[jira] [Updated] (MESOS-4343) Introduce the ability to assign network handles to mesos containers

["Avinash Sridharan (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/MESOS-4343?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Avinash Sridharan updated MESOS-4343:
-------------------------------------
    Description: 
Linux provides net_cls as a cgroup subsystem. A net_cls cgroup is associated with a 16-bit major handle and a 16-bit minor handle.  When a task is associated with a net_cls cgroup, the kernel tags every packet being generated by the task with the major and minor handle associated with the net_cls cgroup. These tags are then used by network performance shaping and firewall tools such as tc (traffic controller) and iptables. 

Currently, mesos agents do not provide any isolator that can enable mesos-containers in a net_cls cgroup, or assign network handles to a net_cls cgroup. As part of this epic we plan to achieve the following:

a)  Implement net_cls cgroup isolator for mesos agents.
b)  Implement a manager for the net_cls handles.
c)  Allow operators to set a major network handle when launching an agent. 
d)  Expose the net_cls network handle allocated to a container, to entities such as operators and frameworks. 

Once the above goals are met operators can learn about network handles allocated to containers and apply them to tools such as tc and iptables to enforce network policies. 

  was:
Linux provides net_cls as a cgroup subsystem. A net_cls cgroup is associated with a 16-bit major handle and a 16-bit minor handle.  When a task is associated with a net_cls cgroup, the kernel tags every packet being generated by the task with the major and minor handle associated with the net_cls cgroup that the task belongs too. These tags are then used by network performance shaping and firewall tools such as tc (traffic controller) and iptables. 

Currently, mesos agents do not provide any isolator that can enable mesos-containers in a net_cls cgroup, or assign network handles to a net_cls cgroup. As part of this epic we plan to achieve the following:

a)  Implement net_cls cgroup isolator for mesos agents.
b)  Implement an net-handles allocator class that can manage.
c)  Allow operators to set a major network handle when launching an agent. 
d)  Expose the net_cls network handle allocated to a container, to entities such as operators and frameworks. 

Once the above goals are met operators can learn about network handles allocated to containers and apply them to tools such as tc and iptables to enforce network policies. 


> Introduce the ability to assign network handles to mesos containers
> -------------------------------------------------------------------
>
>                 Key: MESOS-4343
>                 URL: https://issues.apache.org/jira/browse/MESOS-4343
>             Project: Mesos
>          Issue Type: Epic
>          Components: containerization
>            Reporter: Avinash Sridharan
>            Assignee: Avinash Sridharan
>              Labels: containers, mesosphere
>             Fix For: 0.28.0
>
>
> Linux provides net_cls as a cgroup subsystem. A net_cls cgroup is associated with a 16-bit major handle and a 16-bit minor handle.  When a task is associated with a net_cls cgroup, the kernel tags every packet being generated by the task with the major and minor handle associated with the net_cls cgroup. These tags are then used by network performance shaping and firewall tools such as tc (traffic controller) and iptables. 
> Currently, mesos agents do not provide any isolator that can enable mesos-containers in a net_cls cgroup, or assign network handles to a net_cls cgroup. As part of this epic we plan to achieve the following:
> a)  Implement net_cls cgroup isolator for mesos agents.
> b)  Implement a manager for the net_cls handles.
> c)  Allow operators to set a major network handle when launching an agent. 
> d)  Expose the net_cls network handle allocated to a container, to entities such as operators and frameworks. 
> Once the above goals are met operators can learn about network handles allocated to containers and apply them to tools such as tc and iptables to enforce network policies. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)