Deploying IPv6 in OpenStack Environments Shannon McFarland - CCIE #5245 Distinguished Engineer Cloud Platform & Services Group @eyepv6
Agenda • General OpenStack + IPv6 Stuff • Tenant IPv6 • Address Assignment: SLAAC, Stateless DHCPv6, Stateful DHCPv6 • Provider Networks • IPv6 Only • IPv6 Prefix Delegation • IPv6 with Heat • IPv6 with L3 High-Availability • Next Time • Conclusion
Reference Material • https://github.com/shmcfarl/my-heat-templates • https://github.com/shmcfarl/my-heat-templates/blob/master/new-v6-only- lbaasv2.yaml • Some posts with more details: http://www.debug-all.com/ • Tenant IPv6 Deployment: http://www.debug-all.com/?m=201505 • Tenant IPv6 Deployment using Heat: http://www.debug- all.com/?m=201506
General OpenStack + IPv6 Stuff
It’s The End Of The World As We Know It • IANA and RIRs are out or almost out of IPv4 addresses: • https://www.arin.net/knowledge/ipv6_info_center.html • https://www.ripe.net/publications/ipv6-info-centre • https://www.apnic.net/community/ipv6-program • http://afrinic.net/services/ipv6-programme • http://portalipv6.lacnic.net/en/ • It’s easy to get IPv6 addressing and the general deployment of IPv6 on your infrastructure is much easier to do than it used to be - no excuses not to do it
The Hard Stuff – IPv6 + Cloud Inside of a Cloud stack you have a lot of moving parts and they all ride on IP: • API endpoints • Provisioning, Orchestration and Management services • Boatload of protocols and databases and high-availability components • Virtual networking services <> Physical networking • It has been a bumpy road to getting a solid IPv6 implementation in OpenStack • Most of the core IPv6 requirements are met except for IPv6 PD HA and IPv6-only Metadata (config-drive seems to • be good enough) Tenant IPv6 Address Assignment via: • SLAAC, Stateful DHCPv6, Stateless DHCPv6 • ipv6_ra_mode attribute - Control of router advertisements for a subnet • ipv6_address_mode attribute - Control of how addressing is handled by OpenStack • Two common approaches for IPv6 support: • Dual-Stack everything (Service Tier + Tenant Access Tier [Tenant management interface along with VM network access]) • Conditional Dual stack (Tenant Access Tier only – API endpoints & DBs are still IPv4) •
Cloud Stack – IP Version Options Dual-Stack Everything Conditional Dual-Stack Service Tier/Control Service Tier/Control Tenant 2 Tenant Tenant 1 Plane Plane Access Tier Access Tier Access Tier VM Operating VM Operating VM Operating API endpoints IPv4 API endpoints IPv4/IPv6 IPv6 IPv4/IPv6 IPv4/IPv6 System System System IPv4 IPv4/IPv6 Database(s) Database(s) Virtual Virtual Virtual IPv6 IPv4/IPv6 IPv4/IPv6 Networking Networking Networking Automation IPv4 Automation IPv4/IPv6 (L2/L3) (L2/L3) (L2/L3) Virtual Virtual Virtual Interface Interface IPv6 IPv4/IPv6 Network Network Network IPv4/IPv6 IPv4/IPv6 IPv4/IPv6 (GUI, CLI) (GUI, CLI) Services Services Services (SLB/FW) (SLB/FW) (SLB/FW) Tenant Tenant Tenant IPv6 IPv4/IPv6 IPv4/IPv6 Interface Interface Interface (GUI, CLI) (GUI, CLI) (GUI, CLI)
Tenant IPv6 Deployment
Address Assignment: Neutron L3-Router - SLAAC, DHCPv6 Stateless, DHCPv6 Stateful
Tenant IPv6 Address Options Don’t do this Tenant 1 = 2001:DB8:1::/48 Tenant 1 = 2001:DB8:1::/48 2001:420::/32 Tenant 2 = 2001:DB8:2::/48 Tenant 2 = 2001:DB8:2::/48 XLATE/Proxy :BAD:BEEF::/64 :DEAD:BEEF::/64 :1000::/64 :2000::/64 ULA Block/48 ULA Block/48 ::A ::A ::A ::A ::A ::A FDDE:50EE:79DA:1::/64 FD9C:58ED:7D73:1::/64 Web Web Web Web Web Web :DEAD:FACE::/64 :BAD:FACE::/64 Server Server Server Server Server Server :1001::/64 :2001::/64 ::1 ::1 ::1 ::1 ::1 ::1 ::2 ::2 ::2 ::2 ::2 ::2 App App App App App App Server Server Server Server Server Server Tenant 1 Tenant 2 Tenant 1 Tenant 2 Tenant 1 Tenant 2 Option 1 Option 2 Option 3 Cloud Provider-assigned Tenant Brings Addressing Prefix Translation Addressing
