OVS Orbit by Ben Pfaff

June 11, 2017 OVN Support for Multiple Gateways and IPv6, with Russell Bryant and Numan Siddique from Red Hat

Russell Bryant is a Senior Principal Software Engineer at Red Hat, Inc.

He was on the OpenStack Technical Committee from Fall 2012 until Fall

2016 and was elected to serve on the OpenStack Foundation Board of

Directors in 2015, 2016, and 2017. Russell has been contributing to the

development of OpenStack since the Fall of 2011. His most significant

contributions around OpenStack have been to Nova and most recently

Neutron and OVN. Russell is also a project committer for Open vSwitch

(OVS) and OVN.

Numan Siddique is a developer at Red Hat, Bangalore. He has around 12

years of software development experience. He has been involved with

OpenStack since Ice house release. He works mainly on OVN and

networking-ovn. Prior to OVN, he was contributing to OpenContrail SDN

controller.

This episode is a talk that Russell and Numan gave at OpenStack Boston

during the Open vSwitch Open Source Day on May 10, with the following

abstract:

OVN supports multiple gateways on a network with traffic spread across

them. Russell Bryant will cover the different gateway and NAT modes

supported by OVN and how OpenStack can take advantage of multiple

gateway support.

OVN supports IPv6. Numan Siddique will cover the details of this

support, the present status of the IPv6 features supported and a list

of missing IPv6 features if any and a demo showing the supported IPv6

features by OVN.

Slides for this talk are available in PDF

format. Some parts of the talk will be easier to follow while looking at

the slides.

Toward the end of the questions, Russell refers to the talk OpenStack

and OVN: What's New with OVS 2.7, given by Russell Bryant, Ben Pfaff,

and Justin Pettit at OpenStack Summit Boston.

Russell previously appeared in episode 18, on the

launch of OVN, and episode 7 was based on a talk that

he co-presented. Russell also made multiple presentations at Open vSwitch 2015 Fall

Conference.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

30 min

June 11, 2017 OpenStack Performance with OVS-DPDK for NFV and Connection Tracking, with Sugesh Chandran and Bhanuprakash Bodireddy from Intel

Sugesh Chandran is a network software engineer with Intel. His work is

primarily focused on accelerated software switching solutions in user

space running on Intel architecture. His contributions to Open vSwitch

with DPDK include tunneling acceleration and enabling hardware

acceleration. Before joining Intel, he has been involved in developing

features for Cisco and Procurve switching products.

Bhanuprakash is a software engineer at Intel Corporation focusing on

virtual switching solutions. Before joining Intel, he has been involved

in building telecom solutions for Asian mobile operators and had

significant contributions towards fast-path optimization in vEPC. He

also worked on building reliable fronthaul solution at a startup that

built vRAN using Ethernet fronthaul. He is also passionate about FOSS

and has actively contributed to FreeBSD MIPS and OVS.

This episode is a talk that Sugesh and Bhanuprakash gave at OpenStack

Boston during the Open vSwitch Open Source Day on May 10, with the

following abstract:

This talk analyzes the performance of OVS-DPDK in two situations

relevant to OpenStack.

First, the speakers will analyze the performance of the OVS-DPDK

connection tracker, which plays a critical role in protecting tenants

and application workloads from network-based attacks. They will demo

and wal kthrough their findings with different test topologies that

includes multiple VMs, bridges with thousands of connections. They

will showcase Vtune results for specific bottlenecks and discuss

mitigation strategies.

Second, the speakers will analyze the performance of OVS-DPDK for

Network Function Virtualization (NFV). This part of the talk will

describe a few real world deployment with OVS-DPDK and walk through

various scenarios. This includes latency details, scalability, NUMA

node aware allocation, classifier bottleneck, noisy neighbor and

hardware acceleration features.

Slides for this talk are available in PDF

format. Some parts of the talk will be easier to follow while looking at

the slides.

Bhanuprakash previously presented two talks related to OVS-DPDK at Open vSwitch 2016 Fall

Conference.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

51 min

May 20, 2017 Lightning Talks, with Joe Stringer from VMware and Yusuke Tatsumi from Yahoo! JAPAN

This episode is a series of 3 lightning talks given at OpenStack Boston

during the Open vSwitch Open Source Day on May 10.

The first speaker is Joe Stringer, a developer at VMware who works on

Open vSwitch. The title of his talk, which starts at 1:03, is

“Deploying an OVS-based feature switch in 5 minutes or less.” It

consists of a demo showing how to quickly deploy the Faucet open source

OpenFlow controller as a drop-in replacement for a network switch. This

talk did not include slides, but you can watch a video recording of a

similar demo on youtube. For more

coverage of Faucet, see episode 19 or Shivaram

Mysore's talk at the Open vSwitch 2016 Fall

Conference.

