OpenStack Israel Meetup - Project Kuryr: Bringing Container Networking to Neutron

Project Kuryr
Gal Sagie (@GalSagie)
http://galsagie.github.io

Net1
10.10.10.0/24
VM1
10.10.10.100
VM2
10.10.10.200
Virtual Machine or
Container
Virtual Interface (VIF)
Virtual Port
Virtual Network
Virtual subnet
Neutron Abstraction

Public Network
10.50.50.0/24
Router Router
Tenant A Net1
192.168.1.0/0
Tenant A Net2
192.168.5.0/0
Tenant B Net1
192.168.1.0/0
Tenant B Net2
192.168.9.0/0
VM1
192.168.1.5
VM2
192.168.1.7
192.168.5.2
VM3
192.168.1.9
VM1
192.168.1.3
VM2
192.168.1.3
192.168.9.5
VM3
192.168.9.7
You can build this

A Docker Container
Network Sandbox
Endpoint
A Docker Container
Network Sandbox
Endpoint
A Docker Container
Network Sandbox
Endpoint
Frontend Network
Endpoint
Backend Network
Container Networking : libnetwork

Where Have I Seen
That Before?

Neutron and libnetwork
A Docker
Container
Network
Sandbox
Endpoint
A Docker Container
Network Sandbox
Endpoint
A Docker
Container
Network
Sandbox
Endpoint
Frontend
Network
Endpoint
Backend
Network
Tenant A Net1
192.168.1.0/0
Tenant A Net2
192.168.5.0/0
VM1
192.168.1.5
VM2
192.168.1.7
192.168.5.2

What are the problems?
 Reinventing networking abstractions
 Changing and vendor specific solutions
 Flannel
 Weave
 SocketPlane
 Overlay2 for VM nested containers
 Performance, latency, SLA, management penalties

New Solutions For Containers Networking
Compute Node Node
Networking
Infrastructure

Compute Node
Nested Containers Overlay2
VM
BR-INT
BR-TUN
Docker0
Compute Node
VM
BR-INT
BR-TUN
Docker0
Flannel Overlay
Neutron Overlay

Neutron as the production ready
networking abstraction containers
need

Kuryr Solution
 Neutron as the production ready network abstraction containers
need
 Map container networking abstractions to the Neutron API
 Allow consumers to choose vendor keeping one high quality API free of
vendor lock-in
 Bring your container and VM networking together under one API
 Implement all the common code for Neutron vendors allowing
them to get to container networking by just having a binding script

Kuryr Solution
 Implement a common base for Neutron vendors that support VM
nested containers
 Avoid double encapsulation
 Manage each container port as a Neutron entity
 Planned support for OVN, MidoNet, Dragonflow and Calico
 Leverage Neutron advanced networking
 LBaaS, FWaaS, VPNaaS
 Security Groups / NAT

Kuryr Project Overview
 Open source
 Part of OpenStack Neutron’s big stadium
 Under OpenStack big tent from next release!!!
 Brings the Neutron networking model as a provider for the Docker
CNM
 Aims to support different Container Orchestration Engines
 E.g. Kubernetes, Mesos, Docker Swarm
 Weekly IRC meetings
 Working together with OpenStack community
 Neutron, Magnum, Kolla

Kuryr Project Overview
 Multiple companies working on it

Kuryr
Configuration
Management
Docker Libnetwork
Remote Driver
Docker Libnetwork
IPAM Driver
Kubernetes
CNI
Driver
Authentication
Neutron
Client
Generic
VIF
Binding

Kuryr Libnetwork Remote Driver
 Keeping up to date with the changing libnetwork remote driver API
 Maps Docker's CNM operations into a Neutron API usage
 Any Neutron plugin can use it (for example OVS)

Kuryr Generic VIF Binding Layer
 Binds the container networking namespace to the networking infra
 Common part (container side)
 IPAM
 vEth creation
 Executable based vendor-specific part
 Choice based on Neutron port type
 Free implementation language
 Root context
 Generic OS VIF Binding Library (Nova)

