diff --git a/doc/source/how_l2_segregation_works.rst b/doc/source/how_l2_segregation_works.rst deleted file mode 100644 index 4b0d2b9d..00000000 --- a/doc/source/how_l2_segregation_works.rst +++ /dev/null @@ -1,66 +0,0 @@ -.. _how_it_works: - -**************************** -How Ryu L2 segregation works -**************************** -This section describes how Ryu L2 segregation works. - -tenant/network id creation -========================== -When tenant(= network id) is created, Quantum server tells it to Ryu. -Ryu remembers the network id. - - .. image:: /images/network-creation.png - - -association OVS port to network id -================================== -#. When VM instance is created, the network port is created in OVS and - it is associated to network id that VM belongs to. - -#. quantum OVS agent tells the associated (network id, ovs port) to Ryu. - Ryu remembers (network id, ovs port) relationship. - -#. quantum OVS agent also tells to Ryu which OVS port is not managed by - nova/quantum, but is connected to external ether cable. - We call it external OVS port or that the port is external. - - - .. image:: /images/assoc-ovs-port.png - - -mac learing -=========== -When VM sends packets, Ryu determins network id from OVS port and then -associates src mac address to network id. - - .. image:: /images/mac-learning.png - - -packet filtering(L2 unicast case) -================================= -* When VM sending L2-unicast packet, Ryu checks if the destination mac - address belongs to the same netowrk id of the source mac address which - is same to the network id that the OVS port is associated to. -* If no, the packet is dropped. -* If yes, send the packet is sent to ports which belongs to the same - network id and external port. - - .. image:: /images/filtering-outgoing.png - .. image:: /images/filtering-incoming.png - - -packet filtering(L2 broadcast case) -=================================== -* When VM sending L2-broadcast/multicaset packet, Ryu checks if the source - mac address. -* send the packet to all external ports and all OVS ports that belongs - to the same network id of the source mac address. -* When receiving broacast/multicast packet from the external ports, - Ryu checks if the source mac address belongs to known network id. - - * If yes, send the packet to the external ports except incoming one - and the all OVS ports that belongs to the network id - * if no, drop the packet. - - .. image:: /images/filtering-broadcast.png diff --git a/doc/source/images/assoc-ovs-port.png b/doc/source/images/assoc-ovs-port.png deleted file mode 100644 index 16e0386a..00000000 Binary files a/doc/source/images/assoc-ovs-port.png and /dev/null differ diff --git a/doc/source/images/assoc-ovs-port.svg b/doc/source/images/assoc-ovs-port.svg deleted file mode 100644 index 2aa8656e..00000000 --- a/doc/source/images/assoc-ovs-port.svg +++ /dev/null @@ -1,572 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - image/svg+xml - - - - - - - - - - - - - ryu-openflow-controller - - - nova-compute - - VMtenant-X - - OVS - - physical host - - - - quantum_ovs_agent - - associates OVS port to network id - - - - eth - - - network_id - - external port - - diff --git a/doc/source/images/filtering-broadcast.png b/doc/source/images/filtering-broadcast.png index a4c1276e..4c32e802 100644 Binary files a/doc/source/images/filtering-broadcast.png and b/doc/source/images/filtering-broadcast.png differ diff --git a/doc/source/images/filtering-broadcast.svg b/doc/source/images/filtering-broadcast.svg index 013b007a..5a088a77 100644 --- a/doc/source/images/filtering-broadcast.svg +++ b/doc/source/images/filtering-broadcast.svg @@ -15,7 +15,7 @@ height="744.09448" id="svg2" version="1.1" - inkscape:version="0.48.1 r9760" + inkscape:version="0.48.3.1 r9886" sodipodi:docname="filtering-broadcast.svg" inkscape:export-filename="/home/yamahata/openvswitch/sp-lab/scarab/ryu/ryu-1/doc/source/images/filtering-broadcast.png" inkscape:export-xdpi="90" @@ -28,15 +28,15 @@ inkscape:pageopacity="0.0" inkscape:pageshadow="2" inkscape:zoom="0.8162589" - inkscape:cx="385.43528" + inkscape:cx="387.88548" inkscape:cy="372.04724" inkscape:document-units="px" inkscape:current-layer="layer1" showgrid="false" inkscape:window-width="1345" inkscape:window-height="1004" - inkscape:window-x="153" - inkscape:window-y="155" + inkscape:window-x="88" + inkscape:window-y="112" inkscape:window-maximized="0" inkscape:snap-grids="true" inkscape:snap-to-guides="false" @@ -404,7 +404,7 @@ image/svg+xml - + @@ -627,30 +627,25 @@ x="517.40717" id="tspan5238-6-0-7-5" sodipodi:role="line">mac addr - - - ryu-openflow-controller - + + ryu mac addr - - - ryu-openflow-controller - + + ryu image/svg+xml - + @@ -685,30 +685,25 @@ x="515.09814" id="tspan5238-6-0-7-5" sodipodi:role="line">mac addr - - - ryu-openflow-controller - + + ryu +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ComputeNode + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + GRE tunnel + + + + + + + + + + + + + + + + + + + + + TenantKey=X + + + + + + + + + + + + + + + Set GRE Key + + + + + + + + Ryu + + + +OVS + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OpenFlow + + + +Deliver/drop packetsbased on GRE key + + + +En/de-cupsel packetinto/from GRE tunnel + + + +ComputeNode + + + +Compute+networknode + + + +Tenant VM + + + +Tenant VM + + + +Tenant VM + + + +Tenant VM + + + +Tenant VM + + + +Tenant VM + + + +OVS + + + +OVS + + + +TenantKey=Y + + + +Key is used as GRE key + + + +agent + + + +agent + + + +L2 isolation by GRE tunnel + + + +L2 over L3 with GRE tunnel- Able to span over network segments (virtual l2 segment can span over multi data centers)- can coexists withconventional networktechnology + + + + + \ No newline at end of file diff --git a/doc/source/images/internal-live-migration.png b/doc/source/images/internal-live-migration.png new file mode 100644 index 00000000..75bf9c36 Binary files /dev/null and b/doc/source/images/internal-live-migration.png differ diff --git a/doc/source/images/internal-live-migration.svg b/doc/source/images/internal-live-migration.svg new file mode 100644 index 00000000..94180aba --- /dev/null +++ b/doc/source/images/internal-live-migration.svg @@ -0,0 +1,382 @@ + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + compute-node + + softwarebridge + + VM + + + + + + + compute-node + + softwarebridge + + VM + + + 1. prepare destination VM ports are created + 2. VM state are sent + 3. stop VMon the source + 6. resume VMon the desitnation + 4. hypervisor sendsGARP pakcet to notify thatthe mac address is moved + 5. switches re-learn mac-address andupdate mac-learing table + + + + diff --git a/doc/source/images/internal-quantum-bootup.png b/doc/source/images/internal-quantum-bootup.png new file mode 100644 index 00000000..92db629f Binary files /dev/null and b/doc/source/images/internal-quantum-bootup.png differ diff --git a/doc/source/images/internal-quantum-bootup.svg b/doc/source/images/internal-quantum-bootup.svg new file mode 100644 index 00000000..fe2e23bc --- /dev/null +++ b/doc/source/images/internal-quantum-bootup.svg @@ -0,0 +1,411 @@ + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + + QuantumServer + + Ryu + + + ryu.ini + + + OVS + + + Ryu agent + + + + 1.get IP addressfor ryu to accessovsdb + 3. setup OVSto accept changesfrom Ryu.set-manager ptcp:<port> + 4. register necesary infosdpid, ovsdb ip address(+ ip adress for tunnelif GRE is enabled) + Node boot up + + 2. Get addressfor Ryu RESTvia openstack RPCwhich is used forinternal communication + + ryu.ini + + get IP address for Ryu REST APIon startup + + 5. setup ovsto connect Ryuset-controller tcp:<ip>:<port> + + diff --git a/doc/source/images/internal-quantum-gre-flow-table.png b/doc/source/images/internal-quantum-gre-flow-table.png new file mode 100644 index 00000000..70007264 Binary files /dev/null and b/doc/source/images/internal-quantum-gre-flow-table.png differ diff --git a/doc/source/images/internal-quantum-gre-flow-table.svg b/doc/source/images/internal-quantum-gre-flow-table.svg new file mode 100644 index 00000000..53504c17 --- /dev/null +++ b/doc/source/images/internal-quantum-gre-flow-table.svg @@ -0,0 +1,589 @@ + + + + + + + + + + image/svg+xml + + + + + + + + table 0 + + in_portsrc