The second speaker is Yusuke Tatsumi, a network infrastructure engineer

at Yahoo! JAPAN, with “Continuous Integration for IaaS,” about a

continuous integration tool chain for Open vSwitch with DPDK. This talk

begins at 4:54. Slides

are available.

The third speaker is also Joe Stringer, presenting “Cyber RFP!” about

the strategy that the Faucet open source OpenFlow controller uses to

validate a switch's OpenFlow support using a comprehensive, easy-to-use

testsuite. This talk begins at 10:53. Slides

are available.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

17 min

May 15, 2017 Deploying OVN on Windows with OpenStack and Kubernetes, with Alessandro Pilotti and Alin Balutoiu from Cloudbase Solutions

Alessandro is CTO of Cloudbase Solutions, a company focused on cloud

computing interoperability and the main contributor of all the OpenStack

Windows and Hyper-V components in Nova, Neutron, Cinder, Ceilometer and

Heat since the Folsom release. Alin is a developer at Cloudbase who

describes himself as an Open Source enthusiast and a passionate Python

developer at heart.

Slides for this talk are available in PDF

format.

This episode is a talk that Alessandro and Alin gave at OpenStack Boston

during the Open vSwitch Open Source Day on May 10, with the following

abstract:

Current Windows datapath development aids users and simplifies

networking deployments. One of the improvements brings Linux Bridges

(OVS bridges) mentality under Windows. Recent development also allows

for OVN to work together with the Windows datapath. This session will

cover how it can be achieved on Windows under Hyper-V as well. Among

other topics, we will cover how to set up OVN using DevStack and add a

Windows node and how to debug Windows-specific problems, with a demo.

In addition, one of the recent and interesting integration of OVN is

Kubernetes. This helps users to deploy containers over both public and

private clouds. Cloudbase Solutions recently added a PoC (proof of

concept) integration for Windows. This allows Windows workloads to be

deployed under the same cluster. We will emphasize on the advantages

that can be achieved using this type of approach. We will explain how

to set up an environment including a Windows node and play a

prerecorded demo.

The demos may be of less interest than the rest of the talk because no

video is available. If you want to skip over them, they run from 8:27 to

13:06 and from 20:56 to 28:03.

Alessandro previously appeared on OVS Orbit way back in Episode 1: Porting OVS to Hyper-V.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

31 min

May 13, 2017 NetBricks: Taking the V out of NFV, with A. Panda from Berkeley

Panda is a PhD candidate in the computer science department at the

University of California, Berkeley. In this episode, we discuss the

paper “NetBricks:

Taking the V out of NFV,” by Panda, Sangjin Han, Keon Jang, Melvin

Walls, Sylvia Ratnasamy, and Scott Shenker, which was published in OSDI 2016. The

abstract for the paper is:

The move from hardware middleboxes to software network functions, as

advocated by NFV, has proven more challenging than expected. Developing

new NFs remains a tedious process, requiring that developers repeatedly

rediscover and reapply the same set of optimizations, while current

techniques for providing isolation between NFs (using VMs or containers)

incur high performance overheads. In this paper we describe NetBricks, a

new NFV framework that tackles both these problems. For building NFs we

take inspiration from modern data analytics frameworks (e.g., Spark and

Dryad) and build a small set of customizable network processing

elements. We also embrace type checking and safe runtimes to provide

isolation in software, rather than rely on hardware isolation. NetBricks

provides the same memory isolation as containers and VMs, without

incurring the same performance penalties. To improve I/O efficiency, we

introduce a novel technique called zero-copy software isolation.

One of my favorite quotes from the discussion is the following:

The fewer lines of code you have to reason about, the easier it is.

That's the lesson that, I would guess, if you're a developer, to take

away. Don't think of isolation as this thing you do for security.

That's one use case, it's not even a very good use case because everyone

seems to violate isolation all the time: there's ten bugs on any given

day for hypervisors breaking out of their isolation boundary.

For earlier discussion of NFV, refer back to Episode 2:

OPNFV and OVS, with Dave Neary from Red Hat or Episode

10: SoftFlow, with Ethan Jackson from Berkeley.

