From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <aderumier@odiso.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by lists.proxmox.com (Postfix) with ESMTPS id DF40D61F97
 for <pve-devel@lists.proxmox.com>; Tue,  8 Sep 2020 10:59:32 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
 by firstgate.proxmox.com (Proxmox) with ESMTP id CFE4812FB1
 for <pve-devel@lists.proxmox.com>; Tue,  8 Sep 2020 10:59:02 +0200 (CEST)
Received: from mailpro.odiso.net (mailpro.odiso.net [89.248.211.110])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by firstgate.proxmox.com (Proxmox) with ESMTPS id A872A12FA5
 for <pve-devel@lists.proxmox.com>; Tue,  8 Sep 2020 10:58:59 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
 by mailpro.odiso.net (Postfix) with ESMTP id 72A9F18F64F1;
 Tue,  8 Sep 2020 10:58:53 +0200 (CEST)
Received: from mailpro.odiso.net ([127.0.0.1])
 by localhost (mailpro.odiso.net [127.0.0.1]) (amavisd-new, port 10032)
 with ESMTP id yXBIwqtbXDyd; Tue,  8 Sep 2020 10:58:53 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
 by mailpro.odiso.net (Postfix) with ESMTP id 5529818F642A;
 Tue,  8 Sep 2020 10:58:53 +0200 (CEST)
X-Virus-Scanned: amavisd-new at mailpro.odiso.com
Received: from mailpro.odiso.net ([127.0.0.1])
 by localhost (mailpro.odiso.net [127.0.0.1]) (amavisd-new, port 10026)
 with ESMTP id EMPD6GFJguO5; Tue,  8 Sep 2020 10:58:53 +0200 (CEST)
Received: from mailpro.odiso.net (mailpro.odiso.net [10.1.31.111])
 by mailpro.odiso.net (Postfix) with ESMTP id 3F1E718F64F1;
 Tue,  8 Sep 2020 10:58:53 +0200 (CEST)
Date: Tue, 8 Sep 2020 10:58:53 +0200 (CEST)
From: Alexandre DERUMIER <aderumier@odiso.com>
To: Thomas Lamprecht <t.lamprecht@proxmox.com>
Cc: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Message-ID: <1179667870.443488.1599555533057.JavaMail.zimbra@odiso.com>
In-Reply-To: <65ed6f59-a12b-c331-4b65-a9e95afda377@proxmox.com>
References: <20200824164923.12652-1-aderumier@odiso.com>
 <ac816804-567c-f82d-b574-84db4d6a8278@proxmox.com>
 <1480692740.435706.1599537124012.JavaMail.zimbra@odiso.com>
 <65ed6f59-a12b-c331-4b65-a9e95afda377@proxmox.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Mailer: Zimbra 8.8.12_GA_3866 (ZimbraWebClient - GC83 (Linux)/8.8.12_GA_3844)
Thread-Topic: POC : add/del/update ip from vnet-subnet-ipam
Thread-Index: YoBLmfwHJJhLEw2MQBgGYDDb0UyxiA==
X-SPAM-LEVEL: Spam detection results:  0
 AWL 0.019 Adjusted score from AWL reputation of From: address
 KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
 RCVD_IN_DNSWL_NONE     -0.0001 Sender listed at https://www.dnswl.org/,
 no trust
 SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
 SPF_PASS               -0.001 SPF: sender matches SPF record
Subject: Re: [pve-devel] [PATCH v2 pve-container] POC : add/del/update ip
 from vnet-subnet-ipam
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, 
 <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, 
 <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 08 Sep 2020 08:59:32 -0000

>>I'd like to have stuff in priv/ folder prefixed with a directory=20
>>namespace, maybe "sdn" here.=20

Ok,I'll add the extra /sdn/

(for your problem, maybe look if the gateway ip is present in the ipam.db)

>>Besides that, how big can this get on huge setups? We only can have 512k =
files=20
>>for now.=20
currently, it's just a perl hash converted to json with ip list. (so 32bits=
 by ipv4, and 128bits by ipv6).
So I think it could be ok for common cluster ?



>>Could it make sense to have subnets and vnets at least in the same sectio=
n config,=20
>>with different types? (a bit like storage.cfg) So that we reduce the conf=
iguration=20
>>file amount a bit.=20

yes, I think it's possible. I'll look to see how to implement that.
do you want to have 1 api endpoint for both subnets && vnets ?=20

>>Maybe we could also visualize this in the gui a bit "easier".=20
>>We could merge VNet and SubNet management into one panel, maybe with spli=
t view=20
>>like FW ipsets

That's a really good idea ! Like it :)
I'll look at FW ipset extjs implementation.

