From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <s.hanreich@proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id D62C59B457 for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 18:04:26 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id C160E362A6 for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 18:04:26 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 18:04:25 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 75BA341BAA for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 18:04:25 +0200 (CEST) Message-ID: <a43cbc91-3f76-8aad-77ce-5cd8c36a531d@proxmox.com> Date: Tue, 17 Oct 2023 18:04:24 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.0 Content-Language: en-US To: pve-devel@lists.proxmox.com References: <20231017135507.2220948-1-s.hanreich@proxmox.com> From: Stefan Hanreich <s.hanreich@proxmox.com> In-Reply-To: <20231017135507.2220948-1-s.hanreich@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-SPAM-LEVEL: Spam detection results: 0 AWL 1.966 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment NICE_REPLY_A -3.339 Looks like a legit reply (A) POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [subnets.pm, sdn.pm, network.pm, dnsmasq.pm, subnetplugin.pm, vnets.pm, pveplugin.pm, dhcp.pm, cluster.pm, plugin.pm, lxc.pm, qemuserver.pm] Subject: Re: [pve-devel] [WIP v2 cluster/network/manager/qemu-server/container 00/10] Add support for DHCP servers to SDN X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> List-Post: <mailto:pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Tue, 17 Oct 2023 16:04:26 -0000 Some additional things we've discussed off-list: Currently for VMs Migration & Hibernation are not working - everything else in the lifecycle of VMs/CTs should be covered. For Migration: It currently creates an additional mapping in the IPAM and doesn't delete the existing mapping from the DHCP server config. I'd say we change this to upsert instead of add (for both IPAM and DHCP Plugins). This means when adding a mapping for a VM, check if there is already one, and then return that mapping without doing anything. Then we just need to delete the existing mapping from the source during the migration, which could simply be done somewhere in QemuMigrate. Having upsert, instead of add, would also make implementations with distributed DHCP servers like kea easier. For Hibernation: Having Upsert would solve the issue with Hibernation as well. Here we need to make sure to not delete the entry from the IPAM, since we use a memory snapshot rather than using the guest's hibernation feature. That means the DHCP lease 'persists' in the VM. We will also need to expose the functionality via the Web UI, for that I had the following things in mind: * Add Create/Edit/Delete DHCP to either `Options` or in a new IPAM/DHCP panel (see below) * Add a tree view of the current PVE IPAM state, similar to the resource mapping, as a new panel * add the `dhcp-range` fields to the Subnet Edit Dialog (possibly in a new tab in the edit dialogue) Another thing: What happens when a user changes the MAC address via the UI? I'd either disallow it completely or we need to update the DHCP configuration files and IPAM On 10/17/23 15:54, Stefan Hanreich wrote: > This is a WIP patch series, since I will be gone for 3 weeks and wanted to > share my current progress with the DHCP support for SDN. > > This patch series adds support for automatically deploying dnsmasq as a DHCP > server to a simple SDN Zone. > > While certainly not 100% polished on some ends (looking at restarting systemd > services in particular), the general idea behind the mechanism shows. I wanted > to gather some feedback on how I approached