Neutron Addressing Schemes Reference ipv6_ra_mode ipv6_address_mode Result Address Value SLAAC N/S Address using Neutron router Configuration N/S SLAAC Address using external router Flags Auto 1 SLAAC SLAAC Address using Neutron router Managed 0 ipv6_ra_mode ipv6_address_mode Result Other 0 DHCPv6- N/S Address using Neutron router and optional stateless information using external service Address Value N/S DHCPv6-stateless Address using external router and optional Configuration information using Neutron DHCP Flags implementation Auto 1 DHCPv6- DHCPv6-stateless Address and optional information using Managed 0 stateless Neutron router and DHCP implementation Other 1 respectively ipv6_ra_mode ipv6_address_mode Result Address Value DHCPv6-stateful N/S Address and optional information using Configuration external service Flags N/S DHCPv6-stateful Address and optional information using Auto 0 Neutron DHCP implementation Managed 1 DHCPv6-stateful DHCPv6-stateful Address and optional information using Other 1 Neutron DHCP implementation http://docs.openstack.org/mitaka/networking-guide/config-ipv6.html
Tenant IPv6 - Neutron L3 Example
Create the Public Network/Subnet neutron net-create public --router:external neutron subnet-create --name public-subnet --allocation-pool start=172.16.12.5, end=172.16.12.254 public 172.16.12.0/24 neutron subnet-create --ip-version=6 --name=public-v6-subnet --allocation-pool start=2001:db8:cafe:d::5, end=2001:db8:cafe:d:ffff:ffff:ffff:fffe --disable-dhcp public 2001:db8:cafe:d::/64 DC rtr IPv4: 172.16.12.0/24 IPv6: 2001:db8:cafe:d::/64 .5 ::5 Router
2001:db8:cafe:a::e SLAAC Mode DNS neutron net-create private DC neutron subnet-create --ip-version=6 --name=private_v6_subnet --ipv6-address-mode=slaac --ipv6-ra-mode=slaac private 2001:db8:cafe::/64 +-------------------+-----------------------------------------------------------------------------+ | Field | Value | IPv6: 2001:db8:cafe:d::/64 IPv4: 172.16.12.0/24 +-------------------+-----------------------------------------------------------------------------+ .5 ::5 | allocation_pools | {"start": "2001:db8:cafe::2", "end": "2001:db8:cafe:0:ffff:ffff:ffff:fffe"} | | cidr | 2001:db8:cafe::/64 | Router | dns_nameservers | | | enable_dhcp | True | | gateway_ip | 2001:db8:cafe::1 | .1 ::1 | host_routes | | | id | 42cc3dbc-938b-4ad6-b12e-59aef7618477 | | ip_version | 6 | IPv4: 10.0.0.0/24 IPv6: 2001:db8:cafe:0::/64 | ipv6_address_mode | slaac | | ipv6_ra_mode | slaac | | name | private_v6_subnet | Instance | network_id | 7166ce15-c581-4195-9479-ad2283193d06 | | subnetpool_id | | IPv4: 10.0.0.9 | tenant_id | f057804eb39b4618b40e06196e16265b | IPv6: 2001:db8:cafe:0:f816:3eff:fe79:5acc +-------------------+-----------------------------------------------------------------------------+
2001:db8:cafe:a::e Router Example DNS neutron router-create private-router DC neutron router-gateway-set private-router public neutron router-interface-add private-router private-v4-subnet IPv6: 2001:db8:cafe:d::/64 IPv4: 172.16.12.0/24 .5 ::5 neutron router-interface-add private-router private-v6-subnet Router .1 ::1 IPv4: 10.0.0.0/24 IPv6: 2001:db8:cafe:0::/64 Instance IPv4: 10.0.0.9 IPv6: 2001:db8:cafe:0:f816:3eff:fe79:5acc
SLAAC Mode Info • OpenStack will not inject the IPv6 DNS entry from the subnet dns_nameservers entry • Options • Manually setting the IPv6 DNS server entry in the resolv.conf file allows for correct IPv6-based name resolution • Bake DNS settings into your image • Cloud-init to inject the DNS configuration • You do get A and AAAA records back over IPv4 transport • Basically, it works as it should
Recommend
More recommend