mac + set_tunnelgoto table 1 + + in_port + drop + + in_porttunnel_id + goto table 2 + + tunnel_iddst mac + output(tunnel)goto table 2 + + tunnel_id + goto table 2 + + tunnel_iddst mac + output(vm) + + tunnel_id + drop + + + + + + + + + table 1 + + table 2 + Local out + tunnel out + src table + + + + in port + vmport + tunnelport + + + + + match + action + + + + + match + action + + + + + match + action + + + + diff --git a/doc/source/images/internal-quantum-instance-create.png b/doc/source/images/internal-quantum-instance-create.png new file mode 100644 index 00000000..c3b55e00 Binary files /dev/null and b/doc/source/images/internal-quantum-instance-create.png differ diff --git a/doc/source/images/internal-quantum-instance-create.svg b/doc/source/images/internal-quantum-instance-create.svg new file mode 100644 index 00000000..801e6d4e --- /dev/null +++ b/doc/source/images/internal-quantum-instance-create.svg @@ -0,0 +1,481 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + OVS + + Instance Creation + nova-compute + vid driver + + + + + + quantumserver + ryu + + 1.create instance + 2.create porton network + 5. uuid for the created port + 6.plug + 7. create portstore port uuid andmac address to ovsdb + 4. (netork uuid, port uuid) + + + 8. OFPPortStatusOVS notifies port creationvia OpenFlow protocol + 10. setup flow entries + + 9. query ovsdbget infos, port uuidand mac address + 3. quantum serverallocates uuid tothe created port + + diff --git a/doc/source/images/internal-quantum-network-creation.png b/doc/source/images/internal-quantum-network-creation.png new file mode 100644 index 00000000..4ff5602b Binary files /dev/null and b/doc/source/images/internal-quantum-network-creation.png differ diff --git a/doc/source/images/internal-quantum-network-creation.svg b/doc/source/images/internal-quantum-network-creation.svg new file mode 100644 index 00000000..ef1b5031 --- /dev/null +++ b/doc/source/images/internal-quantum-network-creation.svg @@ -0,0 +1,236 @@ + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + QuantumServer + + Ryu + Network creation + + + 1. create network + + quantum db(network uuid, key) + + 2. allocate key + 3. tell (network uuid, key) + + diff --git a/doc/source/images/internal-quantum-overview.png b/doc/source/images/internal-quantum-overview.png new file mode 100644 index 00000000..0df0058d Binary files /dev/null and b/doc/source/images/internal-quantum-overview.png differ diff --git a/doc/source/images/internal-quantum-overview.svg b/doc/source/images/internal-quantum-overview.svg new file mode 100644 index 00000000..4ce416d9 --- /dev/null +++ b/doc/source/images/internal-quantum-overview.svg @@ -0,0 +1,1813 @@ + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OVS + + + + + + + + + + + + OVS + + + + + + + + + + + + + + + + + + + + Quantum db:(netowrk uuid, key) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Overview + + + + + + + + + + +Quantum-node: somewhere wherecompute/network can communicateTypically on network-node + + + + + + + + + + +Ryu-node: somewhere wherecompute/network/quantum cancommunicate. Typically on network-node + + + + + + + + + + +compute-node + + + + + + + + + + +Network-node + + + + + + + + + + +Quantumserver + + + + + + + + + + + + +Ryu db(in memory for now)(network uuid, key)(dpid, port, network uuid, mac address)(dpid, port, remote dpid) + + +createport + + + + + + + + + + +initialization + + + + + + + + + + +Vif driver + + + + + + + + + + +Ryu agent + + + + + + + + + + +Ryu agent + + + + + + + + + + +OVSDBprotocol + + + + + + + + + + +QuantumAPI + + + + + + + + + + + + +Ryu + + + + + + + + +initialization + + + + + + + + +l3 agent + + + + + + + + +... + + + + + + + + +manimuplate OVS directly + + + + + + + + +REST API + + + + + + + + +interface driver + + + + +OpenFlowProtocol + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/doc/source/images/internal-tunnel-live-migration-after.png b/doc/source/images/internal-tunnel-live-migration-after.png new file mode 100644 index 00000000..1b6219e0 Binary files /dev/null and b/doc/source/images/internal-tunnel-live-migration-after.png differ diff --git a/doc/source/images/internal-tunnel-live-migration-after.svg b/doc/source/images/internal-tunnel-live-migration-after.svg new file mode 100644 index 00000000..83496893 --- /dev/null +++ b/doc/source/images/internal-tunnel-live-migration-after.svg @@ -0,0 +1,1497 @@ + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ComputeNode + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OVS + + + + +ComputeNode + + + + + +Computenode + + + + +VM + + + + + + +VM + + + + +VM + + + + +VM + + + + +OVS + + + + +OVS + + + + +Live-migration with tunnel after migration + + + + + + + + + + + + + + + migration + + \ No newline at end of file diff --git a/doc/source/images/internal-tunnel-live-migration-before.png b/doc/source/images/internal-tunnel-live-migration-before.png new file mode 100644 index 00000000..6d53bc43 Binary files /dev/null and b/doc/source/images/internal-tunnel-live-migration-before.png differ diff --git a/doc/source/images/internal-tunnel-live-migration-before.svg b/doc/source/images/internal-tunnel-live-migration-before.svg new file mode 100644 index 00000000..916d370f --- /dev/null +++ b/doc/source/images/internal-tunnel-live-migration-before.svg @@ -0,0 +1,1445 @@ + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ComputeNode + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OVS + + +ComputeNode + + + +Computenode + + +VM + + +VM + + +VM + + +VM + + +OVS + + +OVS + + +Live-migration with tunnel before preparation + + + + + + + + + + + GRE-tunnel + + +migration + \ No newline at end of file diff --git a/doc/source/images/internal-tunnel-live-migration-during.png b/doc/source/images/internal-tunnel-live-migration-during.png new file mode 100644 index 00000000..aa1e9836 Binary files /dev/null and b/doc/source/images/internal-tunnel-live-migration-during.png differ diff --git a/doc/source/images/internal-tunnel-live-migration-during.svg b/doc/source/images/internal-tunnel-live-migration-during.svg new file mode 100644 index 00000000..0362e66f --- /dev/null +++ b/doc/source/images/internal-tunnel-live-migration-during.svg @@ -0,0 +1,1578 @@ + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ComputeNode + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + OVS + + + + +ComputeNode + + + + + +Computenode + + + + +VM + + + + +VM + + + + +VM + + + + +VM + + + + +VM + + + + +OVS + + + + +OVS + + + + +Live-migration with tunnel during migration + + + + + + + + + + + + + + + migration + +packets destined to the VMare sent to both compute nodes + + \ No newline at end of file diff --git a/doc/source/images/mac-learning.png b/doc/source/images/mac-learning.png index cdd0f7b3..8ce3e75c 100644 Binary files a/doc/source/images/mac-learning.png and b/doc/source/images/mac-learning.png differ diff --git a/doc/source/images/mac-learning.svg b/doc/source/images/mac-learning.svg index 43d806c5..49f600ea 100644 --- a/doc/source/images/mac-learning.svg +++ b/doc/source/images/mac-learning.svg @@ -15,7 +15,7 @@ height="744.09448" id="svg2" version="1.1" - inkscape:version="0.48.1 r9760" + inkscape:version="0.48.3.1 r9886" sodipodi:docname="mac-learning.svg" inkscape:export-filename="/home/yamahata/openvswitch/sp-lab/scarab/scarab-2/doc/source/images/mac-learning.png" inkscape:export-xdpi="90" @@ -28,7 +28,7 @@ inkscape:pageopacity="0.0" inkscape:pageshadow="2" inkscape:zoom="0.8162589" - inkscape:cx="374.1874" + inkscape:cx="376.6376" inkscape:cy="324.99839" inkscape:document-units="px" inkscape:current-layer="layer1" @@ -394,30 +394,25 @@ id="path4088" inkscape:connector-curvature="0" transform="translate(0,308.2677)" /> - - - ryu-openflow-controller - + + ryu to network id of OVS port + id="tspan3090">to network uuid of OVS port @@ -759,6 +754,6 @@ id="tspan6176" y="891.41553" x="344.25351" - sodipodi:role="line">network id + sodipodi:role="line">network uuid diff --git a/doc/source/images/network-creation.png b/doc/source/images/network-creation.png deleted file mode 100644 index d2fe033f..00000000 Binary files a/doc/source/images/network-creation.png and /dev/null differ diff --git a/doc/source/images/network-creation.svg