conserve-mode for Public IPs in VPCs.

[rvalle]

ISSUE TYPE

• Enhancement Request

COMPONENT NAME

VPC

CLOUDSTACK VERSION

4.14

CONFIGURATION

KVM, Advanced Networking, Vlan isolation

OS / ENVIRONMENT

Ubuntu 18.04

SUMMARY

VPC's are great, but the usage of public IPs makes its adoption non-viable for us.

STEPS TO REPRODUCE

Create an VPC
Enable Port Forwarding, VPN, LBS, Source NAT

EXPECTED RESULTS

All network services should be provided from 1 public IP (at least optionally) in a similar way to isolated networks. 

ACTUAL RESULTS

4 public IPs are allocated one for each network service.

[rohityadavcloud]

I've not checked but it may be possible that it works via API? (for the default SNAT IP of the VPC VR)

[rvalle]

@rhtyd I don't understand, what do you think could be achieved via API?

[rvalle]

after having worked a bit with VPCs I can see what @andrijapanicsb meant in the mailing list with architectural constraints to supporting the same IP public address for many different tasks.

New IPs are acquired for different tiers x tasks. They way that IPs are used in VPCs is either consistent with IPV6 or Private Addressing, but not public IP4.

For us public IPV4 efficient use is a hard requirement, but I think ACS is flexible enough to be able to, somehow, model an VPC with just one IPV4.

I am working on modelling an VPC + an isolated network as DMZ, one tier of the VPC, which I call frontend, deploys instances with 2 network interfaces one of them facing the DMZ another the VPC.

The VPC's virtual router is then considered Account's corporate network (private addressing).... but this part I don't know well how to model, for the time being I have created an vlan-ip-range reserved for this Account with private IPs from my datacenter..... but there should be a better way. In fact with this model an Account should connect its VPC/s to an isolated network with a site-to-site VPN to their corporate net. This could be the way in for maintenance + intranet access.

At this point I think I would benefit a lot from a section of "networking patterns", in ACS docs. because of how the different features can be combined is not trivial.

[rvalle]

I wonder if the Open Shortest Path First (OSPF) protocol as described in the ShapeBlue Blog

Would work between a VPC-VR and an Isolated-VR

Isolated networks are IP efficient. That would allow for using a designated isolated network as kind of DMZ for for VPC tier.

[DaanHoogland]

@rvalle normal networks have a flag called "conserve-mode". This is what causes only one ip to be assigned. I am not sure it was ever attempted to implement for VPC. It does not exist at this moment but would be the feature you want. Your VPC-VR <-> VPN <-> Isolated-VR sounds doable as well. I would like to not know of a difference between the two VRs if I could, though.

[rvalle]

@DaanHoogland

I have been trying different setups: I think the OSPF only works with VPC to VPC connectivity or VPC to VPN. I don't know what the difference between the VR of an VPC and the one of an Isolated Network is, but it just looks like it is not the same or they don't take the same set of configuration options.

I tried the OSPF setup with a VPC and an Isolated network and it did not work.

I also tried to setup a VPC gateway to an Isolated Network and I could not, but I managed with a L2 Network.

I finally went for the VPC + Isolated DMZ network. And it is almost OK. But it requires many workarounds to make it work decently.

if at least 1 tier of the VPC could be used in "conserve-mode" that would provide a much cleaner setup to have efficient public IP usage in the VPC. I even think that forcing some kind of DMZ pattern is preferable to just allow public IPs anywhere in the VPC.

[rvalle]

Thanks @DaanHoogland , I understand this issue is about implementing the "conserve-mode" for VPCs, which is complex.

A first step could be to be able to enable conserve-mode on the individual VPC tiers, and not necessarily on the VPC as a whole.

Then only one IP per tier would be used. Which makes it possible to use VPCs with only one (Internet Routable) Public IP.

Since the definition of Public IP for ACS is kind of "externally managed IPs", the other tears could get an externally managed IP that does not need to be public.

[DaanHoogland]

@rvalle this seems related to #4454 would you agree?
I'll rename this to "conserve-mode in vpc" as it describes the issue correctly.
btw, are you working on this (either functionally or coding)?

[rvalle]

@DaanHoogland yes, I agree.

I am not coding on this issue.

I am currently using VPCs with the workaround that I explain above.

My coding time is mostly on the ansible-modules. After it I plan to start contributing on ACS codebase, this or other issue.

If you are planning to start working on this I would be willing to help.