Page History

...

The 2 VPC's: trading, and finance need to access services in the office IT VPC but should not be allowed to reach each other's services. The owners of the trading and finance VPC's can then create a VPC Peering request towards the office IT VPC.  The owner of the office IT VPC can then choose to accept or reject the peering request.

Once the peering request has been accepted a route is added to the route table of the requesting VPC and the accepting VPC which points towards the cidr block of the peer. And if there is no restrictive access list in place traffic is possible between the requesting VPC and the accepting VPC. 

A band of VPC's

Let's say you run a high traffic high risk app and need to guarantee a maximum availability . and you've built 3 VPC's each containing services that together form a geo cluster. Each VPC in this circle must be able to reach services in the other VPCs.  In this example each VPC will have 2 VPC peering connections.

Requirements

Limits

• VPC peering connections are not possible between VPC's with matching or overlapping VPC CIDR blocks
• VPC peering connections are not transitive in the sense that VPC's will not automatically gain access to a 3rd VPC via a even when the VPC that is peered too has a peering connection with that 3rd VPC.
• VPC peering connections are only possible within a CloudStack region
• There is a maximum amount of pending VPC peering requests per VPC
• There is a maximum amount of active VPC peering connections
• There is an expiry time on the pending VPC peering requests

...

Authorization

Implementation

UI

API

• createVPCPeeringConnection
• listVPCPeeringConnections
• deleteVPCPeeringConnection
• acceptVPCPeeringConnection
• rejectVPCPeeringConnection

Datamodel

Marvin

...

Network providers

• VMWare NSX
• OVS
• Physical (VLAN based)

...