Per-project uplink IP quotas #14631

hamistao · 2024-12-10T04:33:26Z

Introduces per-network project uplink IP limits, adding a limits.networks.uplink_ips.NETWORK_NAME configuration key to projects.
This config key defines the maximum value of IPs made available on a network named NETWORK_NAME to be assigned as uplink IPs for entities inside a cetain project.

lxd/api_project.go

lxd/network/driver_ovn.go

hamistao · 2024-12-10T19:43:32Z

@minaelee Thanks for the early review, every comment was addressed as you suggested.

minaelee · 2024-12-11T01:04:32Z

@minaelee Thanks for the early review, every comment was addressed as you suggested.

Thanks! Sorry, I missed that it was marked as Draft. Looks great!

hamistao · 2024-12-11T04:31:09Z

@tomponline @markylaing Some observations on this:

I did not consider bridge network forwards as something that is taking away IPs from another network, as it would be more tricky to check if they are taking IPs from other managed networks and they are exclusive to the default project. If needed we can add this check in the future.
Project uplink IP limits are exclusive to projects with features.networks
I am not currently distinguishing between ipv6 and ipv4. Maybe I am not 100% clear on the details of the use case of this feature, as that could help decide how to approach the different protocols.
Tests are in the works and should be added to lxd CI shortly.

Manual tests are looking fine so far so I am opening this for review, feel free to look whenever you are able.

tomponline · 2024-12-11T13:19:55Z

I am not currently distinguishing between ipv6 and ipv4. Maybe I am not 100% clear on the details of the use case of this feature, as that could help decide how to approach the different protocols.

I think we should have separate ipv4 and ipv6 quotas as the routes on the uplinks are defined per protocol.

tomponline · 2024-12-11T13:23:28Z

I did not consider bridge network forwards as something that is taking away IPs from another network, as it would be more tricky to check if they are taking IPs from other managed networks and they are exclusive to the default project. If needed we can add this check in the future.

I'm not quite following here. We aren't checking if IPs are being taken away from other networks, but rather whether the quota for the project that the IP usage has exceeded the quota.

For any managed networks in the default project they should still be limited by the quota set on the default project (which is likely to be nothing).

Project uplink IP limits are exclusive to projects with features.networks

I think that probably makes sense. The default project has features.networks so that should be fine.

hamistao · 2024-12-12T04:47:08Z

I'm not quite following here. We aren't checking if IPs are being taken away from other networks, but rather whether the quota for the project that the IP usage has exceeded the quota.

Let's make this a topic for our one to one tomorrow so I can better explain.

hamistao · 2024-12-12T17:18:38Z

Going back to draft to implement suggested changes.

lxd/network/network_utils.go

lxd/api_project.go

Pre-requisite for #14631

This originally contained tests for canonical/lxd#14631, but we moved the tests to the lxd ovn test suite and this was repurposed to just fix a wrong string that refers to a bridge network as physical.

This factors out common logic for allocating uplink addresses to network forwards and load balancers. Pre-requisite for #14631

Signed-off-by: hamistao <[email protected]>

We check for the current uplink IP usage on the validator function for two reasons: - Show a more informative error message in case the provided value is not appropriate. - Avoing doing the expensive computation of uplink IP usage unless a config key was provided for a valid uplink network. Signed-off-by: hamistao <[email protected]>

… to projects Signed-off-by: hamistao <[email protected]>

Signed-off-by: hamistao <[email protected]>

This is useful to prevent newly created ovn networks to exceed the allowed quota for uplink IPs in its project Signed-off-by: hamistao <[email protected]>

Signed-off-by: hamistao <[email protected]>

It has a couple lines of unrelated tests thrown in as well, such as testing a forward/load-balancer can't use listen addresses outside uplink routes. Signed-off-by: hamistao <[email protected]>

tomponline

Thanks!

…#14867) As discussed in #14631 (comment). Changes to LXD CI tests will probably be needed in order to reflect these changes. Pre-requisite for #14882, for the sole reason I used the `checkUplinkUse` in my follow up implementation.

MusicDin · 2025-02-03T14:59:34Z

lxd/api_project.go

+			//  shortdesc: Quota of IPv4 addresses from a specified uplink network that can be used by entities in this project
+			projectConfigKeys["limits.networks.uplink_ips.ipv6."+networkName] = validate.Optional(uplinkIPLimitValidator(s, projectName, networkName, "ipv6"))


Caught while writing weekly news, there is a typo in short description: IPv4 -> IPv6