For more information on NetBricks, visit netbricks.io. You can also contact Panda

via email or Twitter.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

46 min

May 01, 2017 NEAt: Network Error Auto-Correct, with Bingzhe Liu

Bingzhe Liu is a first-year PhD student at University of Illinois at

Urbana-Champaign. In this episode, we discuss the paper “NEAt:

Network Error Auto-Correct,” by Wenxuan Zhou, Jason Croft, Bingzhe

Liu, and Matthew Caesar, which Bingzhe presented on April 4 at SOSR,

the Symposium on SDN Research. The abstract for this paper is:

Configuring and maintaining an enterprise network is a challenging and

error-prone process. Administrators must often consider security

policies from a variety of sources simultaneously, including regulatory

requirements, industry standards, and to mitigate attack vectors.

Erroneous implementation of a policy, however, can result in costly

data breaches and intrusions. Relying on humans to discover and

troubleshoot violations is slow and prone to error, considering the

speed at which new attack vectors propagate and the increasing network

dynamics, partly an effect of SDN. To ensure the network is always in a

state consistent with the desired policies, administrators need

frameworks to automatically diagnose and repair violations in

real-time.

To address this problem, we present NEAt, a system analogous to a

smartphone’s autocorrect feature that enables on-the-fly repair to

policy-violating updates. NEAt modifies the forwarding behavior of

updates to automatically repair violations of properties such as

reachability, service chaining, and segmentation. NEAt sits between an

SDN controller and the forwarding devices, and intercepts updates

proposed by SDN applications. If an update violates the policy defined

by an administrator, such as reachability or segmentation, NEAt

transforms the update into one that complies with the policy. Unlike

domain-specific languages or synthesis platforms, NEAt allows

enterprise networks to leverage the advanced functionality of SDN

applications while simultaneously achieving strong, automated

enforcement of general policies.

The paper has contact information for its authors.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

22 min

April 07, 2017 DevPulseCon, with Rupa Dachere from VMware

This episode's guest is Rupa Dachere, an engineer at VMware and the

executive director and founder of CodeChix, a 501(c)3 charity dedicated to

education, advocacy and mentoring of women engineers in industry and

academia. Rupa founded CodeChix because she found that, regardless of

where she worked in the computer industry, she was the only woman on the

team, which led to difficulties in advancing and keeping up with

technologies that continue to pop up. The organization started out with

small group meetings at Rupa's house, grew slowly through meetups and

regular meetings, and now boasts over 400 women engineers as members.

The topic of this episode is primarily DevPulseCon, a two-day

technical and educational micro-conference focused on women engineers,

developers, users, administrators and geeks working in industry and

academia. The conference began in 2015 as Coder[xx] with about 100

attendees, grew to about 120 in 2016, and this year's edition has already

sold over 200 tickets. DevPulseCon takes place April 20 and 21, at the

Computer History Museum in

Mountain View. It is sold out, except for a number of tickets reserved

for students, who may use discount code STUDENT-FREE to register

for free tickets.

DevPulseCon has three components: technical talks, panel discussions, and

hands-on workshops. The full agenda for

DevPulseCon is already posted. For those unable to attend in person, the

technical talks and possibly some of the panels will be recorded and made

available through the DevPulseCon and CodeChix YouTube channels,

alongside the videos that are already available from 2015 and 2016.

This year DevPulseCon features three panel discussions, which are

popular, interactive parts of the conference that tend to run over their

time budgets because the audience doesn't want to stop talking. Rupa is

moderating a panel on toxic environments, which tend to affect women more

strongly than men, for reasons that are not well established. To

encourage participation, the panels are “safe space panels,” meaning

that social media use is banned during the panels and attendees are

encouraged to forget who says what.

Rupa gives some advice on interviewing women for engineering roles. Some

of it I had heard before in unconscious bias training, but some of it was

new to me and easy to act on:

With women, you do a little extra background, reading up on what their

interests are, what drives them, and then phrase your question along

those lines, maybe have a few outlier questions if you think they'll be

able to answer it impromptu, and go that way. Most women like to have a

scripted set of questions, to make them feel comfortable when they're

going into an interview, so they know what to prep for essentially.

Rupa says that CodeChix's primary goal is not recruiting of women to

engineering roles but retention in engineering roles:

Recruiting becomes a secondary [goal]... but retention is and always

has been the focus for CodeChix and that is mainly because of the way I

feel about it. I've been in the industry, I've been on the technical

ladder and actually I've fought to stay on the technical ladder. Most

places they will try to push you into program management, project

management, some sort of management track, and you really have to fight

to stay on the technical ladder...

Now that I have CodeChix, I know that I'm not the only one. That has

always been and still is the number one goal of CodeChix, to retain the

women engineers who are on the technical ladder, keep them on the

technical ladder. In fact, this year I am going to go ahead and say

that I have invited program managers and product managers to the

conference—and these are all people with CS degrees and EE degrees,

that are very qualified—I want to bring them back into the technical

ladder, out of their program management and product management tracks,

and see if I can do that...

