Contrail network plugin

The contrail virtual network controller is an open source project that provides an overlay implementation of network virtualization that is interoperable with network devices that support existing network virtualization standards.

The contrail network plugin interfaces with the contrail API server. The contrail API is auto-generated from an XML schema that defines the network configuration data-model. The contrail java API library is supplied by a maven repository. API calls are performed over a REST API.

The contrail network-element plugin is only supported currently with the Xen hypervisor. Contrail supports other hypervisors (KVM) in other orchestration systems but at this point it was desirable to reduce the test matrix by supporting a single hypervisor.

The plugin takes the approach that the Cloudstack management server database is the "master" copy of the data. I.e. if there is a transient failure and the management server stops being able to communicate with the contrail api server, the data is resynchronized when the API becomes available (e.g. when the processes are being restarted) and the Cloudstack database is authoritative for objects that exist in both the Cloudstack and contrail databases.

In order to create an isolated network, the network-plugin calls the contrail API server and creates an "virtual-network" object with the same UUID as the NetworkVO object in the CloudStack management server database.

When a VMInstance is started, the plugin allocates the corresponding "virtual-machine" object on the contrail API datamodel; Cloudstack "Nics" correspond to "virtual-machine-interfaces".

When a VMInstance is started on a host, the StartCommand executor in then Xen plugin must attach the CloudStack UUID of the VMInstance and Nic to each "vif" interface that is created. These UUIDs are used by the contrail VRouter agent running in the host in order to attach the "tap" or "vif" logical interface with the correct configuration.

The contrail VRouter has a dataplane component running on dom0 in the Xen hypervisor. This dataplane component associated each tap/vif interface with a virtual-network specific VRF (forwarding table). The contents of the forwarding tables are pre-populated by the control plane components of the contrail solution and may consist of routes to other virtual-machines or routes advertised by other network entities that speak RFC4364. These could be physical routers or other orchestration clusters.

The VRouter dataplane acts as the first-hop router as far as the VM is concerned and replaces the functionality of the DomainRouter. Traffic between virtual-networks is exchanged directly from host to host without having to pass through an intermediate domain router.

The Cloudstack contrail plugin supports the following functionality:

1. isolated networks
2. static nat; implemented by the VRouter dataplane
3. source nat; implemented by using a virtual appliance with full NAT functionality.

We plan to extend the plugin in the near term in order to support the full VPC API. Including direct connectivity between networks without traversing a virtual router.