L2 in L3 tunneling

為了解決vlan tag只能有4096個(2^12)的問題所以用此方法來解決

L2 in L3 tunneling to the rescue
You want a private L2 network between VMs
You already have working IP between the members of the network
Use that "underlay" IP network and overlay a private ethernet on top

Install Quantum on XenServer

For using the quantum plugin see: http://openvswitch.org/openstack/documentation/
You can:

• follow: [[[QuantumDevstack]]]
• ensure your VM network is not on a VLAN
• assuming you use Open vSwitch (default on XenServer 6.0.0 and later)
• run the quantum agent on Dom0
• add in nova.conf: xenapi_vif_driver=nova.virt.xenapi.vif.XenAPIOpenVswitchDriver

TODO - other steps not yet found.

[Quantum] quantum ovs-plugin agent的問題: br-int is not a bridge or a socket

https://github.com/mseknibilel/OpenStack-Folsom-Install-guide/issues/75

https://wiki.openstack.org/wiki/ConfigureOpenvswitch

https://answers.launchpad.net/quantum/+question/181070

https://answers.launchpad.net/quantum/+question/205427

OpenStack Security Group設定

為了讓Security Group的相關設定都交給Quantum Service來代理(proxy)處理，所以必須在/etc/nova/nova.conf中做以下的設定，以避免與原來Nova Networking所處理的Security Group相衝突。



## security groups ##
firewall_driver = nova.virt.firewall.NoopFirewallDriver
security_group_api = quantum

Quanum Network Deploy Legacy Case

Quantum把網路分成"network"、"subnet"、"port"等三個部分

1. network: 

network為虛擬的switch

2. subnet:

ip區段(including ipv4 、 ipv6)，主要是用來分派位於某個特定Network內虛擬機器的IP位址，而每個Quantum L2 Network可以擁有多個Subnets

3. port:

至於port的部分，則是用來代表在某個Quantum L2 Network的虛擬埠號(Virtual Port)之對應。簡單來說，可以把它視為在某個虛擬交換器當中的虛擬埠(Virtual Port)。

• Single Flat Network

• Multiple Flat Network

          每個tenant可以看到多個共享網路(shared networks)並選擇想要將VMs附加到哪一個共享網路底下

• Mixed Flat and Private Network

• Provider Router and Private Networks

• Per-Tenant Router and Private Networks

quantum metadata agent

quantum-metadata-agent  推測為openstack grizzly的new feature。

The OpenStack Compute service allows VMs to query metadata associated with a VM by making a web request to a special 169.254.169.254 address. Quantum supports proxying those requests to nova-api, even when the requests are made from isolated networks, or from multiple networks that use overlapping IP addresses. Enabling this requires setting the following fields in nova.conf


http://docs.openstack.org/trunk/openstack-network/admin/content/nova_config_metadata.html

Quantum 安全群組（Security Group）設定

edit  /etc/nova/nova.conf  in Compute Node:

firewall_driver = nova.virt.firewall.NoopFirewallDriver
security_group_api = quantum

Data Forwarding Node in Quantum

Data Forwarding Node

需要安裝 openvswitch 以及quantum-plugin-openvswitch-agent agent

All hosts running quantum-plugin-openvswitch-agent also requires that an OVS bridge named "br-int" exists. To create it, run:

ovs-vsctl add-br br-int

Nicira NVP with OpenStack Quantum

Network Virtualization 的發展近況

     在虛擬化所建構的高動態的服務中， 網路卻以靜態的模式支撐服務的進行， 使服務受限於現今OSI L2/L3的模組中，大幅拖延了雲服務/數據中心的發展速度及目標。 從上而知， 靜態的網路型態， 成為雲服務發展最大的阻礙. 許多數據中心服務商或是設備提供商已經開始關注這一課題， 也陸續在發展相關方案以期能解決相關課題。但是對於雲服務/數據中心這並不是一個絕對的好消息， 因為他們將被迫選擇廠家私有的專屬的硬體或是更新設備才能支持該相關方案，產生方案成本、 擴展性及相容性等不可預期的營運問題。

Nicira NVP (Network Virtualization Platform)

       Network Virtualization Platform (NVP)本身是一種分散式的網路管理控制系統，能夠管理位於網路邊緣的數萬個虛擬交換器(Open vSwitch)，將傳統的實體網路進行decouple建立脫離底層實體網路的數十萬個邏輯網路(Logical Network)。NVP可以將現有的物理網路轉換成資料傳送的Fabric，而無須重新建構。它是一款能夠兼容和現有IaaS的軟體，大大降低維護成本與複雜性。

VMware收購Nicira

VMware於2012年7月以12.6億美元收購新創公司Nicira，並以其NVP作為未來「軟體定義資料中心」的虛擬網路，其中NVP是OpenFlow網路協定概念的領導產品，也是OpenStack Quantum網路平台的基礎。

Reference:

[1] VMware打破門戶之見 推出Grizzly增加與Ubuntu OpenStack雲端服務的相容性,
http://news.networkmagazine.com.tw/classification/software-application/2013/04/19/49274/

[2]  網路虛擬化公司Nicira：描繪未來的網路世界
http://wired.tw/2012/05/03/nicira-2/index.html

[3] http://www.netfos.com.tw/PDF/Nsolution/Nicura-NVP-Nsolution2011.pdf

[4] VMware官方網站對Nicira NVP的introduction,
http://www.vmware.com/products/datacenter-virtualization/nicira.html

L3 Routing + NAT

Quantum Server with plugins

Open vSwitch plugins vs Linux Bridge plugins

Provider Networks

Provider networks

Provider networks就是讓cloud admin可以在datacenter中建立直接與實體網路(Physical Networks)對應的Quantum網路(Quantum Networks)。

Provider Network的用途

• 讓tenant可以直接存取Public Network:
  This is commonly used to give tenants direct access to a "public" network that can be used to reach the Internet.  
  
• 與VLAN做整合:
  It may also be used to integrate with VLANs in the network that already have a defined meaning 

      (e.g., allow a VM from the "marketing" department to be placed 

       on the same VLAN as bare-metal marketing hosts in the same data   center).

    The provider extension allows administrators to explicitly manage the relationship between Quantum virtual networks and underlying physical mechanisms such as VLANs and tunnels.

    When this extension is supported, Quantum client users with administrative privileges see additional provider attributes on all virtual networks, and are able to specify these attributes in order to create provider networks.

As of the Folsom release, the provider extension is supported by the openvswitch and linuxbridge plugins. 

PS: Configuration of these plugins requires familiarity with this extension.