I personally feel that it is really a horrible thing if you try to push

somebody who is a good engineer out of the technical track into

something else that, maybe they might be good at it, maybe they're not

good at it, I don't know... I don't want to waste them because it's so

difficult to find good engineers... Also, I'm tired of being the only

female on the team again.

Ben tells a funny anecdote from the beginning of Nicira, but you'll have

to listen to hear it.

DevPulseCon and CodeChix are available through their websites and all

your favorite social media channels. You may also get in touch with them

through email at [email protected] or [email protected].

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

35 min

March 31, 2017 OVSDB Configuration for Hardware VTEPs, with Chandra Appanna from Arista and Bruce Davie from VMware

This episode's guests are Bruce Davie, a vice president CTO for APJ at

VMware, and Chandra Appanna, an engineer and manager at Arista, who are

two of the designers of the Open vSwitch database schema that can be used

to control VXLAN forwarding in top-of-rack switches, often called the

OVSDB VTEP schema.

The discussion in this episode is related to “A

Database Approach to SDN Control Plane Design,” by Bruce Davie and

several others, published in the January 2017 issue of SIGCOMM Computer Communications

Review, with the following abstract:

Software-defined networking (SDN) is a well-known example of a research

idea that has been reduced to practice in numerous settings. Network

virtualization has been successfully developed commercially using SDN

techniques. This paper describes our experience in developing

production-ready, multi-vendor implementations of a complex network

virtualization system. Having struggled with a traditional network

protocol approach (based on OpenFlow) to achieving interoperability among

vendors, we adopted a new approach. We focused first on defining the

control information content and then used a generic database protocol to

synchronize state between the elements. Within less than nine months of

starting the design, we had achieved basic interoperability between our

network virtualization controller and the hardware switches of six

vendors. This was a qualitative improvement on our decidedly mixed

experience using OpenFlow. We found a number of benefits to the database

approach, such as speed of implementation, greater hardware diversity,

the ability to abstract away implementation details of the hardware,

clarified state consistency model, and extensibility of the overall

system.

One of the main points in the discussion is why it makes sense to focus

on a database schema, rather than on a protocol, as a way of controlling

a network switch, and what it means to use a database to control a

network. As Bruce Davie says:

I think there was a little bit of, “Well, here's a tool that's lying in

our toolkit, let's try to use it,” but it was also because we spent so

much time thinking about the information model. We realized, like many

problems in networking, this really is a state synchronization problem,

and that's kind of what database protocols do, so let's see if the one

we've got can be made to work.

Some of the points touched on during the discussion include:

History of the VTEP schema.

The relationship of the meaning of “virtualization” in the terms VLAN

and VXLAN and VPN, to its meaning in compute and network

virtualization.

Why use OVSDB VTEP instead of something more general, such as OpenFlow,

to control physical switch hardware?

Will networking hardware become generally programmable in the future?

Similarities of philosophical underpinnings for OVSDB and Arista OS.

Potential alternatives, if the OVSDB approach had not been taken (BGP?

Ad-hoc scripts?) and existing competitors.

State synchronization as the fundamental value of OVSDB.

Should databases be used more frequently as a way to implement

networking?

The process used for developing the OVSDB VTEP schema, compared to

the process used for developing IETF specifications. Chandra's

viewpoint is worth quoting:

To me this felt more familiar, in terms of, this is how the IETF has

always tried to do things, “working code and rough consensus,” and

that's what happened in this case, right? It solved a real problem,

there were enough vendors interested in it. Nicira/VMware kind of

spearheaded it, but they built something that others wanted to

participate in, and of course we all gave in a lot of inputs. The

model definitely does make a lot of sense to the hardware vendors,

and that's why it succeeded. We built things in stages, we didn't

try to make a perfect solution on day 1, and we actually built

working code... I don't find it a severe contrast to how the IETF

still wants to do stuff, but, yeah, sometimes it doesn't happen like

that.

Uses of the OVSDB VTEP schema beyond those originally envisioned by

VMware.

Performance and scale in practice.

Future directions for the OVSDB VTEP schema (security?

microsegmentation?) and the ease of extending its capabilities.

You can contact Chandra via email at [email protected] and Bruce via

Twitter as @_drbruced.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

51 min

March 16, 2017 DragonFlow, with Omer Anson from Huawei

Omer Anson is a software developer at Huawei. I caught up with him at

OpenStack Barcelona back in October to talk about the Dragonflow project,

which is a distributed SDN controller for OpenStack Neutron that supports

logical switching and routing and more advanced features.

