Openstack Group-Based Policy
Download as PPTX, PDF1 like324 views
The Group-based Policy (GBP) abstractions for OpenStack provide an intent-driven declarative policy model that presents simplified application-oriented interfaces to the user. GBP allows separation of the intent of application developers from the requirements of infrastructure operators. It provides policy-based abstractions to manage OpenStack infrastructure and runs on top of existing OpenStack services.
![Group-Based Policy Constructs
12
•Collection of network endpoints with their properties.
•Policy Target Group: Contains members [VMs]
•External Group: Contains the external connectivity defined by External Segment
Groups
•These are reusable rules that define connectivity between members of the group
Policy Rules
•These are collection of Policy rules
Policy Rule Set
•It defines port, protocol and direction
Classifier
•It can be of type ALLOW, REDIRECT (Service chaining)
Actions](https://image.slidesharecdn.com/openstackgroup-basedpolicy-out-160414121745/85/Openstack-Group-Based-Policy-12-320.jpg)
Openstack Group-Based Policy
- 1. OPENSTACK GROUP- BASED POLICY The Group-based Policy (GBP) abstractions for OpenStack provide an intent-driven declarative policy model that presents simplified application-oriented interfaces to the user. 1
- 2. Agenda 2 Openstack Challenges Group-Based Policy Overcoming challenges Under the hood More Features
- 3. Openstack 3 A free open source software platform for cloud computing mostly deployed as IAAS Started in 2010 At least two releases every year, current stable release – Liberty 2015; upcoming is Mitaka April 2016 Thousands of contributors in over 100 countries
- 4. Openstack Architecture 4 Openstack Shared Services SWIFT CINDE R NOVA GLANC E NEUTRO N HORIZON GUI STORAGE HYPERVISORS NETWORK CLI REST API REST API Users Users
- 7. Agenda 7 Openstack Challenges Group-Based Policy Overcoming challenges Under the hood More Features
- 8. Challenges 8 1 • Separating the Concerns 2 • Networking knowledge 3 • Need to manually maintain and refer virtual infrastructure information for any deployment 4 • Introduces more complexity with new networking features such as firewalling, load balancing
- 9. Agenda 9 Openstack Challenges Group-Based Policy Overcoming challenges Under the hood More Features
- 10. Group-Based Policy 10 GBP is available from Openstack Juno release Developed by a community of engineers from IBM, Cisco, Big Switch etc. It was started around Sept 2014 It has the ability to separate the intent of the application developer from the requirement of the infrastructure operators It runs on top of existing Openstack services Designed to offer policy based abstractions to manage Openstack infrastructure
- 11. Group-Based Policy 11 Openstack Shared Services SWIFT CINDE R NOVA GLANC E NEUTRO N HORIZON GUI STORAGE HYPERVISORS NETWORK CLI REST API REST API Users Users
- 12. Group-Based Policy Constructs 12 •Collection of network endpoints with their properties. •Policy Target Group: Contains members [VMs] •External Group: Contains the external connectivity defined by External Segment Groups •These are reusable rules that define connectivity between members of the group Policy Rules •These are collection of Policy rules Policy Rule Set •It defines port, protocol and direction Classifier •It can be of type ALLOW, REDIRECT (Service chaining) Actions
- 13. Group-Based Policy Design 13 POLICY TARGET GROUP SUBNET LAYER 2 POLICY POLICY RULE SET POLICY RULE POLICY RULE POLICY RULE CLASSIFIER CLASSIFIER ACTIONS ACTIONS POLICY TAGS Port: 22 Protocol: TCP Direction: Bi ALLOW
- 15. POLICY Demo 15 15 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 APP GROUP DB GROUPWEB GROUP
- 16. Agenda 16 Openstack Challenges Group-Based Policy Overcoming challenges Under the hood More Features
- 17. Overcoming Challenges 17 Non-GBP GBP Separating the Concerns Networking knowledge Manually maintain and refer info More complexity with new n/w features Separation of Concerns No Need to have networking knowledge No Need to maintain any information Complexity removed with service chaining
- 18. Agenda 18 Openstack Challenges Group-Based Policy Overcoming challenges Under the hood More Features
- 19. Group-Based Policy Under the hood19 Neutron Driver HORIZON GUICLI ML2 Driver Neutron ODL Driver Vendor Driver Network Infrastructure
- 20. Agenda 20 Group-Based Policy Overcoming challenges Under the hood More Features Future Q&A
- 21. More Features of Group-Based Policy21 Service Chaining NAT Pooling
- 22. SERVICE CHAINING Service Chaining 22 WEB GROUP APP GROUP DB GROUP CLASSIFIE R FIREWALL LOAD BALANCER PORT 80 REDIRECT
- 23. Agenda 23 Group-Based Policy Overcoming challenges Under the hood More Features Future Q&A
- 24. Future Group Based Policy Experience24 It will become more easier and more flexible for vendors to integrate with Openstack that are offering policy based solutions More focus on application deployment and delivery Integrating SDN based solution will be easier
- 25. Agenda 25 Group-Based Policy Overcoming challenges Under the hood ICF More Features Future Q&A
- 26. Q&A 26
- 27. THANK YOU! Shital Patil & Vinod Borole 27
Editor's Notes
- #7: Application developers, the real users of the cloud infrastructure, need to think about different layers of the Open Systems Interconnection (OSI) stack as they deploy their applications. So although the detailed network configuration is very natural for a networking team, in many cases it adds unnecessary complexity and confusion for application developers. This complexity only increases as new features such as network services are added to the mix. Application developers just want to describe the network and security requirements of their applications in the simplest terms possible.
- #9: Application developers, the real users of the cloud infrastructure, need to think about different layers of the Open Systems Interconnection (OSI) stack as they deploy their applications. So although the detailed network configuration is very natural for a networking team, in many cases it adds unnecessary complexity and confusion for application developers. This complexity only increases as new features such as network services are added to the mix. Application developers just want to describe the network and security requirements of their applications in the simplest terms possible.
- #11: OpenStack Group-based Policy was designed to offer a new set of abstractions to manage OpenStack infrastructure. The solution was designed to separate the intent of the application developer from the requirements of the infrastructure operators to offer a powerful yet simple set of APIs. The solution runs on top of existing OpenStack services in a non-disruptive manner and has been developed by a community of engineers from Big Switch, Cisco, IBM, Juniper, Midokura, Nuage Networks, and One Convergence. GBP is available now on Stack-Forge and is designed to work with the OpenStack Juno release.
- #13: To address additional network services like firewalling, load balancing; service chaining can be used.
- #25: Future IaaS environments need to focus on deployment and delivery of applications and services with speed, agility, flexibility, security, and scale rather than just orchestration of infrastructure components