Guru Shetty has been working at VMware, and before that at Nicira, since

about 2011. Guru has done a lot of work to integrate Open vSwitch with

various platforms. This episode is a conversation with Guru primarily

about integrating Open vSwitch and OVN with multiple container systems,

including Docker and Kubernetes.

Guru begins by reiterating the rationale for containers from an

application developer point of view: to capture and encapsulate

dependencies into usable pieces and thereby make the software easier to

consume. This is not so different from a VM, conceptually, but

containers have some advantages in terms of size and life-cycle

management. Microservices, on the other hand, are a way of building an

application from many independently deployed and upgradeable components

that interact through well-defined APIs. The components, which are the

microservices themselves, could be housed on physical machines or in VMs

but are usually in containers.

To introduce the topic of how Open vSwitch integrates with container

systems, Guru begins by describing how Open vSwitch integrates with any

kind of virtualization. This is divided into three parts. First, the

virtualization system must attach its virtual interfaces to Open vSwitch.

This is usually simple: for a system that already integrates with the

Linux bridge, for example, it might entail calling into the OVS

ovs-vsctl program instead of the bridge's

brctl. Second, the virtualization system needs to provide

some metadata to allow a network controller to identify the relationship

between VIFs and VMs. These first two pieces do not differ much between

VM and container virtualization.

The third part of integrating a virtualization system with Open vSwitch

is a matter of matching up the virtualization system's networking

concepts with those understood by the network controller. OpenStack, for

example, has switch and router concepts and supports various ways to

connect virtual networks to external physical ones. Container systems,

though, generally have much simpler ideas of how to interact with

networks, perhaps because they are designed by and for application

developers who have little interest in operating a network as opposed to

simply using one. This makes container systems harder to integrate with

featureful virtual networking systems such as OVN, since they simply lack

many of the concepts. Guru makes the counterpoint, though, that

OpenStack and similar ask application developers to work with a lot of

low-level concepts that really have no direct importance to them.

Rather, networking should “just work.”

OVS integration with Docker evolved through a few steps. The first step

was a form of integration without assistance from Docker itself, through

an external wrapper that built a network namespace and configured Docker

to use it through a veth pair. This was not ideal, so

Guru proposed a native integration framework for Docker. At the same

time, there were about a dozen startups and companies all trying to do

something similar, which led to a lot of fighting over the approach.

Eventually Docker elected to provide a pluggable architecture, although

its form is still unsatisfactory for many purposes and thus a number of

vendors continue to use a “side-band” or wrapper approach. A form of

the latter has been standardized as CNI, which is what

Kubernetes and CoreOS and Mesos use.

Guru has also implemented integration between Open vSwitch and

Kubernetes, the wildly popular container orchestration system from

Google. It approaches networking problems from an application deployer's

perspective. For example, an application developer does not care about

IP addresses, so Kubernetes hides those details, instead exposing

services through higher-level names that are more meaningful to the

developers. Kubernetes also exposes every application through a load

balancer that allows the application to scale by increasing or decreasing

the number of containers behind the load balancer, in a manner hidden

from the application's clients. Guru implemented Kubernetes load

balancing support for OVN through the NAT feature added to recent

versions of Open vSwitch.

The OVN support for Kubernetes is implemented in a repository separate

from the main Open vSwitch repository, which is unusual for OVN and Open

vSwitch. This was done because Kubernetes changes much faster than Open

vSwitch, so that OVN-Kubernetes integration needs to change much more

quickly too.

One possibility for the future of the OVN-Kubernetes integration is to

take advantage of the Open vSwitch support for DPDK to build a very fast

north-south gateway for Kubernetes.

Guru talks briefly about the possibilities for Open vSwitch integration

with Mesos, Pivotal Cloud Foundry, and Rocket.

Guru talks about how OVN might be a useful component for service function

chaining in container environments, where its general concept of network

virtualization gives a lot of value versus ad hoc techniques.

Sometimes containers are portrayed as having, compared to VMs, huge

numbers per host and high rates of change. Guru has not seen this in

practice. While containers are shorter-lived than VMs, the scale is not

much higher.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

featuring cdk and DarrylJ, copyright 2013, 2016 by Alex. The bumper music is

Yeah Ant

featuring Wired Ant and Javolenus, copyright 2013 by Speck. The outro

music is Space

Bazooka featuring Doxen Zsigmond, copyright 2013 by Kirkoid. All content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.