OVS Orbit by Ben Pfaff

May 26, 2016 nlog, with Teemu Koponen from Styra and Yusheng Wang from VMware

Interview with Teemu Koponen of Styra

and Yusheng Wang of VMware, about

the nlog language.

nlog, in this context, is unrelated to the logging platform for .NET. It

is a database language, a simplified form of Datalog that lacks

recursion and negation. Teemu designed this language for use in Nicira

NVP, the forerunner of VMware

NSX-MH. Yusheng is now working to implement nlog in OVN.

Teemu and Yusheng begin by describing the nlog language, its name (the

“N” stands for “Nicira.”), and its purpose and contrast it with more

commonly known languages such as SQL. An nlog (or Datalog) program

consists of a series of queries against input table that produce new

tables, which can be reused in subsequent queries to eventually produce

output tables.

In a network virtualization system such as NVP or OVN, input tables

contain information on the configuration or the state of the system. The

queries transform this input into flow tables to push down to switches.

The nlog program acts a function of the entire contents of the input

tables, without reference to a concept of time or order. This simplifies

implementation, because it avoids ordering problems found so pervasively

in distributed systems. Thus, versus hand-code state machines, nlog

offers better hope of correctness and easier quality assurance, since it

allows programmers to specify the desired results rather than all of the

possible state transitions that could lead there.

Topics include:

Related (more complicated) work in academia.

External functions for mapping output.

Query planning in NVP and in OVN.

Sharding, threading, and performance.

Where Yusheng is planning to first propose nlog for use in OVN.

The simple Java-based network virtualization system that Yusheng built

to demonstrate the idea.

The patches that we should expect to see soon from Yusheng.

Code size for nlog implementations (small!).

Strategies for testing an nlog implementation.

Data types in nlog, and risks of asynchronous interfacing

Convergence, performance, and transactions.

Lessons learned:

Only implement a DSL if you know what you're getting in for.

nlog solved correctness issues, period (leaving developers to worry

about scale).

You can reach Teemu at [email protected] and Yusheng at [email protected].

OVS Orbit is produced by Ben Pfaff. The

intro and bumper music is Electro

outro music is Girls like

All content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

38 min

May 21, 2016 Cilium, with Thomas Graf from Cisco

Interview with Thomas Graf of Cisco, regarding the Cilium project.

Cilium is a “science project” that Thomas and others at Cisco and

elsewhere are hacking on, to address the question of how to address

policy in a legacy-free container environment that scales to millions of

endpoints. It's an experiment because the outcome isn't yet certain, and

it's a question that hasn't seen much work outside of hyperscale

providers.

Cilium is based on eBPF, a

Linux kernel technology that introduces the ability for userspace to

inject custom programs into the kernel using a bytecode analogous to Java

virtual machine bytecode. Cilium uses eBPF-based hooks can intercept

packets at various places in their path through the kernel to implement a

flexible policy engine.

Topics include:

How Chris Wright encouraged Thomas to become involved with Open

vSwitch, when Thomas was at Red Hat.

The important differences between containers and VMs (quantity,

duration of workloads, and frequency of state changes) and how Cilium

addresses these issues.

The toolchain that Cilium uses to generate a eBPF program customized

for the policy of each container in a minimal and complete way.

The potential to bypass kernel sk_buff overhead by

intercepting packets before these data structures are constructed, via

Express Data Path (XDP), leading to the potential for DPDK-like packet

forwarding performance without ever leaving the kernel. What's the

drawback? We don't know yet how it will play out.

The main benefit of getting XDP-based early access to packets is to

avoid the main Linux networking code paths, which are optimized for

delivery to socket buffers (taking advantage of segmentation offload)

as opposed to forwarding.

Dropping packets quickly is important because many operators are under

attack all the time.

Importance of performance for small and large packets.

Languages available for writing eBPF: C via LLVM/Clang and Python

(among others?).

Limitations due to the verifier (primarily restrictions on loops), and

how to work around them.

How Cilium generates its eBPF programs: a base C program, plus an agent

in Go that generates a C header file. Cilium compiles the C program to

eBPF bytecode, using LLVM, then loads it into the running kernel with

the tc utility.

Potential for difficulty in getting a compiler toolchain into

production deployments. Is the simplicity of supplying Cilium as a

container image that builds in the toolchain an advantage?

How often eBPF programs need to be recompiled in Cilium.

eBPF “map” data structures that can be shared among eBPF programs,

the rest of the kernel, and userspace.

Policy in Cilium. The basic idea is that whoever specifies Cilium

policy should not have to understand traditional networking concepts

like IP addresses ands port. Instead, abstract labels specify which

classes of containers can talk to each other.

Lessons learned from policy in Cilium.

How Cilium does datapath packet processing, how it passes labels from

source to destination, and where it applies policy.

The direction in which Cilium points for eBPF support in Open vSwitch:

first, it shows that it is possible; second, it shows that the tracing

buffer mechanism available from eBPF is a potential replacement for

Open vSwitch “upcalls” currently implemented via Netlink; third, it

points out an alternative for the flow-based model. (Does it makes

sense to implement OVN directly via code generation?)

Connection tracking in eBPF.

eBPF helper functions in Linux, and the limitations of the current

ones.

Potential for applying eBPF to other targets such as DPDK or the OVS

port to Hyper-V.

Performance penalty for eBPF versus native code.

Early controversy in the kernel community over eBPF when it was

introduced.

What's next for Cilium: load balancing, IPsec, IPv4 .

More information about Cilium: slides

and the code repository.

You can find Thomas on the ovs-dev mailing

list, @tgraf__ on Twitter,

or on Facebook.