Thanks for catching this, will fix in a minute

github-actions bot added Documentation Documentation needs updating API Changes to the REST API labels Dec 10, 2024

hamistao force-pushed the project_uplink_ip_quotas branch 5 times, most recently from c83d52d to d9df773 Compare December 10, 2024 12:17

minaelee reviewed Dec 10, 2024

View reviewed changes

hamistao force-pushed the project_uplink_ip_quotas branch from d9df773 to ad6e23d Compare December 10, 2024 19:42

hamistao force-pushed the project_uplink_ip_quotas branch from ad6e23d to cf466fa Compare December 11, 2024 04:08

hamistao marked this pull request as ready for review December 11, 2024 04:28

hamistao marked this pull request as draft December 12, 2024 17:18

hamistao force-pushed the project_uplink_ip_quotas branch 5 times, most recently from 1a05029 to 41d59cd Compare January 22, 2025 14:24

hamistao mentioned this pull request Jan 22, 2025

Fix echo string in ovn tests canonical/lxd-ci#390

Merged

hamistao force-pushed the project_uplink_ip_quotas branch from 41d59cd to 1b11281 Compare January 23, 2025 04:33

hamistao marked this pull request as ready for review January 23, 2025 04:48

hamistao requested a review from tomponline January 23, 2025 05:12

tomponline reviewed Jan 23, 2025

View reviewed changes

lxd/network/network_utils.go Outdated Show resolved Hide resolved

tomponline reviewed Jan 23, 2025

View reviewed changes

lxd/api_project.go Show resolved Hide resolved

tomponline added a commit that referenced this pull request Jan 24, 2025

Network: Factor out uplink validation logic (#14846)

077aaf7

Pre-requisite for #14631

hamistao mentioned this pull request Jan 24, 2025

Network: De-duplicate uplink address allocation logic #14848

Merged

hamistao force-pushed the project_uplink_ip_quotas branch from 8cd98b6 to d630e2a Compare January 24, 2025 13:57

tomponline added a commit that referenced this pull request Jan 24, 2025

Network: De-duplicate uplink address allocation logic (#14848)

a055765

This factors out common logic for allocating uplink addresses to network forwards and load balancers. Pre-requisite for #14631

hamistao force-pushed the project_uplink_ip_quotas branch 7 times, most recently from 2c3824c to 3cc7b25 Compare January 25, 2025 19:28

hamistao added 10 commits January 26, 2025 20:15

api: Add projects_limits_uplink_ips extension

3e24001

Signed-off-by: hamistao <[email protected]>

lxd/project/limits: Create UplinkAddressQuotasExceeded

f9ab285

Signed-off-by: hamistao <[email protected]>

lxd/api_project: Add projectName argument to projectValidateConfig

eae4216

Signed-off-by: hamistao <[email protected]>

lxd/api_project: Introduce limits.networks.uplink_ips.* config keys…

84dd9ab

… to projects Signed-off-by: hamistao <[email protected]>

lxd/network/common: Create projectUplinkIPQuotaAvailable

b4e83fe

Signed-off-by: hamistao <[email protected]>

lxd/network/ovn: Check uplink IP limits on allocateUplinkAddress

21c95ca

Signed-off-by: hamistao <[email protected]>

lxd/network/ovn: Check uplink IP limits on allocateUplinkPortIPs

a0e8a62

This is useful to prevent newly created ovn networks to exceed the allowed quota for uplink IPs in its project Signed-off-by: hamistao <[email protected]>

make update-metadata

46bf593

Signed-off-by: hamistao <[email protected]>

test/suites: Add tests for project uplink IP limits

2e5ca4f

It has a couple lines of unrelated tests thrown in as well, such as testing a forward/load-balancer can't use listen addresses outside uplink routes. Signed-off-by: hamistao <[email protected]>

hamistao force-pushed the project_uplink_ip_quotas branch from 3cc7b25 to 2e5ca4f Compare January 26, 2025 23:26

hamistao marked this pull request as ready for review January 26, 2025 23:26

tomponline approved these changes Jan 27, 2025

View reviewed changes

tomponline merged commit c7770ec into canonical:main Jan 27, 2025
28 checks passed

hamistao deleted the project_uplink_ip_quotas branch January 27, 2025 13:25

hamistao mentioned this pull request Jan 27, 2025

Projects: Deny restricting a project that is using a forbidden uplink #14867

Merged

MusicDin reviewed Feb 3, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Per-project uplink IP quotas #14631

Per-project uplink IP quotas #14631

hamistao commented Dec 10, 2024 •

edited

Loading

hamistao commented Dec 10, 2024

minaelee commented Dec 11, 2024

hamistao commented Dec 11, 2024

tomponline commented Dec 11, 2024

tomponline commented Dec 11, 2024

hamistao commented Dec 12, 2024

hamistao commented Dec 12, 2024 •

edited

Loading

tomponline left a comment

MusicDin Feb 3, 2025

hamistao Feb 3, 2025

		// shortdesc: Quota of IPv4 addresses from a specified uplink network that can be used by entities in this project
		projectConfigKeys["limits.networks.uplink_ips.ipv6."+networkName] = validate.Optional(uplinkIPLimitValidator(s, projectName, networkName, "ipv6"))

Per-project uplink IP quotas #14631

Per-project uplink IP quotas #14631

Conversation

hamistao commented Dec 10, 2024 • edited Loading

hamistao commented Dec 10, 2024

minaelee commented Dec 11, 2024

hamistao commented Dec 11, 2024

tomponline commented Dec 11, 2024

tomponline commented Dec 11, 2024

hamistao commented Dec 12, 2024

hamistao commented Dec 12, 2024 • edited Loading

tomponline left a comment

Choose a reason for hiding this comment

MusicDin Feb 3, 2025

Choose a reason for hiding this comment

hamistao Feb 3, 2025

Choose a reason for hiding this comment

hamistao commented Dec 10, 2024 •

edited

Loading

hamistao commented Dec 12, 2024 •

edited

Loading