Introduction
Purpose
Isolation of Guest VM traffic is achieved using Security Groups in Basic zone. For Advance In Advanced zone, traffic can be isolated on per network basis using VLANs. Currently a shared network can be shared by multiple accounts/tenents, there is no way to isolate guest traffic within in Network.In 2.2.x version of the CloudStack, we used to support SG isolation in Shared Zone wide network in Advance zone. In 3.0, this functionality was temporarily disabled. We have to re-enable it back in the next CloudStack release to support upgrade for existing 2.2.x customers using this feature.do isolation in this network. The purpose of this document is to provide functional specification to use SG to isolate guest VM within a shared network in advanced zone. And in Advanced zone, VM can be on multiple shared networks, different NICs of a VM can have different SG sets, says SG works on NIC level in Advanced zone.
Glossary
- SG - Security Group
- VR - Virtual Router
- VM - User Virtual Machine
Requirements
Major point is, make the feature work just the way it worked in 2.2.x. We will extend the functionality later on.
Design
- In advanced zone, SG is on NIC level, a NIC can be part of multiple SGs, different NICs of a VM can be part of different SGs
- In advanced zone, SG is an option of network offering, if a network is created with a network offering (SG in on), SG can be applied to NICs on this network.
- shared network is created by Admin, there is another option in network offering to indicate whether user can apply SG to NICs on this network, if the option is off, only admin can apply SG to NICs on this network, the reason for this is, Admin might want to provide service (for example monitoring service) on this network, Admin might not want to user SG rules break the service, or Admin might not want to user SG rules to allow guest VMs to access utility/service VM/host directly in that network.
- All network types will be supported
- All external device will be supported, if firewall external device is enabled , user might need to configure both firewall and SG to allow traffic go through
- All network service provider will be supported.
- support KVM and XenServer hypervisor.
- SG functionality is as
- Feature is supported for Shared zone wide network only in Advance zone
- When Advance zone is Security Group enabled ("securitygroupenabled=true" is passed to createZone API call; corresponding field is being set to true in the DB), only one Shared Zone Wide SG Enabled Guest network can be added to this zone + any number of Shared Account Specific SG Disabled networks.
- Shared Zone Wide SG Enabled Guest network is required in Advance SG enabled zone as CPVM/SSVM are using it.
- User vm can be deployed either in Shared Zone Wide SG enabled network, or in 1-n Shared Account Specific networks. Combination of SG enabled and SG disabled networks for the same VM is not supported.
- Only supported on KVM hypervisor.
- Only one provider is supported - Virtual Router
- SG functionality should be the same as in Basic zone in terms of Ingress/Egress rules behavior
- No Isolated networks can be added to the Advance SG enabled zone. No Shared Domain wide networks are allowed either.
Feature specification
Code changes
As the 2.2.x code was never removed, we just have to make sure it works + put some additional limitations/fixes to the API related to the 3.0.x changes to NaaS (there was no notion of Physical network/Traffic types in 2.2.x; plus in 2.2.x Shared Zone wide network was created automatically as a part of addZone call.
Things to check:
Make sure that all 2.2.x limitations for Advance SG zone, are still respected in the code. And fix if something got broken/disabled along the way.
3.0.x fixes
Add Zone flow
Don't create Guest network automatically as a part of addZone
Add Traffic Type flow
Don't allow adding Public Traffic Type to the SG enabled Advance zone.
Create Guest Network flow
1) Only Shared Zone wide and Account specific networks can be added to the SG enabled Advance zone.
2) Don't allow to add more than 1 Shared Zone wide network to the zone. This network has to:
- Have VR as the provider for all its services
- SG Service should be mandatory
System vms (CPVM/SSVM) will have a NIC in the Shared SG network, so before the network is added, the system is not ready for user vm launch.
3) Only VR can be a provider for all the services
Client API changes
- Add "securitygroupenabled" (boolean/optional) to the listZones request.
DB modifications
No DB modifications are needed
Not support
- not support Vmware, OVM, etc. hypervisor
- not support SG on isolated /VPC networks,
API changes
- Add "securitygroupenabled" (boolean/optional) to the listZones request.
API behavior changes
- CreateNetworkCmd
in advanced SG enabled zone, only SG enabled shared network can be created, other network type like isolated and public creation will fail.
in advanced SG disabled zone, SG enabled shared entwork creation will fail. - CreateVPCCmd
will fail in advanced SG enabled zone - AddF5LoadBalancerCmd
will fail in advanced SG enabled zone - AddSrxFirewallCmd
will fail in advanced SG enabled zone
UI Flow
...
The flows below require changes:
Add Zone
- Show Isolation type (Vlan and Security Group) as selectable option when create Advance zone. Put it on the first pageAdd check box "Enable Security Group" to the first page of create Zone dialog. If Security Group selected, pass
securitygroupenabled=true to the addZone api call. You can duplicate this logic from 2.2.x code. - Like in Basic zone, we should force admin to create Guest Network shared network as a part of zone creation. With the only one difference 2 differences - Vlan VLAN field is required; and network offering should be SG enabled.
- No Public traffic type support when add SG Advance zone
- Allow having multiple physical networks though.
- When add first cluster/host, show KVM as the only one available hypervisorKVM/XenServer can be chosen.
Add Cluster
- Only allow adding KVM/XenServer cluster to Advance advanced SG enabled zone
Infrastructure -> PhysicalNetworks Diagram -> Modify Guest traffic type
- Only allow adding Shared Account specific network when the zone is Advance
Networks tab
->AddNetwork
- all shared networks type with SG network offering are supported in advanced SG enabled zone
Networks tab
- show all networksAdd SecurityGroup to the list of Views (drop box) on the top of the view. Show it only when 1) there is at least 1 Basic zone in the cloudStack 2) There is at least one Advance zone that is SG enabled (execute listZones&securitygroupenabled=true)
Deploy VM flow
- Get all the networks available to the User with a simple listNetworks&account=&domainId API call
- Don't allow user to select combination of SG enabled and disabled network
- When SG enabled network is selected, show Security Group list to select fromUser can choose one network
Upgrade flow
- When create physical network traffic types, don't create Public traffic type.
- The rest of the upgrade should be handled the same way we handle it for other zones
Future release plans
In the future releases we are going to:Add support for
- VM can be on multiple SG enabled
...
...
- Add support for SG in Isolated networks
- Feature support in VPC networks