OVS Orbit is produced by Ben Pfaff. The

intro and bumper music is Electro

outro music is Girls like

All content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

33 min

May 08, 2016 OVS in Production, with Chad Norgan from Rackspace

Interview with Chad Norgan of Rackspace, about use of Open vSwitch at

Rackspace over the years.

Topics include:

Chad's role at Rackspace and what he spends his time on.

Shifts in where he spends his time as Open vSwitch has matured.

Experiments with buying and writing SDN controllers and OpenFlow flows

at Rackspace, including a Ryu-based chassis controller.

SDN in two generations of Rackspace cloud, with NVP in the second

generation.

Tracing datapath flows using tools in Open vSwitch, using

“ovs-appctl ofproto/trace”, and the value of tracing for

debugging a running system.

Suggestions for improving “ovs-appctl ofproto/trace”.

Usefulness of Open vSwitch logging.

Significant performance improvements since earlier versions, such as

moving logging out of the main thread, megaflows, and eviction

handling.

Potential appliance use of DPDK, contrasted against downside for

hypervisors of losing a core.

Thoughts about importance of 64-byte packet performance in Rackspace

environment, and potential of eBPF work going on at Cisco to help with

that.

Performance history of Open vSwitch versions as perceived by Nicira and

Rackspace, and its evolution over time as Open vSwitch was exposed to

more and more diverse production use cases.

Open vSwitch decision for version 1.11 to completely rewrite everything

in terms of megaflows, to achieve reasonable performance in important

minority of cases.

Chad's presentation on Open vSwitch performance at the Open vSwitch 2014

Fall Conference.

Open vSwitch as the “incumbent” virtual switch.

Generating good representative traffic for testing.

Ixia hardware for predictable traffic generation, removing a variable

from the testing equation.

Desire for a physical hardware switch with the flexibility of Open

vSwitch, with P4 switches as a possible route there.

“ovsdb-tool -mmm show-log” as database debugging tool.

Chad can be contacted at @chadnorgan on Twitter, as

BeardyMcBeard on the freenode IRC

network

OVS Orbit is produced by Ben Pfaff. The

intro and bumper music is Electro

outro music is Girls like

All content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

19 min

May 04, 2016 OPNFV and OVS, with Dave Neary from Red Hat

Interview with Dave Neary of Red Hat, concerning OPNFV and its

relationship with Open vSwitch.

Topics include:

The difference between SFC and NFV.

Importance performance constraints in NFV.

Telcos and NFV, and how telcos approached OpenStack.

How OPNFV bridges the telcos with OpenStack.

What telcos care about, and a definition of “carrier grade.”

Why carrier-grade features matter to everyone.

Downsides and tradeoffs of carrier grade, such as cost and

complexity.

Role of Open vSwitch in OPNFV, and why DPDK is important to NFV.

Importance of short 64-byte packets in NFV, e.g. for RTP (Real-time

Transport Protocol, for delivering audio and video across networks).

Relationship between SIP and RTP.

Status of DPDK datapath in OVS for OPNFV (still under OpenStack review

and in early evaluation, not running in production much).

Importance of vhost-user for NFV.

Why DPDK API/ABI changes cause trouble for Open vSwitch and downstream

users, and how symbol versioning in DPDK 2 and later helps.

Problems caused by irregularly scheduled Open vSwitch 2.4 and 2.5

releases.

Intent to branch OVS 2.6 in July.

SFC for OPNFV demo with Tacker.

Progress toward NSH support in OVS, and why OVS support for Geneve should

make it easier now.

Geneve standardization progress.

OpenFlow matching for service chains.

Potential pros and cons of NSH and Geneve for service chaining.

VPP and OPNFV, and guesses at pros and cons of VPP versus OVS for

different application.

Why Dave is excited about OPNFV.

You can find Dave at @nearyd on

Twitter.

OVS Orbit is produced by Ben Pfaff. The

intro and bumper music is Electro

outro music is Girls like

All content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

24 min

May 01, 2016 Porting OVS to Hyper-V, with Alessandro Pilotti from Cloudbase

An interview with Alessandro Pilotti of Cloudbase, which Alessandro

describes as the company that takes care of everything related to

Microsoft technologies in OpenStack. The interview focuses on the

Open vSwitch port to Hyper-V, to which Cloudbase is a top contributor.

Highlights and topics in this episode include:

An overview of what Cloudbase does and what it works on in OpenStack.

Why Cloudbase started their Open vSwitch port to Hyper-V.

History of the VMware and Cloudbase ports to Hyper-V and how they

were merged into upstream Open vSwitch.

Alessandro's thoughts on how to favoring a user experience familiar to

Windows admins versus one familiar to user who know Open vSwitch from

other platforms.

Perspectives on collaboration in the Hyper-V port development.

The native Hyper-V switch versus Open vSwitch.

Ben's anecdote about a surprising conference call with Microsoft

back in 2011.

Alessandro educates Ben about Ubuntu on Windows

How port names are handled in Windows.

Status of the Hyper-V port and how it's being used

Upcoming features for the Hyper-V port, such as connection tracking bsed

firewalling ("conntrack").

OVN on Hyper-V.

Alessandro's role as CEO at Cloudbase and how he gets involved in the

technical side of projects.

How Cloudbase attracts employees, via internships from local universities.

Continuous integration for OpenStack on Hyper-V.

Special challenges of projects with a kernel component.

OVS Orbit is produced by Ben Pfaff. The

intro and bumper music is Electro

outro music is Girls like

All content is licensed under a Creative Commons Attribution 3.0

Unported (CC BY 3.0) license.

34 min

Share OVS Orbit

Sign up to save your podcasts

OVS Orbit

OVS Orbit episodes

About OVS Orbit