JIRA:IPVSIX-29

Change-Id: Ibd7e1af42bf474836e81a38b7fbad1b93ebcd78f
Signed-off-by: Bin Hu <bh526r@att.com>

1 files changed, 102 insertions, 153 deletions

diff --git a/docs/gapanalysis/gap-analysis-openstack-kilo.rst b/docs/gapanalysis/gap-analysis-openstack-kilo.rst
index dea09ba..29f563c 100644
--- a/docs/gapanalysis/gap-analysis-openstack-kilo.rst
+++ b/docs/gapanalysis/gap-analysis-openstack-kilo.rst
@@ -10,156 +10,105 @@ requirements of VIM-agnostic IPv6 functionality, including infrastructure layer
 .. table::
   :class: longtable
 
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Use Case / Requirement               |Supported in Neutron     |Notes                            |
-  +=====================================+=========================+=================================+
-  |All topologies work in a multi-tenant|Yes                      |The IPv6 design is following the |
-  |environment                          |                         |Neutron tenant networks model;   |
-  |                                     |                         |dnsmasq is being used inside DHCP|
-  |                                     |                         |network namespaces, while radvd  |
-  |                                     |                         |is being used inside Neutron     |
-  |                                     |                         |routers namespaces to provide    |
-  |                                     |                         |full isolation between tenants.  |
-  |                                     |                         |Tenant isolation can be based on |
-  |                                     |                         |VLANs, GRE, or VXLAN             |
-  |                                     |                         |encapsulation. In case of        |
-  |                                     |                         |overlays, the transport network  |
-  |                                     |                         |(and VTEPs) must be IPv4 based as|
-  |                                     |                         |of today.                        |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |IPv6 VM to VM only                   |Yes                      |It is possible to assign IPv6-   |
-  |                                     |                         |only addresses to VMs. Both      |
-  |                                     |                         |switching (within VMs on the same|
-  |                                     |                         |tenant network) as well as east/ |
-  |                                     |                         |west routing (between different  |
-  |                                     |                         |networks of the same tenant) are |
-  |                                     |                         |supported.                       |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |IPv6 external L2 VLAN directly       |Yes                      |IPv6 provider network model; RA  |
-  |attached to a VM                     |                         |messages from upstream (external)|
-  |                                     |                         |router are forwarded into the VMs|
-  +-------------------------------------+-------------------------+---------------------------------+
-  |IPv6 subnet routed via L3 agent to an|                         |Configuration is enhanced in Kilo|
-  |external IPv6 network                |                         |to allow easier setup of the     |
-  |                                     |1. Yes                   |upstream gateway, without the    |
-  |1. Both VLAN and overlay (e.g. GRE,  |                         |user forced to create an IPv6    |
-  |   VXLAN) subnet attached to VMs;    |                         |subnet for the external network. |
-  |2. Must be able to support multiple  |2. Yes                   |                                 |
-  |   L3 agents for a given external    |                         |                                 |
-  |   network to support scaling        |                         |                                 |
-  |   (neutron scheduler to assign      |                         |                                 |
-  |   vRouters to the L3 agents)        |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Ability for a NIC to support both    |                         |Dual-stack is supported in       |
-  |IPv4 and IPv6 (dual stack) address.  |                         |Neutron with the addition of     |
-  |                                     |                         |``Multiple IPv6 Prefixes``       |
-  |1. VM with a single interface        |1. Yes                   |Blueprint                        |
-  |   associated with a network, which  |                         |                                 |
-  |   is then associated with two       |                         |                                 |
-  |   subnets                           |                         |                                 |
-  |2. VM with two different interfaces  |2. Yes                   |                                 |
-  |   associated with two different     |                         |                                 |
-  |   networks and two different subnets|                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Support IPv6 Address assignment modes|1. Yes                   |                                 |
-  |                                     |                         |                                 |
-  |1. SLAAC                             |2. Yes                   |                                 |
-  |2. DHCPv6 Stateless                  |                         |                                 |
-  |3. DHCPv6 Stateful                   |3. Yes                   |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Ability to create a port on an IPv6  |Yes                      |                                 |
-  |DHCPv6 Stateful subnet and assign a  |                         |                                 |
-  |specific IPv6 address to the port and|                         |                                 |
-  |have it taken out of the DHCP address|                         |                                 |
-  |pool.                                |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Ability to create a port with        |**No**                   |The following patch disables this|
-  |fixed_ip for a SLAAC/DHCPv6-Stateless|                         |operation: https://review.opensta|
-  |Subnet.                              |                         |ck.org/#/c/129144/               |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Support for private IPv6 to external |**Rejected**             |Blueprint proposed in upstream   |