designing the plugins and the > config regeneration process before comitting to this design by creating an API > and UI around it. > > You need to install dnsmasq (and disable it afterwards): > > apt install dnsmasq && systemctl disable --now dnsmasq > > > You can use the following example configuration for deploying a DHCP server in > a SDN subnet: > > /etc/pve/sdn/dhcp.cfg: > > dnsmasq: nat > > > /etc/pve/sdn/zones.cfg: > > simple: DHCPNAT > ipam pve > > > /etc/pve/sdn/vnets.cfg: > > vnet: dhcpnat > zone DHCPNAT > > > /etc/pve/sdn/subnets.cfg: > > subnet: DHCPNAT-10.1.0.0-16 > vnet dhcpnat > dhcp-dns-server 10.1.0.1 > dhcp-range server=nat,start-address=10.1.0.100,end-address=10.1.0.200 > gateway 10.1.0.1 > snat 1 > > > Then apply the SDN configuration: > > pvesh set /cluster/sdn > > You need to apply the SDN configuration once after adding the dhcp-range lines > to the configuration, since the running configuration is used for managing > DHCP. It will not work otherwise! > > For testing it can be helpful to monitor the following files (e.g. with watch) > to find out what is happening > * /etc/dnsmasq.d/<dhcp_id>/ethers (on each node) > * /etc/pve/priv/ipam.db > > Changes from v1 -> v2: > * added hooks for handling DHCP when starting / stopping / .. VMs and CTs > * Get an IP from IPAM and register that IP in the DHCP server > (pve only for now) > * remove lease-time, since it is now infinite and managed by the VM lifecycle > * add hooks for setting & deleting DHCP mappings to DHCP plugins > * modified interface of the abstract class to reflect new requirements > * added helpers in existing SDN classes > * simplified DHCP configuration settings > > > > pve-cluster: > > Stefan Hanreich (1): > cluster files: add dhcp.cfg > > src/PVE/Cluster.pm | 1 + > src/pmxcfs/status.c | 1 + > 2 files changed, 2 insertions(+) > > > pve-network: > > Stefan Hanreich (6): > subnets: vnets: preparations for DHCP plugins > dhcp: add abstract class for DHCP plugins > dhcp: subnet: add DHCP options to subnet configuration > dhcp: add DHCP plugin for dnsmasq > ipam: Add helper methods for DHCP to PVE IPAM > dhcp: regenerate config for DHCP servers on reload > > debian/control | 1 + > src/PVE/Network/SDN.pm | 11 +- > src/PVE/Network/SDN/Dhcp.pm | 192 +++++++++++++++++++++++++ > src/PVE/Network/SDN/Dhcp/Dnsmasq.pm | 186 ++++++++++++++++++++++++ > src/PVE/Network/SDN/Dhcp/Makefile | 8 ++ > src/PVE/Network/SDN/Dhcp/Plugin.pm | 83 +++++++++++ > src/PVE/Network/SDN/Ipams/PVEPlugin.pm | 64 +++++++++ > src/PVE/Network/SDN/Makefile | 3 +- > src/PVE/Network/SDN/SubnetPlugin.pm | 32 +++++ > src/PVE/Network/SDN/Subnets.pm | 43 ++++-- > src/PVE/Network/SDN/Vnets.pm | 27 ++-- > 11 files changed, 622 insertions(+), 28 deletions(-) > create mode 100644 src/PVE/Network/SDN/Dhcp.pm > create mode 100644 src/PVE/Network/SDN/Dhcp/Dnsmasq.pm > create mode 100644 src/PVE/Network/SDN/Dhcp/Makefile > create mode 100644 src/PVE/Network/SDN/Dhcp/Plugin.pm > > > pve-manager: > > Stefan Hanreich (1): > sdn: regenerate DHCP config on reload > > PVE/API2/Network.pm | 1 + > 1 file changed, 1 insertion(+) > > > qemu-server: > > Stefan Hanreich (1): > sdn: dhcp: add DHCP setup to vm-network-scripts > > PVE/QemuServer.pm | 14 ++++++++++++++ > vm-network-scripts/pve-bridge | 3 +++ > vm-network-scripts/pve-bridgedown | 19 +++++++++++++++++++ > 3 files changed, 36 insertions(+) > > > pve-container: > > Stefan Hanreich (1): > sdn: dhcp: setup DHCP mappings in LXC hooks > > src/PVE/LXC.pm | 10 ++++++++++ > src/lxc-pve-poststop-hook | 1 + > src/lxc-pve-prestart-hook | 9 +++++++++ > 3 files changed, 20 insertions(+) > > > Summary over all repositories: > 20 files changed, 681 insertions(+), 28 deletions(-) >