According to Omer, Dragonflow distinguishes itself from other Neutron

drivers by aiming at scale. It intends to scale to thousands or even

tens of thousands of compute nodes (hypervisors). It also focuses on

scale testing, testing in simulation with 4,000 nodes with very good

results, showing a slowdown of only about 5% between 30 nodes and 4,000

nodes for control plane operations such as creating subnets or ports.

Dragonflow features include fully distributed DHCP and ARP responders.

The latter feature reduces the amount of broadcast traffic within a

cloud. Dragonflow can integrate physical devices and even remote clouds

into a logical network through its “remote device” functionality.

The Dragonflow implementation currently builds on top of OpenFlow with

Nicira extensions (as implemented by Open vSwitch). The developers are

also considering adding support for BPF or P4 datapaths.

The Dragonflow design emphasizes pluggability:

My vision is—our vision is—that everything—every Neutron API that

exists—will be written as a Dragonflow application. Currently,

Dragonflow itself does very little to nothing with creating flows and

instructing the policy of how packets move. Everything is done through

applications. We have an L2 application which detects the MAC addresses

and knows how to direct them to the correct ports, we have an L3

application... that knows to detect when packets are supposed to reach

the router and have the layer-2 addresses replaced...

DragonFlow supports, for example, running on top of any of several

database systems. The diversity among those databases is vast, which

gives users great freedom to choose one that is well suited for their own

needs.

Dragonflow has multiple implementations of L3. One of these populates

flows proactively into Open vSwitch, that is, it adds flows without

waiting for packets to arrive at the controller. The other uses some

proactive population along with reactive population, that is, adding

flows in response to packet arrival. Omer explains the rationale for the

two implementations and how they work.

A new feature of Dragonflow is that it is now implemented as an “ML2

mechanism driver” rather than a Neutron core plugin. This allows it to

better coexist with other Neutron drivers within a single deployment.

Omer mentions some upcoming development work, such as a better, more

user-oriented deployment mechanism and integration with additional

projects such as Ansible, the

OpenStack Kolla

project, OpenStack Puppet,

and more. Service function chaining support is also in the works.

The Dragonflow project is seeking new contributors. You can find the

developers in the #openstack-dragonflow channel in the Freenode IRC network. Omer's nick

on Freenode is "oanson".

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

30 min

March 02, 2017 The Evolution of OpenFlow, with Jean Tourrilhes from HPE Labs and Justin Pettit from VMware

Jean Tourrilhes is a networking researcher at HPE Labs who served as the

chair of the Open Networking Foundation's OpenFlow standardization

working group (the “extensibility” working group) from its inception

until 2015. Justin Pettit, who was a founding employee at Nicira and who

has continued to work at VMware since it acquired Nicira in 2012, was

co-chair of the working group during the same period.

Justin and Jean are two of the authors of “SDN

and Standards Evolution: a Standards Perspective,” a paper published

in IEEE Computer in Nov. 2014. This paper gives a lot of the facts

behind the OpenFlow's evolution, but it doesn't talk at all about what

worked well and what didn't in the standardization process. This

discussion tries to cover that part of the story, with the goal of

helping listeners to understand how they might better approach any future

standardization processes in the future.

Some of the topics covered include:

Tension between advocates for hardware and software switch

implementations.

The debates behind multiple table support.

Capabilities aka “table features” aka “table type pattern” support.

Will increasing flexibility in hardware enable better OpenFlow-like

functionality in the future? At what cost?

Naivete regarding OpenFlow influence over hardware.

Secretiveness of hardware vendors and the OpenFlow hardware vendor

working group.

The requirement for prototyping new features added to OpenFlow, along

with pluses and minuses for the requirement.

Different categories of switches, beyond “hardware” and “software”

classification.

Interactions with testing and interoperability working group, and

difficulties with NDAs on testing results.

Lack of OpenFlow reference implementation and Open vSwitch de facto in

that role.

Increased power of the working group chair, compared to the IETF.

What is the future of OpenFlow? Is it dying? Or just entrenched?

What's a likely successor to OpenFlow? P4? eBPF?

You can contact Jean via email as [email protected] and Justin either via

email as [email protected] or on

Twitter as @Justin_D_Pettit.

OVS Orbit is produced by Ben Pfaff. The

intro music in this episode is Drive,

music is Yeah Ant

music is Space

content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

54 min

Share OVS Orbit

Sign up to save your podcasts

OVS Orbit

OVS Orbit episodes

About OVS Orbit