Ways to introduce secure multi-tenancy to VMware/vCenter clusters via open sourc

色粉盒撒娇

　　http://www.opencontrail.org/integrating-opencontrail-with-vcenteresxi-virtualization-platform/
　　

Note: This blog is co-authored by Sachchidanand Vaidya and AniketDaptari from Juniper Networks.
Introduction
This document describes the different options to integrate OpenContrail with vCenter/ESXi virtualization platform. Further, it also describes the OpenContrail + vCenter integration in detail.
The following section describes four alternatives to integrate OpenContrail with vCenter/ESXi.
Option 1
This option provides ESXi as a supported hypervisor under OpenStack. For those users who have certified ESXi workloads, don’t want to pay for vCenter licenses and want to work with open systems, Option 1 provides a migration path to OpenStack with OpenContrailproviding the full-featured cloud solution. OpenContrail will support the ESXi nova driver for this option.

Figure 1 ESXi as Compute with OpenContrail
Jakub Pavlik from tcpCloud performed some tests using this option and has blogged his experience here.
Option 2
OpenContrail provides an open network virtualization solution in avCenter only environment. More details about this option are described in later sectionsof the document. This Option also allows customers to federate the vCenter Cluster with an OpenStack cloud to facilitate “Cap and Grow”.

Figure 2 OpenContrail and vCenter only Integration
Option 3
Under this option, the vCenter cluster is represented as a compute node under OpenStack. This way, OpenStack can be used to orchestrate workloads for both KVM and ESXi hypervisors. The workloads on ESXi hosts will be scheduled by vCenter.

Figure 3 vCenter as a compute with OpenContrail
Option 4
Under this option, customers can continue to use their existing VMware deployments using VDS VLANs and connect them to the growing OpenStack clouds. OpenContrail will contrail OVSDB enabled ToR switches which will perform translation of VLANs in VMware clustersto VXLAN tunnels in OpenStack clouds and vice versa.

Figure 4 vCenter and OpenStack with OpenContrail
OpenContrail and vCenter Integration (Option 2)
OpenContrail system consists of two main components:OpenContrail Controller andOpenContrail vRouter.The OpenContrail Controller is a logically centralized but physically distributed controller responsible for providing the configuration, control, and analytics functions of the virtualized network. The OpenContrail vRouter implements the distributed forwardingplane.
Three main components involved in an OpenContrail + vCenter solution are:

• OpenContrail Controller
  
• OpenContrail vRouter VM
  
• vCenter Server
  

Figure 5 Detailed View (OpenContrail + vCenter Integration)
OpenContrailController (OpenContrail vCenter Plugin)
The OpenContrail vCenter Plugin performs two main functions:

• When a Port Group is created using vCenter and it is associated with an IP-pool, the vCenter plugin creates corresponding virtual-network on OpenContrail Controller. When a Virtual Machine is spawned using vCenter with the VM’s network adapter in a PortGroup,the plugin creates corresponding Virtual Machine object and VM interface object on OpenContrail. This is analogous to the OpenContrail Neutron plugin in OpenStack clouds.
  
• The plugin also informs the vRouter agent about the VM interface AddPort event. The vRouter agent pulls the relevant routing table information from the OpenContrail Control node in response to the AddPort event. This is analogous to the nova vif driver in OpenStackclouds. Finally, the agent can respond to the DHCP requests from the tenant VMs and the vRouter can perform L3/L2 functions.
  

Thus, the plugin communicates with three entities – vCenter Server, OpenContrail API Server, and the vRouter agent.
OpenContrail vRouter VM
OpenContrail vRouter VM has the vRouter kernel module, which implements the distributed forwarding plane. As shown in the Figure 5, the OpenContrail vRouter VM has two interfaces. One interface is part of the Fabric PortGroup (PG) and serves as the interfacetowards the IP Fabric. The other interface is part of the Trunk PG (on the vDS). The Trunk PG sees tenant traffic from all PGs.
In the VMware vCenter environment, the OpenContrail vRouter VM will be present on every ESXi host.
Features:
The following table lists the mapping between vCenter and OpenContrail entities.
vCenterOpenContrailPort Group (PG)Virtual NetworkIP Pool & RangeSubnet & Allocation PoolIntegrating OpenContrail with a VMware cluster brings an open source implementation of fully distributed network policy, DHCP and DNS, floating IP, security groups and service chaining to the VMware cluster.
Thus, a VMware cluster gets transformed into an open, full featured, secure, multi-tenant cloud solution.
This YouTubevideo contains a demonstration of the integrated solution.
References

• https://techwiki.juniper.net/Documentation/Contrail/Contrail_Controller_Getting_Started_Guide/202Installation/Configuring_Contrail_on_VMware_ESXi
  
• http://www.vmware.com/files/pdf/virtual_networking_concepts.pdf
  
• http://www.vmware.com/files/pdf/techpaper/vsphere-distributed-switch-best-practices.pdf
  
• https://pubs.vmware.com/vsphere-50/topic/com.vmware.ICbase/PDF/vsphere-esxi-vcenter-server-50-basics-guide.pdf
  
• http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1010691
  
• http://pubs.vmware.com/vsphere-51/topic/com.vmware.vsphere.networking.doc/GUID-A9287D46-FDE0-4D64-9348-3905FEAC7FAE.html