
* Complete python34 support for test (see tox.ini for disabled tests) (https://bugs.launchpad.net/neutron/+bug/1480326). In review.
 +
* Grenade work to support Advanced Services, so that plugin can be activated (partial implementation).
 +
* User documentation for Networking Guide for VPNaaS. (including limitations/restrictions)
 +
* Documentation on how to use StrongSwan
 +
* Documentation on the differences between StrongSwan and OpenSwan (and any limitations/restrictions of each - e.g. mixing IPv4/v6)
 +
* Break out new endpoint-group and multiple local subnet API logic into separate extension(?) so that Horizon can detect when feature is available (Akihiro mentioned).
 +
* Complete move of API tests to neutron-vpnaas repo (https://bugs.launchpad.net/neutron/+bug/1483417), and add tests for endpoint-group and multiple local subnet APIs. In review.
 +
* Modify neutron-client so that Horizon can detect multiple local subnet capabilities (https://bugs.launchpad.net/neutron/+bug/1515670).
 +
* Check whether or not IPv6 works with *Swan. Likely will need proposed change. (https://bugs.launchpad.net/neutron/+bug/1436864).
 +
* Refactor functional jobs (https://bugs.launchpad.net/neutron/+bug/1495584). In review.
 +
* Temp workaround for cross project breakage would be to run VPN function job during Neutron tests. Can be follow-on steps to https://bugs.launchpad.net/neutron/+bug/1495584 work.
 +
* Deprecate OpenSwan and transition to StrongSwan. May still need Libreswan for Redhat.
 +
 
 +
=== Nice to Have ===
 +
* Check when removing/changing GW I/F that is not used by VPNaaS (may be bug for this).
 +
* Improve coverage in UTs.
 +
** Checking various sync() cases: router w/o VPN running on it any more; router with VPN running, but no longer a service configured; process running VPN, but no longer VPN configured.
 +
** Verification of reported status for various cases: connections (active, down, pending create), service (created, deleted, admin down).
 +
* Refactor the rest of the database tests and remove round trip test cases once similar tests in place.
 +
* Need more functional tests for OpenSwan device driver (and StrongSwan driver). Identify what's needed (MTU check, connection delete, admin up/down?, non-default configs [API or unit?], IPv6). Referenced by https://bugs.launchpad.net/neutron/+bug/1416427
 +
* Refactor duplication out of device driver code (OpenSwan, StrongSwan, Cisco, Vyatta). Some is covered under https://bugs.launchpad.net/neutron/+bug/1414253.
 
* The OpenSwan class should be separated from the ABC definition, and placed into a new module.
 
* The OpenSwan class should be separated from the ABC definition, and placed into a new module.
 +
* Remove /n from execute method in utils.py so that duplicate code can be removed in VPN drivers.
 +
* Developer Reference Documentation needed.
 +
* Migrate to using neutronclient extension for VPN (and create job).
 +
* StrongSwan execute_with_mount() to allow configurable rootwrap config file (hard coded currently).
 +
* Check interop of StrongSwan and OpenSwan (https://bugs.launchpad.net/neutron/+bug/1441789).
 +
 +
=== Pie in the Sky Items ===
 +
* Explore leveraging off of endpoint group mechanism for other VPN flavors.
 +
* Drivers for other VPN types (e.g. something similar to AWS DirectConnect and Azure ExpressRoute) DMVPN, SSLVPN?
 +
 +
== Interested People ==
  
== Open Discussion ==
+
List of people w/IRC that are interested in participating (coding, reviewing, testing, and/or documenting):
 +
 
 +
* Paul Michali (pc_m)
 +
* Sridhar Ramaswamy (sridha_ram)
 +
* Al Miller (ajmiller)
 +
* Victor Howard (vichoward)
  
 
== Charter ==
 
== Charter ==
 +
 
[[NeutronSubteamCharters#VPNaaS_Team|VPNaaS Team Charter]]
 
[[NeutronSubteamCharters#VPNaaS_Team|VPNaaS Team Charter]]
 +
  
 
== Meeting Commands ==
 
== Meeting Commands ==
  
<nowiki>/join #openstack-meeting-4</nowiki><br />
+
<nowiki>/join #openstack-meeting-3</nowiki><br />
 
<nowiki>#startmeeting vpnaas</nowiki><br />
 
<nowiki>#startmeeting vpnaas</nowiki><br />
 
<nowiki>#topic Announcements</nowiki><br />
 
<nowiki>#topic Announcements</nowiki><br />

Latest revision as of 17:15, 13 November 2015

Meetings

  • On-demand on Tuesdays at 1600 UTC
  • IRC channel: #openstack-meeting-3
  • Chair: pc_m (Paul Michali)

There currently are no planned VPNaaS meetings. If there is an important aspect to discuss, you can either add an on-demand topic to the Neutron IRC meeting, or hold an on-demand meeting in the above reserved channel. If doing the latter, please update the agenda, and next meeting date on this page, and post a notice on the openstack-dev mailing list with ample time for people to allocate time to attend (you may want to request a quorum).


