RFE - Support Distributed SNAT with DVR

[Takanori Miyagishi]

In Juno release, DVR was implemented to Neutron.
So virtual router can running on each Compute node.
However, SNAT is still running on Network node and not distributed yet.

Our proposal is to distribute SNAT to each Compute node.
If we use SNAT feature, the packet doesn't need to go Network node.

[Assaf Muller (amuller)]

FYI: We have a plan to integrate DVR with L3 HA so that the centralized / SNAT portion of distributed routers will no longer pose a single point of failure. There are patches up for review:
https://review.openstack.org/#/q/status:open+project:openstack/neutron+branch:master+topic:bug/1365473,n,z

I hope to merge them during the Liberty time cycle.

[Takanori Miyagishi (miyagishi-t)]

In my understanding, your proposal is SNAT is no longer SPOF due to enabling HA
of network nodes?
On the other hand, our proposal is not only no longer SPOF but network load is
shared by each compute node due to packet doesn't necessary to go Network node.
So, in case of SNAT communication, the performance will be improved.
On another benefits, we can reduce the number of nodes than HA.
Therefore, we think that our proposal as well as your feature are necessary.

[Carl Baldwin (carl-baldwin)]

How would you like this done. This question has been out there for a while. There are different ways to do it and the choice has big effects on deployers. For example, some suggest that we use a single IP per compute host. Others object strongly to that because they do not want tenants to share the same IP address for security and accountability purposes. Others have suggested that we distribute to compute host based on ingress port. Others object due to the complexity of providing and supporting this feature.

There has been an etherpad [1] out there for a while outlining some of the pros and cons of each approach that has come up. We need someone to drive consensus around this before we proceed.

[1] https://etherpad.openstack.org/p/decentralized-snat

[Armando Migliaccio (armando-migliaccio)]

Until more details are provided, this is a pipe dream.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]