PERFORMANCE OPTIMIZATION IN RED PERFORMANCE OPTIMIZATION IN RED HAT - PowerPoint PPT Presentation

PERFORMANCE OPTIMIZATION IN RED PERFORMANCE OPTIMIZATION IN RED HAT OPENSTACK PLATFORM HAT OPENSTACK PLATFORM LUNCH & LEARN LUNCH & LEARN Razique Mahroua Red Hat Training - Services Content Architect

ABOUT ME ABOUT ME Course author of the Red Hat OpenStack Administration courses (CL110, CL210, CL310). Services content architect for Red Hat Training since 2014. Worked on the majority of the cloud portfolio (Red Hat OpenStack Platform, OpenShift Container Platform, CloudForms, RHV, etc.) Published some whitepapers for IBM and Amazon rmahroua@redhat.com https://github.com/rmahroua www.linkedin.com/in/rmahroua OpenStack Summit

PERFORMANCE OPTIMIZATION PERFORMANCE OPTIMIZATION AGENDA AGENDA 1. DVR Architecture 2. Network Components 3. Routing Flows 4. Instances (CPU pinning, host aggregates, hugepages, and filters) OpenStack Summit

PERFORMANCE OPTIMIZATION PERFORMANCE OPTIMIZATION 1: DVR Architecture OpenStack Summit

DVR: AN INTRODUCTION DVR: AN INTRODUCTION NETWORK NODES PROVIDE NETWORK NODES PROVIDE IP forwarding Inter-subnet Floating IP Default SNAT Metadata agent Access to the Nova metadata agent OpenStack Summit

DVR: AN INTRODUCTION DVR: AN INTRODUCTION ISSUES ISSUES Scalability Single point of failure Performance bottleneck OpenStack Summit

DVR: AN INTRODUCTION DVR: AN INTRODUCTION DISTRIBUTED ROUTING IN NEUTRON DISTRIBUTED ROUTING IN NEUTRON Compute nodes provide IP forwarding for local VMs & metadata agents for VMs ( Inter- subnet) and floating IPs BENEFITS BENEFITS Bypasses the network nodes for better performance Scales with the number of compute nodes Limited domain failure Limitation: the default SNAT function is still centralized OpenStack Summit

DVR: AN INTRODUCTION DVR: AN INTRODUCTION Neutron Distributed Virtual Routing is a routing model that places L3 routers directly onto compute nodes Enables both inter-project instance traffic and external traffic to be directly routed without traversing the controller nodes. Implements a floating IP namespace on each compute node where VMs are running, providing source network address translation (SNAT) behavior for private VMs. OpenStack Summit

DVR: AN INTRODUCTION DVR: AN INTRODUCTION Introduced as a technology preview feature in Red Hat OpenStack Platform 6, DVR is fully supported with Red Hat OpenStack Platform 10 . Is an optional feature, typical installations default to legacy, centralized routing. OpenStack Summit

PERFORMANCE OPTIMIZATION PERFORMANCE OPTIMIZATION 2: Nodes Components OpenStack Summit

CONTROLLER NODE COMPONENTS CONTROLLER NODE COMPONENTS Open vSwitch Agent manages virtual switches, connectivity among them, and interaction over virtual ports with other networking components (namespaces, Linux bridges, and physical interfaces). DHCP Agent manages DHCP network namespaces (provides IP allocations for instances). The DHCP agent starts dnsmasq processes to manage IP address allocation. OpenStack Summit

CONTROLLER NODE COMPONENTS CONTROLLER NODE COMPONENTS L3 Agent manages the qrouter and SNAT namespaces. qrouter NS routes north-south and east-west network, performs DNAT and SNAT, routes metadata traffic between instances and the metadata agent. SNAT namespaces perform SNAT for north-south network traffic for instances with fixed IP address and project networks on distributed routers. Metadata Agent processes metadata operations for instances using project networks on legacy routers. OpenStack Summit

COMPUTE NODE COMPONENTS COMPUTE NODE COMPONENTS Open vSwitch Agent DHCP Agent L3 Agent Metadata agent Linux Bridge : the Neutron service uses a Linux bridge to manage security groups for instances. OpenStack Summit

