Date post: | 14-Apr-2017 |
Category: |
Technology |
Upload: | openstack |
View: | 1,091 times |
Download: | 2 times |
OpenStack® Summit Austin 2016OpenStack® Summit Austin 2016
Infrastructure as Code in OpenStackwith Ansible
Alex TeschCloud Consultant
@tesch75
Anthony ReesCloud Consultant
@anthonyrees
Advanced Neutron Use CasesWhat will we cover ?– LBaaS
– Proactive auto Scaling
– FWaaS– Dynamic security
– VPNaas– Connecting two clouds
– Bare Metal as a Service
2
LBaaSLoad Balancer as a Service
3
Load Balancer as a ServiceWhy was the customer interested in LBaaS?
– Auto scaling via threshold
– Variety of load balancers supported
– Control load balancers by code
4
Current Neutron LimitationsHow do we overcome them?LBaaS v2 Limitations in current enterprise distros– Lack of Autoscaling capabilities using the traditional scaling group approach.
– Instead of using Ceilometer / heat to trigger the autoscaling, we decided to use an enterprise monitoring tool to keep track of the CPU utilisation in the Tomcat instances and use scripts to trigger the scale up / down once thresholds are reached.
– No HA capabilities for LBaaS v2 control plane and data plane.– An external HW Load Balancer with supported LBaaS v2 API can be used to achieve
HA in the data plane. HA for the control plane remains a concern…
5
Current Neutron LimitationsHow do we overcome them?LBaaS v2 Limitations in current enterprise distros– The LBaaS agent runs inside the kernel namespaces of the network node or
compute (when DVR is used). If the network node is down, the kernel namespace is gone and there is no way to bring up the load balancer in an alternate network node. – This limitation will be addressed by Octavia in the next Enterprise release.
6
Current Neutron LimitationsHow do we overcome them?LBaaS v2 Limitations in current enterprise distros– No Horizon integration
– LBaaS needs to be managed from neutron CLI or using API (This is not a bad thing).
– LBaaS v2 has no integration with Heat. (This is a bad thing…)– The work around presented in the demo makes possible to orchestrate a full two tier
infrastructure (Tomcat / Oracle) combining heat orchestration templates with neutron API calls driven from a single Ansible playbook or a single shell script.
7
FWaaSFire Wall as a Service
8
Fire Wall as a ServiceWhy was the customer interested in FWaaS?
– Simple interface for Firewall
– Dynamic changes applied | No restart required
– Control the Firewall via code
– Advantages beyond what’s offered by Security Groups for LBaaS
9
Current Neutron LimitationsHow do we overcome them?FWaaS v1 Limitations in current enterprise distros– This is by no mean an Enterprise HW firewall replacement.
– External FW support is in place for major vendors (checkpoint, Brocade,
– If DVR is enabled the firewall service does not filter east / west traffic, only north south traffic is filtered.– A combination of security group policies / FWaaS can be used to address this.
10
Current Neutron LimitationsHow do we overcome them?FWaaS v1 Limitations in current enterprise distros– Security groups are not able to block ICMP targeting the LBaaS floating IP
(since the LBaaS is an agent, not a VM) FWaaS can address this (as shown in the demo).
11
VPNaaSVirtual Private Network as a Service
12
VPN as a ServiceWhy was the customer interested in VPNaaS?
– Securely connect two clouds to create a ‘region’ like experience
– Enable ‘Back-end’ as a Service
– Enable ‘Bi-Modal’ IT
– A way to link legacy systems of record, databases etc. to cloud instances
13
VPN as a ServiceHow it works
14
Site A(Private Cloud)
Site B(Public Cloud)
DB
WebWeb
Web
IPSec Site Connections
Current Neutron LimitationsHow do we overcome them?VPNaaS limitations in current enterprise distros– VPNaaS doesn’t work with FIP if DVR is being used.
– VPNaaS currently supports only Pre-shared keys (PSK).– If certificate based security is required, VPNaaS is not a viable option in the current
enterprise distributions.
15
Current Neutron LimitationsHow do we overcome them?VPNaaS limitations in current enterprise distros– The VPNaaS implementation is based on OpenSwan which runs an ipsec
process as root in the network nodes. A vulnerability in this process could lead to a root compromise in the network nodes.– If this is a major concern, operators should consider deploying additional protection
mechanisms.
16
BMaaSBare Metal as a Service
17
Bare Metal as a ServiceWhy was the customer interested in Bare Metal?
– Automated way to add compute nodes to their cloud
– Automated way to provision Bare Metal for applications that don’t perform on cloud instances
– Control bare metal via code
– One code base to control cloud instances or bare metal
18
Bare Metal ProvisioningProvisioning new servers into the cloudThe Ansible Model
– The model holds existing and new bare metal servers
19
– Ansible passes the metadata required to Cobbler
– Ansible configures the DHCP server for the new bare metal machine
20
Bare Metal ProvisioningProvisioning new servers into the cloudThe Ansible Model
– Ansible powers up the new bare metal machine
21
Bare Metal ProvisioningProvisioning new servers into the cloudThe Ansible Model
Thank you
22