b/doc/source/images/network-creation.svg deleted file mode 100644 index 3d6d1e5f..00000000 --- a/doc/source/images/network-creation.svg +++ /dev/null @@ -1,484 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - image/svg+xml - - - - - - - - - - - quantum-server - - - - ryu-openflow-controller - - - - tenant-X - - - nova-network - User - - tenant creation - - network creation - allocate network id - - tell network id - - diff --git a/doc/source/internals_l2_isolation.rst b/doc/source/internals_l2_isolation.rst new file mode 100644 index 00000000..03e2ad0e --- /dev/null +++ b/doc/source/internals_l2_isolation.rst @@ -0,0 +1,193 @@ +.. _internals_l2_isolation: + +**************** +Ryu L2 isolation +**************** +This section describes how Ryu cooperates with Openstack Quantum and +how its L2 isolation works. + +Overview +======== +Ryu provides REST API by which Quantum server tells necessary informations. +Quantum Server manages the association networks(uuid) to actual key value in +addition to normal Quantum management informations. +(Here key value is an integer for VLAN ID, GRE key and so on. +The quantum only have to know the range of key which depends on the isolation +technology. For example, 12 bit in VLAN case, 24 bit in GRE case.) +Quantum Ryu plugin doesn't know about what technology Ryu uses for L2 +isolation. + + .. image:: /images/internal-quantum-overview.png + +Quantum doesn't necessarily knows all the informations Ryu needs like +mac address attached to the interface. Ryu can gather those informations +by accessing directly to OVSDB. When tunnel ports on OVS needs to be created +on compute-node, Ryu will directly accesses to OVSDB and creates/deletes +ports. + + +Cooperate with Openstack Quantum +================================ +Ryu reacts to Qauntnum events, compute-node boots up, network +creation/deletion, and VM instance creation/deletion. +When VM instance is created, corresponding quantum port is created. + +compute-node boot up +-------------------- +When a compute note boots up, minimal initalization work is done by +Ryu-quantum-agent which tell necessary informations to Ryu. +Then Ryu set up OVS such that OVS connects to Ryu via OpenFlow. +There are 2 steps of OVS initialization. By agent and by Ryu. +This is to keep Ryu agent logic minimal and independent from what actual Ryu +needs to set. Even if Ryu is enhanced for new feature and some additional +configuration to OVS is needed (for example multi-controller for HA), +ryu agent doesn't need to be modified due to 2 step initialization. + + .. image:: /images/internal-quantum-bootup.png + +network creation +---------------- +When network is created, quantum Ryu plugin assigns Key value to +a created network, and tell the association to Ryu + + .. image:: /images/internal-quantum-network-creation.png + +VM instance creation +-------------------- +When VM instance is created, quantum port is created. Quantum Ryu +plugin tells the association of (network uuid, port uuid) to Ryu, and +then OVS port is created. Ryu finds the port creation via OpenFlow +and get the information of the created port for (port uuid, attached +mac address) via OVSDB protocoal, and then sets up network +configuration to OVS. + + .. image:: /images/internal-quantum-instance-create.png + +quantum_adapater RyuApp +----------------------- +This application watches port creation/deletion by OF protocol. +When it detects the creation of ports, it tries to retrieve related +informations(port uuid, mac address) by OVSDB protocol, +tries to determine if the port corresponds to Qauntnum VM port, and then +stores those informations into the in-memory, which generates the event of +VMPort creation. Then Ryu app of isolation (simple_vlan or gre_tunnel) +will be notified. + +live-migration +-------------- +live-migration is popular feature with virtualization, so as OpenStack. +As of this writing, there is no hooks in quantum. So no notification/callback +are triggered when live-migration starts/on-going/ends/error-abort. +Traditional live-migration uses GARP to tell switches the used mac address +is