-  |IPv6 floating IP; Ability to specify |                         |and got rejected. General        |
-  |floating IPs via Neutron API (REST   |                         |expectation is to avoid NAT with |
-  |and CLI) as well as via Horizon,     |                         |IPv6 by assigning GUA to tenant  |
-  |including combination of IPv6/IPv4   |                         |VMs. See https://review.openstack|
-  |and IPv4/IPv6 floating IPs if        |                         |.org/#/c/139731/ for discussion. |
-  |implemented.                         |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Provide IPv6/IPv4 feature parity in  |**To-Do**                |The L3 configuration should be   |
-  |support for pass-through capabilities|                         |transparent for the SR-IOV       |
-  |(e.g., SR-IOV).                      |                         |implementation. SR-IOV networking|
-  |                                     |                         |support introduced in Juno based |
-  |                                     |                         |on the ``sriovnicswitch`` ML2    |
-  |                                     |                         |driver is expected to work with  |
-  |                                     |                         |IPv4 and IPv6 enabled VMs. We    |
-  |                                     |                         |need to verify if it works or not|
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Additional IPv6 extensions, for      |**No**                   |It does not appear to be         |
-  |example: IPSEC, IPv6 Anycast,        |                         |considered yet (lack of clear    |
-  |Multicast                            |                         |requirements)                    |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |VM access to the meta-data server to |**No**                   |This is currently not supported. |
-  |obtain user data, SSH keys, etc.     |                         |Config-drive or dual-stack IPv4/ |
-  |using cloud-init with IPv6 only      |                         |IPv6 can be used as a workaround |
-  |interfaces.                          |                         |(so that the IPv4 network is used|
-  |                                     |                         |to obtain connectivity with the  |
-  |                                     |                         |metadata service)                |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Full support for IPv6 matching (i.e.,|Yes                      |                                 |
-  |IPv6, ICMPv6, TCP, UDP) in security  |                         |                                 |
-  |groups. Ability to control and manage|                         |                                 |
-  |all IPv6 security group capabilities |                         |                                 |
-  |via Neutron/Nova API (REST and CLI)  |                         |                                 |
-  |as well as via Horizon.              |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |During network/subnet/router create, |Yes                      |Two new Subnet attributes were   |
-  |there should be an option to allow   |                         |introduced to control IPv6       |
-  |user to specify the type of address  |                         |address assignment options:      |
-  |management they would like. This     |                         |                                 |
-  |includes all options including those |                         |* ``ipv6-ra-mode``: to determine |
-  |low priority if implemented (e.g.,   |                         |  who sends Router Advertisements|
-  |toggle on/off router and address     |                         |                                 |
-  |prefix advertisements); It must be   |                         |* ``ipv6-address-mode``: to      |
-  |supported via Neutron API (REST and  |                         |  determine how VM obtains IPv6  |
-  |CLI) as well as via Horizon          |                         |  address, default gateway, and/ |
-  |                                     |                         |  or optional information.       |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Security groups anti-spoofing:       |Yes                      |                                 |
-  |Prevent VM from using a source       |                         |                                 |
-  |IPv6/MAC address which is not        |                         |                                 |
-  |assigned to the VM                   |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Protect tenant and provider network  |Yes                      |When using a tenant network,     |
-  |from rough RAs                       |                         |Neutron is going to automatically|
-  |                                     |                         |handle the filter rules to allow |
-  |                                     |                         |connectivity of RAs to the VMs   |
-  |                                     |                         |only from the Neutron router     |
-  |                                     |                         |port; with provider networks,    |
-  |                                     |                         |users are required to specify the|
-  |                                     |                         |LLA of the upstream router during|
-  |                                     |                         |the subnet creation, or otherwise|
-  |                                     |                         |manually edit the security-groups|
-  |                                     |                         |rules to allow incoming traffic  |
-  |                                     |                         |from this specific address.      |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Support the ability to assign        |Yes                      |                                 |
-  |multiple IPv6 addresses to an        |                         |                                 |
-  |interface; both for Neutron router   |                         |                                 |
-  |interfaces and VM interfaces.        |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Ability for a VM to support a mix of |Yes                      |                                 |
-  |multiple IPv4 and IPv6 networks,     |                         |                                 |
-  |including multiples of the same type.|                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Support for IPv6 Prefix Delegation.  |**Roadmap**              |Some partial support is available|
-  |                                     |                         |in Liberty release               |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |Distributed Virtual Routing (DVR)    |**No**                   |Blueprint proposed upstream,     |
-  |support for IPv6                     |                         |pending discussion               |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |IPv6 First-Hop Security, IPv6 ND     |**Roadmap**              |Supported in Liberty release     |
-  |spoofing.                            |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
-  |IPv6 support in Neutron Layer3 High  |Yes                      |                                 |
-  |Availability (keepalived+VRRP).      |                         |                                 |
-  +-------------------------------------+-------------------------+---------------------------------+
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Use Case / Requirement                                     |Supported in Kilo Neutron|Notes                                                               |
+  +===========================================================+=========================+====================================================================+
+  |All topologies work in a multi-tenant environment          |Yes                      |The IPv6 design is following the Neutron tenant networks model;     |
+  |                                                           |                         |dnsmasq is being used inside DHCP network namespaces, while radvd   |
+  |                                                           |                         |is being used inside Neutron routers namespaces to provide full     |
+  |                                                           |                         |isolation between tenants. Tenant isolation can be based on VLANs,  |
+  |                                                           |                         |GRE, or VXLAN encapsulation. In case of overlays, the transport     |
+  |                                                           |                         |network (and VTEPs) must be IPv4 based as of today.                 |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |IPv6 VM to VM only                                         |Yes                      |It is possible to assign IPv6-only addresses to VMs. Both switching |
+  |                                                           |                         |(within VMs on the same tenant network) as well as east/west routing|
+  |                                                           |                         |(between different networks of the same tenant) are supported.      |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |IPv6 external L2 VLAN directly attached to a VM            |Yes                      |IPv6 provider network model; RA messages from upstream (external)   |
+  |                                                           |                         |router are forwarded into the VMs                                   |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |IPv6 subnet routed via L3 agent to an external IPv6 network|                         |Configuration is enhanced in Kilo to allow easier setup of the      |
+  |                                                           |1. Yes                   |upstream gateway, without the user forced to create an IPv6 subnet  |
+  |1. Both VLAN and overlay (e.g. GRE, VXLAN) subnet attached |                         |for the external network.                                           |
+  |   to VMs;                                                 |                         |                                                                    |
+  |2. Must be able to support multiple L3 agents for a given  |2. Yes                   |                                                                    |
+  |   external network to support scaling (neutron scheduler  |                         |                                                                    |
+  |   to assign vRouters to the L3 agents)                    |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Ability for a NIC to support both IPv4 and IPv6 (dual      |                         |Dual-stack is supported in Neutron with the addition of             |
+  |stack) address.                                            |                         |``Multiple IPv6 Prefixes`` Blueprint                                |
+  |                                                           |                         |                                                                    |
+  |1. VM with a single interface associated with a network,   |1. Yes                   |                                                                    |
+  |   which is then associated with two subnets.              |                         |                                                                    |
+  |2. VM with two different interfaces associated with two    |2. Yes                   |                                                                    |
+  |   different networks and two different subnets.           |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Support IPv6 Address assignment modes.                     |1. Yes                   |                                                                    |
+  |                                                           |                         |                                                                    |
+  |1. SLAAC                                                   |2. Yes                   |                                                                    |
+  |2. DHCPv6 Stateless                                        |                         |                                                                    |
+  |3. DHCPv6 Stateful                                         |3. Yes                   |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Ability to create a port on an IPv6 DHCPv6 Stateful subnet |Yes                      |                                                                    |
+  |and assign a specific IPv6 address to the port and have it |                         |                                                                    |
+  |taken out of the DHCP address pool.                        |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Ability to create a port with fixed_ip for a               |**No**                   |The following patch disables this operation:                        |
+  |SLAAC/DHCPv6-Stateless Subnet.                             |                         |https://review.openstack.org/#/c/129144/                            |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Support for private IPv6 to external IPv6 floating IP;     |**Rejected**             |Blueprint proposed in upstream and got rejected. General expectation|
