- Weekly on-demand on Tuesdays at 1600 UTC
- IRC channel: #openstack-meeting-3
- Chair: pc_m (Paul Michali)
If you want to hold a meeting. Update this wiki page with agenda modifications, date of meeting desired, date of update, and then post a notice on the openstack-dev mailing list, at least 24 hours prior to the meeting start time. We have reserved this (new) channel on the IRC for the time/day of week.
Next meeting: Tuesday, June 9nd, 2015.
Logs and Minutes
Meetings, with their notes and logs, will be found under http://eavesdrop.openstack.org/meetings/vpnaas/
Updated May 26th, 2015
- BGP/MPLS VPN and Edge VPN evaluation
- Discuss DMVPN spec for Liberty (https://review.openstack.org/#/c/181563/)
- Discuss whether VPNaaS should be enhanced to support multiple local subnets
- Reviewers/testers needed for specs and code changes
- Liberty first milestone is...?
- Sign up for buck-list items below, so there is no overlap.
Bugs under Review
Current bugs: VPN bugs
Current reviews: VPNaaS reviews
Need resolution of gate issues for: https://review.openstack.org/#/c/159746
BGP/MPLS and Edge VPN
https://etherpad.openstack.org/p/vpn-flavors created for people to express their thoughts...
As a team, we need to see if we can come up with a seamless way for users to make use of BGP/MPLS VPN and Edge VPN (and other types, like equivalent of AWS Direct Connect), providing a consistent and uniform experience for customers.
Toward that goal, we should do the following:
- Collect information on the two solutions (design specs, APIs, etc) so that everyone has a basic understanding of the features.
- Review the VPNaaS object model and see if it can accommodate either/both of these features.
- Determine if we can come up with (and it makes sense to have) a common API for these that provides the user with a consistent experience.
For example, should there be list commands that indicate all the types of connections created, with maybe an optional filter by type? Are there top level VPN APIs, like vpn-service-create that can be used for all VPN types? Etc.
Here's some info from the summit:
- Edge-VPN http://git.openstack.org/cgit/stackforge/networking-edge-vpn/ with spec https://review.openstack.org/#/c/152377/
- BGP VPN https://github.com/stackforge/networking-bgpvpn with API proposa https://review.openstack.org/#/c/177740
Multiple Local Subnets on VPN connection
I'll work on a blueprint spec for this. Will need to decide if this should be done independently of other work.
Here are some ideas for tasks that need to be done (feel free to work on them - put your name by any you choose)...
- User documentation for Networking Guide. (including limitations/restrictions)
- Coverage, especially in database and device driver modules, is lacking.
- Need functional tests for OpenSwan device driver (and StrongSwan driver). Identify what's needed (MTU check, connection delete, admin up/down?, non-default configs).
- Refactor duplication out of device driver code (OpenSwan, StrongSwan, Cisco, Vyatta)
- The OpenSwan class should be separated from the ABC definition, and placed into a new module.
- Remove /n from execute method in utils.py so that duplicate code can be removed in VPN drivers.
- Documentation on how to use StrongSwan
- Looks like StrongSwan is missing some configuration settings in template, so can only do defaults. Bug filed.
- Documentation on the differences between StrongSwan and OpenSwan (and any limitations/restrictions of each - e.g. mixing IPv4/v6)
- StrongSwan execute_with_mount() to allow configurable rootwrap config file.
- Support for BGP/MPLS VPN? DM VPN? OpenVPN (road-warrior)? Can they be integrated into VPNaaS?
- Certificate support for IPSec (Barbican - see what LBaaS did to use certificate). - Will investigate pc_m
- Devstack support for VPNaaS (see LBaaS including devstack setup in their repo).
- Multiple local subnet support for IPSec. - pc_m
- There is interest by some on other VPN types (e.g. something similar to AWS DirectConnect and Azure ExpressRoute).
- Should enhance/add unit test cases for:
- Checking various sync() cases: router w/o VPN running on it any more; router with VPN running, but no longer a service configured; process running VPN, but no longer VPN configured.
- Verification of contents of configuration files created for StrongSwan and OpenSwan.
- Verification of reported status for various cases: connections (active, down, pending create), service (created, deleted, admin down).
List of people w/IRC that are interested in participating (coding, reviewing, testing, and/or documenting):
- Paul Michali (pc_m)
- Al Miller (ajmiller)