Network Multi-tenancy in Xen-based Clouds

### Overview In this talk, Chiradeep from Citrix's Cloud Platforms Group discusses strategies and architectures for implementing network multi-tenancy in Xen-based clouds using Apache Cloud Stack. Covering the history of CloudStack from its origins at Cloud.com to its graduation as an Apache Software Foundation top-level project, the presentation outlines how CloudStack orchestrates compute, storage, and networking to provide isolated multi-tenant environments similar to public cloud models like AWS.

### Key Topics - **Multi-Tenant Challenges in IaaS:** Cloud tenants deploy multi-tier architectures (e.g., web, application, and database tiers) requiring isolation, custom security rules, overlapping IP spaces, and dedicated edge services such as firewalls, NAT, VPNs, and load balancers. - **Network Virtualization (L2 Isolation):** Techniques giving tenants the illusion of private networks over shared hardware. Traditional VLANs face scale limitations (12-bit ID/4096 limit, trunking requirements), while overlay technologies (VXLAN, STT, GRE) leverage tunnels between hypervisors with identifiers like 32-bit GRE keys. - **L3 Isolation and Security Groups:** An alternative model where VMs share physical address spaces, but cross-tenant communication is restricted directly at the hypervisor level in Dom0 using stateful iptables filtering and ipset optimization. - **Private VLANs (PVLAN):** Used as an isolation mechanism where tenants share a VLAN but are prevented from communicating with adjacent VMs via Open vSwitch (OVS) rules, directing traffic upstream through a router. - **Extensible SDN Integrations:** CloudStack's pluggable network model, which integrates with native GRE SDN controllers and third-party solutions including Nicira, Midokura, Big Switch, Stratosphere, Juniper Contrail, and OpenDaylight.

### Technical Details - **Hardware & Architecture:** CloudStack coordinates XenServer/XCP hypervisors, primary shared storage for active VM instances, and secondary storage for disk images, snapshots, and ISOs, backed by a MySQL database and management server cluster. - **L3 Filtering Stack:** To achieve L3 isolation, iptables rules are enforced across the bridge in Dom0. Because Open vSwitch lacked a built-in stateful firewall at the time, bridging with iptables and ipset was required. In contrast, KVM combined OVS and iptables via an intermediate bridge setup (sometimes referred to as a "frankenswitch"). - **Service Catalog Abstraction:** CloudStack exposes service offerings (such as gold tiers) that decouple configuration from physical implementation, allowing operators to seamlessly upgrade network services from low-performance virtual appliances to dedicated hardware appliances (such as Juniper SRX firewalls or NetScaler load balancers) without altering VM configurations.

### Takeaways Network multi-tenancy requires balancing isolation mechanisms with scale and performance requirements. While VLANs remain standard despite port trunking and scalability constraints, overlay tunnels and L3 security group models provide higher scalability for massive multi-tenant deployments. CloudStack abstracts these choices via modular SDN integrations and service catalogs to give administrators flexibility while keeping VM orchestration straightforward for end users.