+  |Ability to specify floating IPs via Neutron API (REST and  |                         |is to avoid NAT with IPv6 by assigning GUA to tenant VMs. See       |
+  |CLI) as well as via Horizon, including combination of      |                         |https://review.openstack.org/#/c/139731/ for discussion.            |
+  |IPv6/IPv4 and IPv4/IPv6 floating IPs if implemented.       |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Provide IPv6/IPv4 feature parity in support for            |**To-Do**                |The L3 configuration should be transparent for the SR-IOV           |
+  |pass-through capabilities (e.g., SR-IOV).                  |                         |implementation. SR-IOV networking support introduced in Juno based  |
+  |                                                           |                         |on the ``sriovnicswitch`` ML2 driver is expected to work with IPv4  |
+  |                                                           |                         |and IPv6 enabled VMs. We need to verify if it works or not          |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Additional IPv6 extensions, for example: IPSEC, IPv6       |**No**                   |It does not appear to be considered yet (lack of clear requirements)|
+  |Anycast, Multicast                                         |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |VM access to the meta-data server to obtain user data, SSH |**No**                   |This is currently not supported. Config-drive or dual-stack IPv4 /  |
+  |keys, etc. using cloud-init with IPv6 only interfaces.     |                         |IPv6 can be used as a workaround (so that the IPv4 network is used  |
+  |                                                           |                         |to obtain connectivity with the metadata service)                   |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Full support for IPv6 matching (i.e., IPv6, ICMPv6, TCP,   |Yes                      |                                                                    |
+  |UDP) in security groups. Ability to control and manage all |                         |                                                                    |
+  |IPv6 security group capabilities via Neutron/Nova API (REST|                         |                                                                    |
+  |and CLI) as well as via Horizon.                           |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |During network/subnet/router create, there should be an    |Yes                      |Two new Subnet attributes were introduced to control IPv6 address   |
+  |option to allow user to specify the type of address        |                         |assignment options:                                                 |
+  |management they would like. This includes all options      |                         |                                                                    |
+  |including those low priority if implemented (e.g., toggle  |                         |* ``ipv6-ra-mode``: to determine who sends Router Advertisements;   |
+  |on/off router and address prefix advertisements); It must  |                         |                                                                    |
+  |be supported via Neutron API (REST and CLI) as well as via |                         |* ``ipv6-address-mode``: to determine how VM obtains IPv6 address,  |
+  |Horizon                                                    |                         |  default gateway, and/or optional information.                     |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Security groups anti-spoofing: Prevent VM from using a     |Yes                      |                                                                    |
+  |source IPv6/MAC address which is not assigned to the VM    |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Protect tenant and provider network from rough RAs         |Yes                      |When using a tenant network, Neutron is going to automatically      |
+  |                                                           |                         |handle the filter rules to allow connectivity of RAs to the VMs only|
+  |                                                           |                         |from the Neutron router port; with provider networks, users are     |
+  |                                                           |                         |required to specify the LLA of the upstream router during the subnet|
+  |                                                           |                         |creation, or otherwise manually edit the security-groups rules to   |
+  |                                                           |                         |allow incoming traffic from this specific address.                  |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Support the ability to assign multiple IPv6 addresses to   |Yes                      |                                                                    |
+  |an interface; both for Neutron router interfaces and VM    |                         |                                                                    |
+  |interfaces.                                                |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Ability for a VM to support a mix of multiple IPv4 and IPv6|Yes                      |                                                                    |
+  |networks, including multiples of the same type.            |                         |                                                                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Support for IPv6 Prefix Delegation.                        |**Roadmap**              |Some partial support is available in Liberty release                |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+  |Distributed Virtual Routing (DVR) support for IPv6         |**No**                   |Blueprint proposed upstream, pending discussion.                    |
+  +-----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+|  IPv6 First-Hop Security, IPv6 ND spoofing.                 |**Roadmap**              |Supported in Liberty release                                        |
++  -----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+
+|  IPv6 support in Neutron Layer3 High Availability           |Yes                      |                                                                    |
+|  (keepalived+VRRP).                                         |                         |                                                                    |
++  -----------------------------------------------------------+-------------------------+--------------------------------------------------------------------+