Next meeting: TBD

Logs and Minutes

Meetings, with their notes and logs, will be found under http://eavesdrop.openstack.org/meetings/vpnaas/

Agenda

Updated Oct 5th, 2015

  • Local multiple subnet

Announcements

  • Endpoint group server and client code is upstreamed.
  • Devstack plugin for neutronclient commit to make voting.
  • Multiple local subnet feature and CLI pushed for review.

Multiple Local Subnets

Server changes (#link https://review.openstack.org/#/c/230164) and Neutron client (#link https://review.openstack.org/#/c/231133) are out for review. Please look them over.

Will work on follow-up commits for functional tests, API documentation, and additional validation.

DevRef: https://review.openstack.org/#/c/191944

Bugs under Review

Current bugs: VPN bugs

Current reviews: VPNaaS reviews

Open Discussion

Bucket List

Here is a list of features/fixes/enhancements that could be done for VPNaaS, with a subjective assessment of the importance of each:

Very Important

  • Certificate support for IPSec (Barbican - see what LBaaS did to use certificate). - RFE created. VPNaaS isn't practical for production use with pre-shared keys, IMHO. (https://bugs.launchpad.net/neutron/+bug/1459427)
  • Removing direct dependency on Neutron, causing breakages occasionally (neutron-lib).

Important

  • Complete python34 support for test (see tox.ini for disabled tests) (https://bugs.launchpad.net/neutron/+bug/1480326). In review.
  • Grenade work to support Advanced Services, so that plugin can be activated (partial implementation).
  • User documentation for Networking Guide for VPNaaS. (including limitations/restrictions)
  • Documentation on how to use StrongSwan
  • Documentation on the differences between StrongSwan and OpenSwan (and any limitations/restrictions of each - e.g. mixing IPv4/v6)
  • Break out new endpoint-group and multiple local subnet API logic into separate extension(?) so that Horizon can detect when feature is available (Akihiro mentioned).
  • Complete move of API tests to neutron-vpnaas repo (https://bugs.launchpad.net/neutron/+bug/1483417), and add tests for endpoint-group and multiple local subnet APIs. In review.
  • Modify neutron-client so that Horizon can detect multiple local subnet capabilities (https://bugs.launchpad.net/neutron/+bug/1515670).
  • Check whether or not IPv6 works with *Swan. Likely will need proposed change. (https://bugs.launchpad.net/neutron/+bug/1436864).
  • Refactor functional jobs (https://bugs.launchpad.net/neutron/+bug/1495584). In review.
  • Temp workaround for cross project breakage would be to run VPN function job during Neutron tests. Can be follow-on steps to https://bugs.launchpad.net/neutron/+bug/1495584 work.
  • Deprecate OpenSwan and transition to StrongSwan. May still need Libreswan for Redhat.

Nice to Have

  • Check when removing/changing GW I/F that is not used by VPNaaS (may be bug for this).
  • Improve coverage in UTs.
    • Checking various sync() cases: router w/o VPN running on it any more; router with VPN running, but no longer a service configured; process running VPN, but no longer VPN configured.
    • Verification of reported status for various cases: connections (active, down, pending create), service (created, deleted, admin down).
  • Refactor the rest of the database tests and remove round trip test cases once similar tests in place.
  • Need more functional tests for OpenSwan device driver (and StrongSwan driver). Identify what's needed (MTU check, connection delete, admin up/down?, non-default configs [API or unit?], IPv6). Referenced by https://bugs.launchpad.net/neutron/+bug/1416427
  • Refactor duplication out of device driver code (OpenSwan, StrongSwan, Cisco, Vyatta). Some is covered under https://bugs.launchpad.net/neutron/+bug/1414253.
  • The OpenSwan class should be separated from the ABC definition, and placed into a new module.
  • Remove /n from execute method in utils.py so that duplicate code can be removed in VPN drivers.
  • Developer Reference Documentation needed.
  • Migrate to using neutronclient extension for VPN (and create job).
  • StrongSwan execute_with_mount() to allow configurable rootwrap config file (hard coded currently).
  • Check interop of StrongSwan and OpenSwan (https://bugs.launchpad.net/neutron/+bug/1441789).

Pie in the Sky Items

  • Explore leveraging off of endpoint group mechanism for other VPN flavors.
  • Drivers for other VPN types (e.g. something similar to AWS DirectConnect and Azure ExpressRoute) DMVPN, SSLVPN?

Interested People

List of people w/IRC that are interested in participating (coding, reviewing, testing, and/or documenting):

  • Paul Michali (pc_m)
  • Sridhar Ramaswamy (sridha_ram)
  • Al Miller (ajmiller)
  • Victor Howard (vichoward)

Charter

VPNaaS Team Charter


Meeting Commands

/join #openstack-meeting-3
#startmeeting vpnaas
#topic Announcements
#undo

...

#endmeeting