You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

Introduction

Currently connecting multiple VPC's together can basically be achieved by using inter VPC routing via PrivateGateways or via VPN tunnels.

The current way of enabling inter-VPC's routing connectivity between VPC's in CloudStack (4.6) is via a PrivateGateway and adding one or multiple static route(s). Creating a privategateway however is not available/permitted for domain admins or non-admin users by the API.  This puts a burden on the root-admins to enable a PrivateGateway on VPC's that a user has created. Another aspect is that domain admins or non-admin users of subdomains in CloudStack do not always have the right information, such as gateway address, vlan, and ip, to use a create privategateway function even if users would be allowed to.  

From a usability and efficiency perspective it also does not make sense to require cloud users to a) provide this information, and b) to have to enable a privategateway and to add a static route on each VPC to be connected while a single request per connection to connect VPC X to Y and perhaps Z to X could suffice.

This design aims to propose a more functional, and for the user more simplified and efficient way of connecting multiple VPC's. The functionality would be called VPC Peering and would aim to provide a simple yet powerful interface for users to connect 2 or more VPC's to each other that effectively creates layer 3 reachability between VPC's.

Use case

Requirements

 

Limits

  • VPC peering connections are not possible between VPC's with matching or overlapping VPC CIDR blocks
  • VPC peering connections are not transitive in the sense that VPC's will not automatically gain access to a 3rd VPC via a VPC that is peered with that 3rd VPC.
  • VPC peering connections are only possible within a CloudStack zone
  • There is a maximum amount of pending VPC peering requests per VPC
  • There is a maximum amount of active VPC peering connections
  • There is an expiry time on the pending VPC peering requests

 

Procesflow

Domain model

Authorization

Implementation

  • UI

  • API
  • Datamodel
  • Marvin / Cloudmonkey

Network providers

  • VMWare NSX
  • OVS
  • Physical (VLAN based)

Tests

 

 

 

  • No labels