You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Standards/scs-xxxx-v1-provider-network-standard.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ track: IaaS
10
10
Many use-cases of IaaS require virtual servers to be able to connect to network resources outside of the cloud environment, often to the internet.
11
11
Openstack supports this by allowing CSPs to map non-virtualized networks onto specific virtual networks, such that virtual routers and servers can connect to them.
12
12
13
-
Such networks will usually be created in a provider-managed project and then shared to user projects using the RBAC-feature of the network API.
13
+
Such networks will usually be created in a provider-managed project and then shared to user projects using the RBAC-feature of the Networking API.
14
14
Because they have to be set up by the cloud provider, networks of this type are generally referred to as _provider networks_, though that term can also be used in a broader senseto refer to other types of CSP-managed virtual networks.
15
15
16
16
When setting up provider networks for external access, CSPs have a number of different options regarding usage restrictions and the allocation of IP addresses.
@@ -30,7 +30,7 @@ The following terms are used throughout this document:
30
30
| DHCP | Dynamic Host Configuration Protocol: Used to automatically configure hosts in a network with IP addresses, default routes, and other information such as DNS servers. |
31
31
| Prefix | IP address prefix of a given bit-length N, written as _ADDRESS/N_. Divides addresses into a network and a host part, a shorter prefix allows more hosts but takes up more address space. |
32
32
| NAT | Network Address Translation: mapping (usually public) IPv4 addresses onto a different (usually private) address space. May allows multiple hosts to share a public address by multiplexing TCP/UDP ports. |
33
-
| RBAC | Role-based Access Control: A mechanism in the Network API to give projects limited access to resources owned by other projects. Typically used by CSPs to create provider networks. |
33
+
| RBAC | Role-based Access Control: A mechanism in the Networking API to give projects limited access to resources owned by other projects. Typically used by CSPs to create provider networks. |
34
34
| Shared Network | Virtual network that is shared between projects in a way that allows direct attachment of servers. |
35
35
| External Network | Virtual network that is shared between projects in a way that only allows virtual routers to use it as external gateway. Typically used by CSPs to provide access to networks outside of the cloud environment. |
36
36
| Provider Network | A CSP-managed virtual network made available to projects as either shared or external, typically connected to non-virtualized infrastructure. |
@@ -50,7 +50,7 @@ This section will provide some general background on OpenStack provider networks
50
50
In OpenStack, ownership of resources is generally tracked through projects, and, as per default policy, only members of a project have access to its resources
51
51
This is also true for CSP-managed resources, such as provider networks, which have to be created in a CSP-internal project, and are initially only accessible in this project.
52
52
53
-
The Network API's Role Based Access Control (RBAC) extension can then be used to share it with other projects.
53
+
The Networking API's Role Based Access Control (RBAC) extension can then be used to share it with other projects.
54
54
RBAC rules for networks support the two actions `access_as_external` and `access_as_shared`, and can be created automatically on `openstack network create` with the options `--external` and `--share`.
55
55
56
56
*`access_as_external` allows networks to be used as external gateway for virtual routers in the target projects. Such networks are in the following referred to as _external networks_.
@@ -67,7 +67,7 @@ This works well for shared networks, where servers can be attached directly, but
67
67
68
68
Making servers in a project-internal network externally accessible through a virtual router is a bit more complicated, though.
69
69
One option is for the user to create a subnet with an external IP range for the internal network, and then ask the CSP to configure a static route to the subnet via the gateway IP of a virtual router.
70
-
This is cumbersome to set up manually, but can be automated using the `bgp` extension of the Network API, which is currently implemented both by the `neutron-dynamic-routing` project [^bgp] and by the `ovn` mechanism driver when used with the `ovn-bgp-agent`[^ovn-bgp].
70
+
This is cumbersome to set up manually, but can be automated using the `bgp` extension of the Networking API, which is currently implemented both by the `neutron-dynamic-routing` project [^bgp] and by the `ovn` mechanism driver when used with the `ovn-bgp-agent`[^ovn-bgp].
71
71
For users, this takes the form of a CSP-managed shared subnet pool, which they can use to create externally routable subnets, limited by a per-project quota.
72
72
73
73
For IPv6, there is also the option of prefix delegation, where a DHCPv6 server automatically assigns an IPv6 prefix to a subnet when it connects to the external provider network [^pd].
@@ -107,7 +107,7 @@ So, rather than trying to find common ground between the networking requirements
107
107
108
108
#### IPv6
109
109
110
-
The OpenStack Network API allows the creation of subnets with either IPv4 or IPv6 address ranges, as indicated by the `ip_version` field.
110
+
The OpenStack Networking API allows the creation of subnets with either IPv4 or IPv6 address ranges, as indicated by the `ip_version` field.
111
111
However, to allow external access to either, the CSP needs to provide projects with externally routable addresses for that IP version.
112
112
113
113
While it is possible (and common) for CSPs to provide both IPv4 and IPv6, the increasing scarcity (and cost) of IPv4 address space may at some point become a barrier to entry for new CSPs.
@@ -172,7 +172,7 @@ CSPs can try to educate users on the correct provider networks to use, and can a
172
172
173
173
#### Required API extensions
174
174
175
-
The OpenStack Network API has a more modular design than other OpenStack APIs.
175
+
The OpenStack Networking API has a more modular design than other OpenStack APIs.
176
176
New features are added as optional API extensions rather than a linear sequence of micro-version, and different Neutron core-plugins, service plugins, and mechanism drivers may provide different extensions.
177
177
178
178
In practice, the great majority of OpenStack deployments will use Neutron with the ML2 core plugin and either the `router` or the `ovn-router` service plugins, which should cover all requirements of this standard.
0 commit comments