Neutron LBaaS Service（2）—— Neutron Services Insertion Model

时间：2014-07-22 22:45:02 阅读：476 评论：0 收藏：0 [点我收藏+]

Service Insertion

Service Insertion是Neutron中实现L4/L7层服务的框架。Neutron以前只有一级插件结构用于实现各种L2层技术(如LinuxBridge,OVS等，部署时分两块：用于和数据库打交道的NeutronPlugin+用于干实际事情的L2Agent），对于L3层的路由和dhcp是采用单独的agent(l3-agent,dhcp-agent)来实现的。但L4-L7层服务要求:

（1）像FW,VPN,DNAT服务需要运行在l3-agent所在的网络节点上，即所谓的Routed/Embedded模式，可参见：https://wiki.openstack.org/wiki/Quantum/ServiceInsertion
bubuko.com,布布扣

(2)像LBaaS服务不需要运行在网络节点上，但网络节点上专门为它准备的port和实际运行haproxy的节点应该通，这个port和网关也应该通，即所谓的Floating/In-Path模式。
bubuko.com,布布扣
(3) 还有一种叫Out-of-Path模式，可能在实现sFlow之类的监控时有用：Where the service also runs in a standalone way but in this case the traffic is first sent to the Router entity and then redirected to the Advanced Service, finally send it back to the routed with specific configuration. In particular, this model could be reduced to the first assuming that a standalone service is regarded as a peculiar case of router capable of providing only a specific service. This mode needs specific changes at the routing entity and may not be implemented in Grizzly release.
bubuko.com,布布扣

于是，Neutron又实现了一层叫做“服务”的插件结构，即现在有两层插件结构，在NeutronPlugin上又可以启动多个服务，eutronPlugin的服务插件继续和数据库打交道同时也能共享原有的NeutronPlugin的信息，如port信息；同时，像FWaaS服务要求ServiceAgent可以运行在l3-agent所在的网络节点上，而LBaaS的haproxy并不需要也安装在l3-agent，但l3-agent也应该在一个专门的命名空间里创建一个port和haproxy所在host是联通的。

Service Type Concept

Just like the Quantum plugins allow for using several technologies for implementing the basic logical topologies, advanced services will use a similar mechanism. However, for advanced services, multiple different implementations of the same kind of service might co-exist in the same deployment. There are a number of reasons for this, most importantly the ability of giving tenants a choice among solutions. The Service Type concept tries to address the need for multiple, co-existing, service providers.

A Service Type definitions might be regarded as list of services (and their providers) which can be offered to tenants. Each advanced service, regardless of its insertion mode, should be either directly or indirectly associated with a single service type.

The association between a service and a service type can happen in two ways, according to the insertion mode of the service.

Routed Insertion mode: The advanced service will be associated with Quantum logical router, which in turn is associated with a service_type resource;

In order to ensure backward compatibility a default service type must be specified. This implies that all the services which will be inserted on a router will share the same service type.

Floating Insertion mode: The service type should be explicitly specified on the advanced service being created; if not, the default service type will be used.

When an advanced service is created at the API layer one of the following two should be specified:

service_type_id # floating or out-of-path insertion
router_id # routed or in-path insertion

It should not be allowed to specify both parameters.

The logical model for service insertion, augmented with the service type concept, is depicted in the following diagram:

bubuko.com,布布扣

下面以LBaaS为例(https://wiki.openstack.org/wiki/Quantum/LBaaS)，说明代码中是如何实现ServiceInsertion框架的。

1, 在NeutronPlugin的配置文件/etc/neutron/neutron.conf中配置核心插件和服务插件：

service_plugins =neutron.services.loadbalancer.plugin.LoadBalancerPlugin

core_plugin =neutron.plugins.openvswitch.ovs_neutron_plugin.OVSNeutronPluginV2

2,在$neutron/neutron/manager.py的init方法中加载service插件：

self.service_plugins ={constants.CORE:self.plugin}

self._load_service_plugins()

3,Agent到Driver的映射即是所说的第二层插件结构，例如haproxydriver只是LbaaSAgent实现的一种：

$neutron/neutron/services/loadbalancer/driver/haproxy/agent.py会调用

$neutron/neutron/services/loadbalancer/driver/haproxy/agent_manager.py来加载haproxy对应的driver，从lbaas的代码架构可以看出：

bubuko.com,布布扣

Service Chain

上节说了通过定义service这第二层的插件结构来实现L4/L7层服务，但一个tenant可能同时需要多个L4/L7层服务，如LB，如FW，并且是有序的。ServiceChain就是来做这件事。

　一个tenant可以请求创建多个有序的Service。ServiceTypes定义了service被插入到tenant网络中的行为：

L3, 这类服务有ip具有路由流量,它运行在router上，或者不运行在router上但具有l3-forwarding的功能，如LBaaS
L2,这类服务具有交换流量，有能力做l2-switching和mac地址学习，如L2-Firewallservice（如用ovs的流表来代替iptables）。
Bump-in-the-wire,嵌入式服务，这类服务既无路由流量也无交换流量，只有出口和入口port，服务在入口port之前就运行了，如Firewallperforming filtering and auditing。
Tap, 这类服务在servicechain中仅在特定的点消费流量，如monitoringservice