>>you won't have the same subnet in different VNets after all,or ?

Yes, currently I manage only 1subnet-1vnet.=20
I don't think users will used same subnet multiple times, until they used v=
rf for routed vnet or isolated bridge.


>>We could also merge DNS and IP management into one panel, maybe with spli=
t view=20
>>like HA or vertical like FW ipsets.=20
>>
>>But this is not too relevant for now, can always be fine tuned once the A=
PI/backend=20
>>stuff is in.=20

Ok, no problem.


>>On another note, are there some unit/regressions tests for this stuff?=20
>>Would give a bit more confidence with this.=20

No sorry. I have done tests manually currently.
I don't know too much how to implement the unit tests, but I'll try too see=
 what can be done.

>>skimming through the code currently, seems mostly OK for now, need to thi=
nk a bit=20
>>about how the general concepts are implemented and if that fits all OK.=
=20

Thanks for the review && comments !




----- Mail original -----
De: "Thomas Lamprecht" <t.lamprecht@proxmox.com>
=C3=80: "Proxmox VE development discussion" <pve-devel@lists.proxmox.com>, =
"aderumier" <aderumier@odiso.com>
Envoy=C3=A9: Mardi 8 Septembre 2020 09:44:19
Objet: Re: [pve-devel] [PATCH v2 pve-container] POC : add/del/update ip fro=
m vnet-subnet-ipam

On 08.09.20 05:52, Alexandre DERUMIER wrote:=20
>>> When trying this I got the gateway IP returned for both, as CT IP and g=
ateway IP.=20
>>> Did not checked this patch closer, but I figured that this behavior is =
caused by=20
>>> the SDN code.=20
>=20
> mmm, that's strange.=20
>=20
> When you create or update the subnet, the gateway ip you define on the su=
bnet should be registered in the ipam.=20
> (you have enable an ipam right ?)=20

Yes, the built-in "PVE" one=20

>=20
>=20
> Then, when you create CT, without any ip, it'll try to find first availab=
le ip in ipam.=20

I did it on an existing CT, changing from a normal bridge to that vnet.=20

> (So if the gateway was not registered in ipam (bug maybe), that could exp=
lain why you have it both).=20
>=20
> for internal ipam, i'm writing ipam database in /etc/pve/priv/ipam.db. (B=
TW,I'm not sure that it's the best path location)=20

I'd like to have stuff in priv/ folder prefixed with a directory=20
namespace, maybe "sdn" here.=20

Besides that, how big can this get on huge setups? We only can have 512k fi=
les=20
for now.=20

>=20
>>> On another node, do you think it makes sense to have vnets, subnets, IP=
am, DNS completely=20
>>> split and separated from each other? I mean, it is flexible, but a user=
 needs to do a lot=20
>>> of, almost boilerplate-like, work to get this started.=20
>>> Advanced users may profit from this, maybe we just need a "simple wizar=
d" for the easiest=20
>>> beginner case..=20
>=20
> Well for subnet, you can assign multiple subnets by vnet, so yes, it's re=
ally need to by separated.=20
> (Somebody at hertzner for example, buying subnets or /32 failovers ips, a=
nd want to add them to a vnet)=20
> IPAM/DNS, are more reusable configurations. (like api url,key,....). So I=
 think you'll define 1 or 2 of them max.=20
>=20
> I think subnet+ipam+dns are ip features.=20
> zones,vnets,controller are physical network features=20

Could it make sense to have subnets and vnets at least in the same section =
config,=20
with different types? (a bit like storage.cfg) So that we reduce the config=
uration=20
file amount a bit.=20

Maybe we could also visualize this in the gui a bit "easier".=20
We could merge VNet and SubNet management into one panel, maybe with split =
view=20
like FW ipsets, you won't have the same subnet in different VNets after all=
, or?=20

We could also merge DNS and IP management into one panel, maybe with split =
view=20
like HA or vertical like FW ipsets.=20

But this is not too relevant for now, can always be fine tuned once the API=
/backend=20
stuff is in.=20

On another note, are there some unit/regressions tests for this stuff?=20
Would give a bit more confidence with this.=20

skimming through the code currently, seems mostly OK for now, need to think=
 a bit=20
about how the general concepts are implemented and if that fits all OK.=20