moved. + + .. image:: /images/internal-live-migration.png + +VLAN +==== +OVS supports port vlan with setting tag value in OVSDB. +Ryu utilizes it for L2 isolation. + +simple_vlan RyuApp +------------------ +When port is created, it sets tag value to key assigned to a given network uuid. +And sets flow entry to output:normal. + +live-migration +-------------- +As flows includes output:normal action, packets are processed by +OVS builtin mac-learning. + +#. When destination VM port is created, same rule is inserted on OVS + on the destination. + But the port on the destination is not used until the first GARP packet + is sent +#. When VM is resumed on the destination, a GARP packet is sent. + Then, mac learning tables on each switch are updated. + So the port on the source will be unused. +#. When the VM on the source is destroyed, the port on the source is also + destroyed. + + +GRE tunneling +============= +OVS supports tunneling and Ryu utilizes it for L2 isolation as follows. + + .. image:: /images/internal-gre-tunnel.png + +tunnel_port_updator RyuApp +-------------------------- +This application watches the VM port creation/deletion, and creates/deletes +tunnel port on OVS when necessary. +That is, it creates tunnel port between compute-nodes which have VMs of same +tenant. it deletes tunnel ports when compute-nodes have no VMs of same +tenant. + +gre_tunnel RyuApp +----------------- +This application watches VM/tunnel port creation/deletion, and +installs/removes flow entries based on port creation/deletion. + +Flow Entries +------------ +Ryu installs following flow entries. + + .. image:: /images/internal-quantum-gre-flow-table.png + +live-migration +-------------- +As flows are aware of mac address of each ports, Ryu updates flow table +for live-migration on each compute-nodes. +When the port of same mac address is added on another compute-node, +Ryu installs flows that duplicates packet so that packets destined to +the mac address will be duplicated and sent to both ports. +GARP from hypervisor isn't used. + + .. image:: /images/internal-tunnel-live-migration-before.png + .. image:: /images/internal-tunnel-live-migration-during.png + .. image:: /images/internal-tunnel-live-migration-after.png + +Mac address based L2 isolation +============================== +Ryu also supports mac address based L2 isolation. +In this case key isn't used. + +mac learing +----------- +When VM sends packets, Ryu determins network uuid from OVS port and then +associates src mac address to network uuid. + + .. image:: /images/mac-learning.png + + +packet filtering(L2 unicast case) +--------------------------------- +* When VM sending L2-unicast packet, Ryu checks if the destination mac + address belongs to the same netowrk id of the source mac address which + is same to the network uuid that the OVS port is associated to. +* If no, the packet is dropped. +* If yes, send the packet is sent to ports which belongs to the same + network uuid and external port. + + .. image:: /images/filtering-outgoing.png + .. image:: /images/filtering-incoming.png + + +packet filtering(L2 broadcast case) +----------------------------------- +* When VM sending L2-broadcast/multicaset packet, Ryu checks if the source + mac address. +* send the packet to all external ports and all OVS ports that belongs + to the same network uuid of the source mac address. +* When receiving broacast/multicast packet from the external ports, + Ryu checks if the source mac address belongs to known network uuid. + + * If yes, send the packet to the external ports except incoming one + and the all OVS ports that belongs to the network uuid + * if no, drop the packet. + + .. image:: /images/filtering-broadcast.png + +live-migration +-------------- +As of this writing, simple isolation doesn't support live-migration. diff --git a/doc/source/openstack.rst b/doc/source/openstack.rst index ec1b9b19..e0b9f571 100644 --- a/doc/source/openstack.rst +++ b/doc/source/openstack.rst @@ -9,4 +9,4 @@ Ryu provides tenant isolation feature in OpenStack. using_with_openstack.rst step_by_step.rst - how_l2_segregation_works.rst + internals_l2_isolation.rst