PERFORMANCE OPTIMIZATION PERFORMANCE OPTIMIZATION 3: Routing Flows & DVR OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS Routing services in OpenStack can be categorized into: distributed ( DVR ) and centralized ( legacy ), and either traffic between VMs within an environment ( east-west ) or between a VM and systems external to the OpenStack installation ( north-south ). East-west non-DVR (legacy) traffic is routed between different subnets, IPv4 or IPv6, in the same project or between subnets of different projects (requires legacy routers). Such traffic remains within OpenStack nodes and does not traverse external networks. OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS In the diagram below, the instances on separate subnets are able to communicate, without routing through the network node: OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS East-west DVR traffic is routed directly from a compute node in a distributed design (bypasses controller nodes). North-south non-DVR (legacy) traffic with floating IPs is a one-to-one association between the floating IP and an instance's fixed address , implemented by IPv4 NAT tables on a legacy networking service router. Instances communicate with external resources using floating IPs reserved from the provider network. Instances configured with IPv6 use routable Global Unicast Addresses ( GUAs ), precluding the need for address overlap management, and are routed without needing NAT. OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS North-south DVR traffic with floating IPs is distributed and routed directly from the compute nodes (requires external provider network connectivity on every compute node). North-south non-DVR (legacy) traffic without floating IPs is handled by a port address translation ( PAT ) service, enabling instances to initiate bidirectional traffic to external systems. OpenStack Summit

ROUTING TRAFFIC FLOWS ROUTING TRAFFIC FLOWS Externally initiated traffic must traverse the networking service (controller) nodes for proper firewall filtering and route addressing to locate instances on their compute host. SNAT applies to IPv4 traffic only. North-south DVR traffic without floating IPs (DVR) is not distributed, and requires a dedicated Neutron Service (controller) node. OpenStack Summit

EAST-WEST PACKET FLOW EAST-WEST PACKET FLOW Compute nodes route east-west network traffic between project networks on an outbound router, bypassing controller node processing, using the instances' fixed and floating IP addresses. OpenStack Summit

EAST-WEST PACKET FLOW EAST-WEST PACKET FLOW OpenStack Summit

NORTH-SOUTH PACKET FLOW NORTH-SOUTH PACKET FLOW Outbound from any VM on any compute host with FIP processing. In this scenario, outbound packets from an instance are routed and processed for network address translation, then exit the external interface. OpenStack Summit

NORTH-SOUTH PACKET FLOW NORTH-SOUTH PACKET FLOW OpenStack Summit

CONFIGURING DVR CONFIGURING DVR DVR can be configured using an YAML file (environment file). The neutron-ovs-dvr.yaml file is used to configure the required parameters for DVR. REQUIREMENTS REQUIREMENTS Both compute and controller nodes must have an interface connected to the physical network for external network traffic. A bridge is required on compute and controller nodes, with an interface for external network traffic. The configured bridge must be allowed in the Neutron configuration for the bridge to be used. OpenStack Summit

CONFIGURING DVR CONFIGURING DVR There are two files which contain a value that must match. The environments/neutron-ovs-dvr.yaml file contains a value for OS::TripleO::Compute::Net::SoftwareConfig , which must match the value for the same variable contained in the environment file used to deploy the overcloud. Without this configuration, the appropriate external network bridge for the compute node's L3 agent is not created. OpenStack Summit

CONFIGURING DVR CONFIGURING DVR Configure a neutron port for the compute node on the external network by modifying OS::TripleO::Compute::Ports::ExternalPort Include the the path to external.yaml . OS::TripleO::Compute::Ports::ExternalPort: ../network/ ports/external.yaml Include neutron-ovs-dvr.yaml as an environment file when deploying the overcloud. Ensure that L3 HA is disabled. OpenStack Summit

MANAGING DVR ROUTERS MANAGING DVR ROUTERS CONSIDERATIONS CONSIDERATIONS The only backends supported for DVR are the ML2 core plug-in and the Open vSwitch mechanism driver . IPv6 traffic is not distributed. If you use IPv6, avoid DVR at this time (all IPv6 routed traffic traverses the centralized controller node). DVR is not supported with L3 HA. Routers are still scheduled from the controller nodes, but in the event of an L3 agent failure, all routers hosted by that agent also fail. Use of the allow_automatic_l3agent_failover flag so that routers are rescheduled to a different node should a network node fail. OpenStack Summit

MANAGING DVR ROUTERS MANAGING DVR ROUTERS To list the routers $ openstack router show my­dvr­router ...output omitted... | distributed | True | ...output omitted... | id | c7ab6809­1fee­40e9­8891­eb3816bdeb6f | To view the ports for the router $ openstack port list ­ ­router my ­dvr­router ­c 'ID' ­c 'Fixed IP Addresses' ­f json [{ ... "ID" : "0db330bc­5eed­4788­a6cf­3fa87073274a" },{ ... "ID" : "75e6b190­3532­471e­be3e­2620be7263ca" },{ ... "ID" : "e2ea1c33­398f­4528­878f­d3d5fbe3c6e2" }] OpenStack Summit