OpenStack® Summit Austin 2016OpenStack® Summit Austin 2016

Infrastructure as Code in OpenStackwith Ansible

Alex TeschCloud Consultant

@tesch75

Anthony ReesCloud Consultant

@anthonyrees

Advanced Neutron Use CasesWhat will we cover ?– LBaaS

– Proactive auto Scaling

– FWaaS– Dynamic security

– VPNaas– Connecting two clouds

– Bare Metal as a Service

2

LBaaSLoad Balancer as a Service

3

Load Balancer as a ServiceWhy was the customer interested in LBaaS?

– Auto scaling via threshold

– Variety of load balancers supported

– Control load balancers by code

4

Current Neutron LimitationsHow do we overcome them?LBaaS v2 Limitations in current enterprise distros– Lack of Autoscaling capabilities using the traditional scaling group approach.

– Instead of using Ceilometer / heat to trigger the autoscaling, we decided to use an enterprise monitoring tool to keep track of the CPU utilisation in the Tomcat instances and use scripts to trigger the scale up / down once thresholds are reached.

– No HA capabilities for LBaaS v2 control plane and data plane.– An external HW Load Balancer with supported LBaaS v2 API can be used to achieve

HA in the data plane. HA for the control plane remains a concern…

5

Current Neutron LimitationsHow do we overcome them?LBaaS v2 Limitations in current enterprise distros– The LBaaS agent runs inside the kernel namespaces of the network node or

compute (when DVR is used). If the network node is down, the kernel namespace is gone and there is no way to bring up the load balancer in an alternate network node. – This limitation will be addressed by Octavia in the next Enterprise release.

6

Current Neutron LimitationsHow do we overcome them?LBaaS v2 Limitations in current enterprise distros– No Horizon integration

– LBaaS needs to be managed from neutron CLI or using API (This is not a bad thing).

– LBaaS v2 has no integration with Heat. (This is a bad thing…)– The work around presented in the demo makes possible to orchestrate a full two tier

infrastructure (Tomcat / Oracle) combining heat orchestration templates with neutron API calls driven from a single Ansible playbook or a single shell script.

7

FWaaSFire Wall as a Service

8

Fire Wall as a ServiceWhy was the customer interested in FWaaS?

– Simple interface for Firewall

– Dynamic changes applied | No restart required

– Control the Firewall via code

– Advantages beyond what’s offered by Security Groups for LBaaS

9

Current Neutron LimitationsHow do we overcome them?FWaaS v1 Limitations in current enterprise distros– This is by no mean an Enterprise HW firewall replacement.

– External FW support is in place for major vendors (checkpoint, Brocade,

– If DVR is enabled the firewall service does not filter east / west traffic, only north south traffic is filtered.– A combination of security group policies / FWaaS can be used to address this.

10

Current Neutron LimitationsHow do we overcome them?FWaaS v1 Limitations in current enterprise distros– Security groups are not able to block ICMP targeting the LBaaS floating IP

(since the LBaaS is an agent, not a VM) FWaaS can address this (as shown in the demo).

11

VPNaaSVirtual Private Network as a Service

12

VPN as a ServiceWhy was the customer interested in VPNaaS?

– Securely connect two clouds to create a ‘region’ like experience

– Enable ‘Back-end’ as a Service

– Enable ‘Bi-Modal’ IT

– A way to link legacy systems of record, databases etc. to cloud instances

13

VPN as a ServiceHow it works

14

Site A(Private Cloud)

Site B(Public Cloud)

DB

WebWeb

Web

IPSec Site Connections

Current Neutron LimitationsHow do we overcome them?VPNaaS limitations in current enterprise distros– VPNaaS doesn’t work with FIP if DVR is being used.

– VPNaaS currently supports only Pre-shared keys (PSK).– If certificate based security is required, VPNaaS is not a viable option in the current

enterprise distributions.

15

Current Neutron LimitationsHow do we overcome them?VPNaaS limitations in current enterprise distros– The VPNaaS implementation is based on OpenSwan which runs an ipsec

process as root in the network nodes. A vulnerability in this process could lead to a root compromise in the network nodes.– If this is a major concern, operators should consider deploying additional protection

mechanisms.

16

BMaaSBare Metal as a Service

17

Bare Metal as a ServiceWhy was the customer interested in Bare Metal?

– Automated way to add compute nodes to their cloud

– Automated way to provision Bare Metal for applications that don’t perform on cloud instances

– Control bare metal via code

– One code base to control cloud instances or bare metal

18

Bare Metal ProvisioningProvisioning new servers into the cloudThe Ansible Model

– The model holds existing and new bare metal servers

19

– Ansible passes the metadata required to Cobbler

– Ansible configures the DHCP server for the new bare metal machine

20

Bare Metal ProvisioningProvisioning new servers into the cloudThe Ansible Model

– Ansible powers up the new bare metal machine

21

Bare Metal ProvisioningProvisioning new servers into the cloudThe Ansible Model

Thank you

22