Ways to introduce secure multi-tenancy to VMware/vCenter clusters via open source network virtualization.

Note: This blog is co-authored by Sachchidanand Vaidya and Aniket Daptari from Juniper Networks.

Introduction

This document describes the different options to integrate OpenContrail with vCenter/ESXi virtualization platform. Further, it also describes the OpenContrail + vCenter integration in detail.

The following section describes four alternatives to integrate OpenContrail with vCenter/ESXi.

Option 1

This option provides ESXi as a supported hypervisor under OpenStack. For those users who have certified ESXi workloads, don’t want to pay for vCenter licenses and want to work with open systems, Option 1 provides a migration path to OpenStack with OpenContrail providing the full-featured cloud solution. OpenContrail will support the ESXi nova driver for this option.

vCenter_blog_image1

Figure 1 ESXi as Compute with OpenContrail

Jakub Pavlik from tcpCloud performed some tests using this option and has blogged his experience here.

Option 2

OpenContrail provides an open network virtualization solution in a vCenter only environment. More details about this option are described in later sections of the document. This Option also allows customers to federate the vCenter Cluster with an OpenStack cloud to facilitate “Cap and Grow”.

vCenter_blog_image2

Figure 2 OpenContrail and vCenter only Integration

Option 3

Under this option, the vCenter cluster is represented as a compute node under OpenStack. This way, OpenStack can be used to orchestrate workloads for both KVM and ESXi hypervisors. The workloads on ESXi hosts will be scheduled by vCenter.

vCenter_blog_image3

Figure 3 vCenter as a compute with OpenContrail

Option 4

Under this option, customers can continue to use their existing VMware deployments using VDS VLANs and connect them to the growing OpenStack clouds. OpenContrail will contrail OVSDB enabled ToR switches which will perform translation of VLANs in VMware clusters to VXLAN tunnels in OpenStack clouds and vice versa.

vCenter_blog_image4

Figure 4 vCenter and OpenStack with OpenContrail

OpenContrail and vCenter Integration (Option 2)

OpenContrail system consists of two main components: OpenContrail Controller and OpenContrail vRouter. The OpenContrail Controller is a logically centralized but physically distributed controller responsible for providing the configuration, control, and analytics functions of the virtualized network. The OpenContrail vRouter implements the distributed forwarding plane.

Three main components involved in an OpenContrail + vCenter solution are:

OpenContrail Controller
OpenContrail vRouter VM
vCenter Server

vCenter_blog_image5

Figure 5 Detailed View (OpenContrail + vCenter Integration)

OpenContrail Controller (OpenContrail vCenter Plugin)

The OpenContrail vCenter Plugin performs two main functions:

When a Port Group is created using vCenter and it is associated with an IP-pool, the vCenter plugin creates corresponding virtual-network on OpenContrail Controller. When a Virtual Machine is spawned using vCenter with the VM’s network adapter in a PortGroup, the plugin creates corresponding Virtual Machine object and VM interface object on OpenContrail. This is analogous to the OpenContrail Neutron plugin in OpenStack clouds.
The plugin also informs the vRouter agent about the VM interface AddPort event. The vRouter agent pulls the relevant routing table information from the OpenContrail Control node in response to the AddPort event. This is analogous to the nova vif driver in OpenStack clouds. Finally, the agent can respond to the DHCP requests from the tenant VMs and the vRouter can perform L3/L2 functions.

Thus, the plugin communicates with three entities – vCenter Server, OpenContrail API Server, and the vRouter agent.

OpenContrail vRouter VM

OpenContrail vRouter VM has the vRouter kernel module, which implements the distributed forwarding plane. As shown in the Figure 5, the OpenContrail vRouter VM has two interfaces. One interface is part of the Fabric PortGroup (PG) and serves as the interface towards the IP Fabric. The other interface is part of the Trunk PG (on the vDS). The Trunk PG sees tenant traffic from all PGs.

In the VMware vCenter environment, the OpenContrail vRouter VM will be present on every ESXi host.

Features:

The following table lists the mapping between vCenter and OpenContrail entities.

vCenter	OpenContrail
Port Group (PG)	Virtual Network
IP Pool & Range	Subnet & Allocation Pool

Integrating OpenContrail with a VMware cluster brings an open source implementation of fully distributed network policy, DHCP and DNS, floating IP, security groups and service chaining to the VMware cluster.

Thus, a VMware cluster gets transformed into an open, full featured, secure, multi-tenant cloud solution.

This YouTube video contains a demonstration of the integrated solution.