This blueprint is to introduce the Cisco APIC to OpenStack Neutron. The plugin is implemented as an ML2 mechanism driver.
The APIC (Application Policy Infrastructure Controller) together with Cisco Nexus 9000 switches provides programmable, policy-driven network control.
The mechanism driver proposed here will interact with the APIC to dynamically manage networking for OpenStack instances. The APIC will intelligently configure the hardware layer and manage VXLAN overlays for networks. VXLAN gateways will be implemented by the controller at the top of rack layer to reduce encapsulation latency in the software switch layer.
- Application centric policy based networking
- External controller managed network fabric
- VXLAN Overlay networks
The diagram below provides a high level overview of how the APIC plugin will integrate into a working environment consisting of multiple hosts with virtual switches connected by a fabric of Nexus 9000 switches. The APIC Mechanism Driver for ML2 communicated with the APIC via its REST API.
+–––––––––––––––––––––––––+ | | | Neutron Server | | with ML2 Plugin | | | | +–––––––––––+ | +–––––––+ | APIC | | | | | Mechanism | | +–––––––––––––––––+ | | | Driver | | | | | +––––+ +––+–––––––––––+––+ REST API | Cisco | | | | | APIC Client +––––––––––––––––––+ APIC | | | +–––––––+–––––––––––––––––+ | | | | | | | | +–––+–––+–––––––––+ | | +–––––––––––+––––––––––––––+ | | | +––––+ L2 Agent | Open vSwitch +–––––+ | | | +–––––––––––+––––––––––––––+ | | | | | | | | | | | HOST 1 | | | | | | | | +––––––––+–––|––––––+ | +––––––––––––––––––––––––––+ | | | | | +––––––+ +–––––––––+––––––+––+ | | | | | +––––––––––+–––––––––––––––+ | | Cisco | +–––––––+ L2 Agent | Open vSwitch +––––––––––––+ | Nexus 9000 | +––––––––––+–––––––––––––––+ | | Switches | | | +––+ | | HOST 2 | | | | | +–––––––––––––––––––+ +––––––––––––––––––––––––––+
The APIC mechanism driver updates the APIC with port, network and subnet changes from Neutron. The APIC configures the physical switch fabric.
The APIC mechanism driver is designed to operate together with the OVS mechanism driver for handling network operations and port binding on the compute nodes.
The APIC mechanism driver implements the following Neutron events:
An alternative solution would be to develop a monolithic plugin. The biggest advantage of using the ML2 mechanism driver approach is that it allows us to easily use the existing OVS agent for virtual switching.
Three new models are created by this driver. These models are specific to this driver and are used for keeping in sync with the APIC.
- NetworkEPG: Tracks network to End Point Group mapping in the APIC.
- PortProfile: Tracks hardware switch/module/port configuration.
- TenantContract: Tracks contracts and filters created on the APIC.
A database migration is included to create the tables for these models.
No existing models are changed.
The performance of ML2 when configured with the APIC driver will be dependent on the performance of the link between Neutron and the APIC, and on the responsiveness of the APIC itself.
The deployer must configure the installation to use the APIC with the following configuration variables:
Additionally, the deployer must configure the ML2 plugin to include the openvswitch mechanism driver before the APIC mechanism driver:
[ml2] mechanism_drivers = openvswitch,cisco_apic
Arvind Somya <asomya>
Henry Gessau <gessau>
The work is split up into two parts:
There are no new library requirements. The following third party library is used:
Complete unit test coverage of the code is included.
For tempest test coverage, third party testing is provided. The Cisco CI reports on all changes affecting this driver. The testing is run in a setup with an OpenStack deployment (devstack) connected to a live APIC and a Cisco Nexus 9000 physical switch.