K5 Inter-Project Routing – Fully Automated Shared Services API Deployment

In previous posts I have mentioned a K5 specific network feature called Inter-Project routing. As K5 is a public OpenStack based cloud rather than traditional private OpenStack cloud, Contract Owners (a.k.a. OpenStack domain admins) do not have permission to create shared networks by design. However many contract owners often find the need to share resources between projects and this is where K5 Inter-Project Routing comes in to play. Take the previous blog posts about Shared Services – these are all possible thanks to this feature.

Note: We are talking about routing between project subnets within the same availability zone and contract, cross availability zone links are also possible and have been discussed in previous posts.

InterProjectBlog.PNG

In order for the virtual machines (VMs) on the subnets in Project A above to be able to reach VMs on BOTH the subnets in Project B it is necessary to create an Inter-Project link to EACH of the subnets in Project B. That’s two inter-project links for the above scenario!

Steps required per Subnet

  • Get a k5 regional token scoped to Project B

  • Create a port on the subnet in Project B

  • Capture the port_id of the newly created port
  • ReScope your K5 token to Project A

  • Use the Fujitsu K5 Neutron enhanced API call, not available in upstream OpenStack, to make the inter-project connection. This API call allows the project administrator to add an interface from a subnet in a different project to the router in the admins project.

  • Rescope the K5 token to Project B (token rescope api call detailed earlier in the post)
  • Add the static return routes for the networks in Project A to the router in Project B (Note: if your design does not have a router in Project B you can add these routes to the subnets in Project B and reboot your servers to receive the new routing information)
  • Routes of the format [{“destination”: CIDR-1, “nexthop”: interProject-Port-IP},{“destination”: CIDR-2, “nexthop”: interProject-Port-IP} ]

Router Update

Alternative Subnet Update

And that’s all there is to it! You should now be able to route between your projects.

So where’s the automation I hear you think…

Well, I quickly ‘hacked’ together the following two python scripts for a customer demo. The python code is by no means efficient (a.k.a. DRY) but it is fit for the purpose of this tutorial:

Repo : https://github.com/allthingsclowd/K5-InterProject-Demo

 

Happy Stacking!

#withk5youcan

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s