Ceilometer currently has no support for metering Firewall as a Service. Cloud providers/Operators have the need to monitor and meter various aspects of the Network Services. This spec deals with metering Firewall as a Service(FWaaS).
The measurements needed for metering FWaas are categorized into two, provider and service level. Following are the measurements targeted to be included in Ceilometer:
Provider level metrics:
- Type of Firewall (iptables, CSR virtual firewall etc..) - depends on flavor framework in neutron(See Dependencies)
Service level metrics:
- Firewall Rule/Policy existence
- Number of Connections - Needs changes to Neutron FWaaS(See Dependencies)
- Bandwidth - Needs changes to neutron FWaaS(See Dependencies)
g = gauge, c = cumulative, p = pollster
The resources associated with these metrics are captured as part of resource discovery. Neutron exposes apis to capture this data which are invoke via pollsters from the ceilometer side. The notifications on neutron services side are a bit slim. As we add these notification messages to the neutron side, we will enhance the ceilometer side to capture these events through notification handlers.
For reference implemenation on neutron side, there will be an api call to retrieve stats such as connections and bandwidth.The backend implementation will be based on iptables. Iptables provides us a way to gather average hit counts to provide these stats. Other vendor based implementation can do the same.
New sources need to be included in pipeline.yaml for each group of pollsters that share a discovery extension. An example below:
sources: - name: fw_source interval: 600 meters: - "network.services.fw" discovery: - "firewall" sinks: - network_services_sink
Similarly, we will have sources for firewall policy, hit counts and bandwidth.
The end user should be able to interact via the existing API and CLI.
This change should not have any major impact on performance/Scalability.
This feature should have minimal impact on developers for ongoing maintenance
New measurements around FWaaS and other network services will be part of the network pollsters and notifications. So ongoing maintenance will be handled by the Ceilometer team, myself included.
Unit and integration Tests will be added to cover the necessary neutron_client calls, pollsters and notifications.
The Measurement docs need to be updated to reflect the new meters captured from FWaaS API and notifications.