Deployment
 Package based
 Container based with Kolla
 Vendors must generate their downstream container with the necessary
agents and plugin
 Quick and easy deployment (Ansible based)

Kuryr In OpenStack
Controller Node
Neutron Server
Kuryr
Service
Compute Node
Neutron Infrastructure
Compute Node
VM
Kuryr
Service
Neutron Infrastructure

VM Nested Containers
 Leverage the same Neutron solution for tenant containers
networking
 Neutron features
 Easier management
 Same “implementation”
 Support containers networks and VM network isolation
 Neutron plugins already support this: OVN, Midonet, Dragonflow
 Magnum
 Backend Implementations interoperability

Compute Node
Mixed OpenStack Environments – Nested Containers
VM
OVS / Midonet / Calico / Dragonflow
VM
Lightweight Tagging Layer
Neutron network 1
Neutron network 2
Neutron network 3

Neutron Side
 Port Forwarding
 Can be used to implement Docker port-mapping
 Save public IP space
 Adding Tags to Resources
 Pre allocation of ports/networks
 Mapping between Docker IDs to Neutron IDs
 VLAN Trunk API (Nested Ports)
 Formal Neutron API to define nested containers ports
 DNS Resolution for Port Names
 Leveraged for DNS service discovery

New Features for Containers
 Security Groups
 Subnet Pools
 NAT (SNAT / DNAT – Floating IP)
 Port Security (ARP Spoofing)
 QoS
 Quota Management
 Neutron pluggable IPAM
 Provide well-integrated COE Load balancing through Neutron
 FWaaS for Containers
 Many more as Neutron progress…

Kuryr Roadmap Plan
 Liberty Release
 Kuryr specs in Neutron/Magnum communities
 Neutron new features specs
 Docker Libnetwork remote driver
 Generic VIF binding layer
 Configuration and authentication in Neutron
and Docker

Kuryr Roadmap Plan
 Mitaka Release
 Neutron IPAM for Docker
 Containerized Neutron plugins and solutions with Kolla
 Nested containers in VM’s, Magnum – Kuryr integration
 Missing Neutron features
 Port forwarding – port mapping for Docker
 Neutron tags to resources – pre-allocating of network/ports/subnets
 DNS resolution for port names – Docker DNS discovery
 VLAN trunk API - used for nested containers
 Kubernetes networking model (K8s API)
 N Release
 Neutron advance services (LBaaS, FWaaS VPNaaS)
 Kubernetes services to use Neutron LBaaS
 Project Astara
 Mesos

Join Us! Be the Kuryr!
 Project Launchpad
 https://launchpad.net/kuryr
 Project Git Repository
 https://github.com/openstack/kuryr
 Weekly IRC Meeting
 http://eavesdrop.openstack.org/#Kuryr_Project_Meeting
 IRC
 #openstack-neutron @ Freenode

Join Us! Be the Kuryr!
 Mailing List
 openstack-dev@lists.openstack.org ([Neutron][Kuryr])
 Trello Board
 https://trello.com/b/cbIAXrQ2/project-kuryr
 Documentation
 http://docs.openstack.org/developer/kuryr
 Getting Started Blog posts
 http://galsagie.github.io/sdn/openstack/docker/kuryr/neutron/2015/08/24/kur
yr-part1/
 http://galsagie.github.io/sdn/openstack/docker/kuryr/neutron/2015/10/10/kur
yr-ovn/

OpenStack Israel Meetup - Project Kuryr: Bringing Container Networking to Neutron

More Related Content

What's hot (20)

Similar to OpenStack Israel Meetup - Project Kuryr: Bringing Container Networking to Neutron (20)

More from Cloud Native Day Tel Aviv (20)

Recently uploaded (20)

OpenStack Israel Meetup - Project Kuryr: Bringing Container Networking to Neutron

Editor's Notes