Nova Security Group相关配置

相关配置

  • network_api_class - 设置 network 模块所用的 api
    • nova.network.api.API - 通过 rpc 与 nova-network 交互
    • nova.network.neutronv2.API - 通过 http 与 neutron-server 交互
  • security_group_api - 设置 security group 模块所用的 api 类
    • nova (nova.compute.api.SecurityGroupAPI) - 通过 rcp 与 nova-compute 交互
    • neutron ( nova.network.security_group.neutron_driver.SecurityGroupAPI ) - 通过 http 与 neutron-server 交互
  • linuxnet_interface_driver - 在机器与 ethernet interface plug&unplug 时调用 。
    • nova.network.linux_net.LinuxBridgeInterfaceDriver - used in nova-network
    • nova.network.linux_net.linuxOVSInterfaceDriver - use in neutron + ml2 + ovs
    • nova.network.linux_net.NeutronLinuxBridgeInterfaceDriver - use in neutron + ml2 + linuxbridge
  • firewall_driver - 虚拟化层所用的 firewall。 在 nova-network 时代 ,security group 由 iptables 和 ebtables 实现 。 在 neutron 时代 , 这个已经不需要了 。 但是 neutron 里现在还有 arp-spoofing 的 bug, 参见 [2]
    • nova.virt.firewall.IptablesFirewallDrive -
    • nova.virt.firewall.NoopFirewallDriver

使用组合 :

nova-network + libvirt

nova_api_class=nova.network.api.API
security_group_ap=nova
linuxnet_interface_driver=nova.network.linux_net.LinuxBridgeInterfaceDriver
firewall_driver=nova.virt.firewall.IptablesFirewallDrive

neutron + ml2 + linuxbridge plugin + libvirt

nova_api_class=nova.network.neutronv2.API
security_group_ap=neutron
linuxnet_interface_driver=nova.network.linux_net.NeutronLinuxBridgeInterfaceDriver
firewall_driver=nova.virt.firewall.NoopFirewallDriver

neutron + ml2 + ovs plugin + libvirt

nova_api_class=nova.network.neutronv2.API
security_group_ap=neutron
linuxnet_interface_driver=nova.network.linux_net.linuxOVSInterfaceDriver
firewall_driver=nova.virt.firewall.NoopFirewallDriver

REF

  1. ebtables in Openstack Nova - nwfilter explaination
  2. Preventing ARP spoofing via ebtables - Neutron BP for preventing arp snoofing. Expected in Kilo
    1. Neutron firewall anti-spoofing does not prevent ARP poisoning - Related bug

Comments