[RFE] DVR support for Allowed_address_pair port that are bound to multiple ACTIVE VM ports
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
Fix Released
|
Wishlist
|
Swaminathan Vasudevan |
Bug Description
DVR support for Allowed_
Problem Statement:
When FloatingIP is asssigned to Allowed_
The use case here is to provide redundancy to the VMs that are serviced by the DVR routers.
This feature works good for Legacy Routers ( Centralized Routers).
Theory:
Distributed Virtual Routers were designed for scalability and performance and to reduce the load on the single network node.
Distributed Virtual Routers are created on each Compute node dynamically on demand and removed when not required. Distributed Virtual Routers heavily depend on the port binding to identify the requirement of a DVR service on a particular node.
Today we only create/
In the above mentioned use case, we are dealing with Allowed_
We have a work around today to inherit the parent VMs port binding properties for the allowed_
The reason for this is, if we have multiple "ACTIVE" VM port associated with the same allowed_
Why is it working with Legacy Routers:
In the case of legacy routers, the routers are always located a the network node and the DNAT is also done at the router_namespace in the Network node. They don't depend on the host-binding, since all the traffic have to flow through the centralized router in the network node. Also in the case of centralized routers, there is not issue of Floatingip GARP, since it is always going to be coming in through a single node.
So in the background, the allowed_
Why it is not working with DVR Routers:
1. Allowed_
2. If we were to inherit from the VMs host-binding, there are multiple VMs that are ACTIVE, so we can't have a single host-binding for these allowed_
3. Even if we ignore the port_binding on the allowed_
How we can make it to work with DVR:
Option 1:
Neutron should have a some visibility on the state of the VM port, when the switch between ACTIVE and STANDBY happens. Today it is done by the keepalived on the VM and so it is not being logged anywhere.
If the keepalived can log the event in neutron port, then it can be used by the neutron to determine when to allow FloatingIP traffic and block FloatingIP traffic for a particular node, and then send the GARP from the respective node. There is some delay introduced in this as well.
(Desired) Low-hanging fruit.
Option 2:
Option 2 basically negates the Distributed nature of DVR and makes it centralized for North-South.
The other option is to have the FloatingIP functionality centralized for such features. But this would be more complex, since we need to introduce config options for agents and floatingip. Also in this case, we can't have both the local floatingip and centralized floatingip support for the same node. A compute node can only have either localized floatingip or centralized floatingip.
Complex ( Negates the purpose of DVR)
References:
Some references to the patches that we have already to support a single use case for the Allowed_
https:/
https:/
https:/
tags: | added: rfe |
Changed in neutron: | |
importance: | Undecided → Wishlist |
status: | New → Confirmed |
tags: | removed: neutron |
Changed in neutron: | |
status: | In Progress → Confirmed |
Changed in neutron: | |
status: | Confirmed → In Progress |
Changed in neutron: | |
status: | In Progress → Confirmed |
Changed in neutron: | |
status: | Confirmed → Triaged |
tags: | removed: lbaas |
Changed in neutron: | |
status: | Triaged → In Progress |
Changed in neutron: | |
assignee: | Oleg Bondarev (obondarev) → Swaminathan Vasudevan (swaminathan-vasudevan) |
Changed in neutron: | |
milestone: | none → pike-3 |
Changed in neutron: | |
assignee: | Swaminathan Vasudevan (swaminathan-vasudevan) → Brian Haley (brian-haley) |
Changed in neutron: | |
assignee: | Brian Haley (brian-haley) → Swaminathan Vasudevan (swaminathan-vasudevan) |
Changed in neutron: | |
assignee: | Swaminathan Vasudevan (swaminathan-vasudevan) → Akihiro Motoki (amotoki) |
Changed in neutron: | |
assignee: | Akihiro Motoki (amotoki) → Swaminathan Vasudevan (swaminathan-vasudevan) |
Changed in neutron: | |
assignee: | Swaminathan Vasudevan (swaminathan-vasudevan) → Brian Haley (brian-haley) |
Changed in neutron: | |
assignee: | Brian Haley (brian-haley) → Swaminathan Vasudevan (swaminathan-vasudevan) |
My initial comment is that this breaks anyone using systems like VRRP with DVR enabled, not just Octavia