[Starlingx-discuss] Questions about StarlingX OVS-DPDK firewall driver enhancement

[Qin, Kailun]

Hi Matt,

We are doing some ground work for https://storyboard.openstack.org/#!/story/2002944 regarding the StarlingX OVS-DPDK firewall driver enhancement. To better understand the requirement, we may need your help on the following question.

There are 3 security group implementations in neutron OVS-DPDK agent.

  1.  Iptables based security group
The OVS agent and Compute service use a Linux bridge between each instance (VM) and the OVS integration bridge br-int to implement security groups. This implementation is stateful but
cause scalability and performance problems.
  2.  Openflow based security group
This implementation is stateless and based in OpenFlow 'learn action', which uses a firewall driver in networking-ovs-dpdk project.
https://github.com/openstack/networking-ovs-dpdk/blob/master/networking_ovs_dpdk/agent/ovs_dpdk_firewall.py
  3.  Openflow + conntrack based security group
This implementation is stateful, which uses a native firewall driver.
https://docs.openstack.org/newton/networking-guide/config-ovsfwdriver.html
http://docs.openvswitch.org/en/latest/tutorials/ovs-conntrack/

The requirement from the enhancement description is that we're going to adopt implementation option 2 for StarlingX OVS-DPDK security group.
Compared with option 3 which is stateful and uses a native firewall driver, what is our consideration on taking option 2 as our target?

Please kindly see the attached doc for further details. Just let me know if anything unclear. Thanks a lot!

BR,
Kailun

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20180906/1ea7100f/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Neutron OVSDPDK + Security Group.pdf
Type: application/pdf
Size: 47866 bytes
Desc: Neutron OVSDPDK + Security Group.pdf
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20180906/1ea7100f/attachment-0001.pdf>