Table Of Contents

Contents

Previous topic

Robot Drivers

Next topic

Robot RCC

  1. Docs
  2. 3: Understanding CloudCIX
  3. Robot Primitives

Robot Primitives

Introduction

  • Primitives are python programs, responsible for instantiation of a Resource on Physical infrastructure.

  • They abstract the Hardware dependencies in the Pod.

  • Primitives is a layer above RCC(Reliable Communication Completion).

  • Primitives require Pod hardware parameters in a config.json file.

  • One or more Primitives involve to instantiate a Resource.

  • Information of the Resource supplied to the Primitives in the form of contract or params. The parameters structure is mentioned in each Primitive service below.

  • Every Primitive is developed individually such that no two Primitives interacts with each other.

  • The naming pattern of a Primitive is

    <Noun>[_Noun].<Verb>[_SubVerb]

  • Each step is logged to PAT’s logging server(Optional).

List of Supported Primitives Nouns

  • There are 15 Primitives, such as follows:

    1. backup

      Virtual Machine Backup

    2. bridgepri

      Private/VLAN Bridge (KVM only)

    3. bridgepub

      Public Subnet Bridge on PodNet

    4. firewall

      Global NFtable Firewall on PodNet

    5. firewallns

      Namespace NFtable Firewall on PodNet

    6. gpu

      GPU

    7. hyperv

      Virtual Machine on Windows hypervisor

    8. kvm

      Virtual Machine on KVM hypervisor

    9. net

      Global Network on PodNet

    10. netns

      Namespace Network on PodNet

    11. storagekvm

      Storage drives (QEMU images) on KVM

    12. rbd

      RadOS Block Device on Ceph cluster

    13. snapshot

      Virtual Machine Snapshot

    14. vpndyn

      WireGuard Dynamic VPN

    15. vpns2s

      StrongSwan Site to Site VPN

Verbs

The following table lists various verbs, their states, and any associated sub-verbs:

Name

State

SubVerbs

build

2

overwrite

quiesce

12

restart

13

scrub

17

scrubprep

14

updatequiesced

16

attach, detach

updaterunning

11

attach, detach

Primitives Software Breadcrumb

Primitives:

Hardware1[_Hardware].<Verb1>: . .

Hardware2[_Hardware].<Verb1>: . .

Primitive Error codes

  • Primitives don’t have error codes, they report to driver if there was a problem

  • Response from a primitive will be success with optional payloads (warning/success) or failure with error message

  • All possible outcomes from primitives are:

Return values

(True , Optional(success_payload))

(True, Optional(warning_payload))

(True, Optional(error_payload))

(False, error_payload)
  • Example output from a kvm_quiece primitive

    (True, ‘KVM #<kvm_id> already shut down’)

List of All Primivitive Verbs

backup:

  • backup_hyperv.build

  • backup_hyperv.scrub

  • backup_hyperv.updatequiesced

  • backup_hyperv.updaterunning

  • backup_kvm.build

  • backup_kvm.scrub

  • backup_kvm.updatequiesced

  • backup_kvm.updaterunning

bridgepri:

  • bridgepri.build

  • bridgepri.scrub

bridgepub:

  • bridgepub.build

firewall:

  • firewall.build

firewallns:

  • firewallns.build

gpu_kvm:

  • gpu_kvm.updatequiesced_attach

  • gpu_kvm.updatequiesced_detach

hyperv:

  • hyperv.build

  • hyperv.quiesce

  • hyperv.restart

  • hyperv.scrub

  • hyperv.scrubprep

  • hyperv.updatequiesced

  • hyperv.updaterunning

kvm:

  • kvm.build

  • kvm.quiesce

  • kvm.restart

  • kvm.scrub

  • kvm.scrubprep

  • kvm.updatequiesced

  • kvm.updaterunning

net:

  • net.build_overwrite

netns:

  • netns.build

  • netns.scrub

rbd:

  • rbd.build

  • rbd.scrub

  • rbd.updatequiesced

  • rbd.updaterunning

rbd_kvm:

  • rbd_kvm.updatequiesced_attach

  • rbd_kvm.updatequiesced_detach

snapshot_hyperv:

  • snapshot_hyperv.build

  • snapshot_hyperv.scrub

  • snapshot_hyperv.updatequiesced

  • snapshot_hyperv.updaterunning

snapshot_kvm:

  • snapshot_kvm.build

  • snapshot_kvm.scrub

  • snapshot_kvm.updatequiesced

  • snapshot_kvm.updaterunning

vpndyn:

  • vpndyn.build

  • vpndny.scrub

vpns2s:

  • vpns2s.build

  • vpns2s.scrub

Public Bridge

Basic Usage: primitives.bridgepub.<verb>

  • Supported Verb

    • build

  • IPv4 Public subnet bridge data for Namespace

    public_subnet = {
    'name': 'B123',                           #  :type str, Namespace's Floating subnet bridge name
    'address_range': '185.49.65.127/24',      #  :type str, network_ip/mask
    'gateway': '185.49.65.1',                 #  :type str, gateway of Floating subnet
}

Global Firewall

Basic Usage: primitives.firewall.<verb>

Namespace Firewall

Basic Usage: primitives.firewallns.<verb>

  • Supported Verb

    • build

  • Firewall Rule Writing

    firewall_rules = [
  {
    'action': 'drop',                    # string
    'description': 'Drop all',           # string
    'destination': ['any'],              # list of strings
    'interface': {'in': '', 'out': ''},  # dictionary
    'order': 1,                          # int
    'port': ['any'],                     # list of strings
    'protocol': 'any',                   # string
    'source': ['any'],                   # list of strings
    'version': 6,                        # int
  },
]

  • action can be one of the following:

    • ‘accept’ for allowing the traffic

    • ‘drop’ for dropping the traffic

  • destination can be:

    • [‘any’] for all IPs

    • [‘8.8.8.8’, ‘91.103.1.3’] for a list of IPs

  • Interface is a dict object, firewall rule is

    • Inbound if only in key in dict

    interface = {'in': 'public'}  # Inbound

    • Outbound if only out key in dict

    interface = {'out': 'management'}  # Outbound

    • Forward if both in and out keys are in dict

    interface = {'in': 'public', 'out': 'private'}  # Forward

  • Value names of the keys in dict can only be one of the following:

    • public

    • management

    • private

  • port can be:

    • [‘any’] any: for all Ports

    • [‘10-20’, ‘22’] for a list of Ports and Port ranges

  • protocol can be one of the following:

    • ‘tcp’

    • ‘udp’

    • ‘icmp4’

    • ‘icmp6’

    • ‘dns’

    • ‘vpn’

    • ‘any’ or an empty string

  • source can be:

    • [‘any’] any: for all IPs

    • [‘8.8.8.8’, ‘91.103.1.3’] for a list of IPs

  • version can be:

    • 4 for IPv4

    • 6 for IPv6

  • Global Services

These are the list of services applied common accross all the firewall rules. Supported service robosoc, is a CloudCIX inhouse developed security service that generates massive list of abusive IPs from various firewall system sources. To know more about RoboSOC Blocklist please visit https://robosoc.io

global_services = ['robosoc']

Global Network

Basic Usage: primitives.net.<verb>

Namespace Network

Basic Usage: primitives.netns.<verb>

  • Supported Verb

    • build_overwrite

  • PodNet interface’s data format

    'public' = {
    'ifname': 'eth0',                                                   #  interface name as on the PodNet
    'ips': [
        {'network_address': '192.168.0.2', 'prefixlen': '24'},          #  ip address with network_address
        {'network_address': '2a02:2078:9::142', 'prefixlen': '126'}     #  and prefixlen
    ],
    'routes': [
        {'to': 'default', 'via': '192.168.0.1'},
        {'to': '::/0', 'via': '2a02:2078::141'},
    ]
}

Namespace object structure

namespace = {
    'identifier': 'P123',                     #  :type str, name of the Namespace
    'ip4': {                                  #  :type object, public ip4 address
        'subnet_id': 345,                     #  :type int, public subnet id
        'address': '91.103.0.5',              #  :type str, public network address of namespace
        'mask': 25,                           #  :type int, public subnet mask
        'gateway': '91.103.0.1',              #  :type str, public subnet gateway
    }
    'ip6': {                                  #  :type object, ip6 address
        'address': '2a02:2078:9:fff0::2',     #  :type str, ipv6 network address of namespace
        'mask': 64,                           #  :type int, ipv6 subnet mask
        'gateway': '2a02:2078:9:fff0::1',     #  :type int, ipv6 subnet gateway
    }
    'networks': [{                            #  :type list, List of all the Namespace network objects
        'vlan': '1001',                               #  :type str, vlan number of the network in string
        'private_address_range': '192.168.0.1/24',    #  :type str, subnet_ip/subnet_mask
        'ip6_address_range': '2a02:2078:9:1003::1/64' #  :type str, subnet_ip/subnet_mask
    },
    ],
}

VPNs2s

Basic Usage: primitives.vpns2s.<verb>

  • Supported Verb

    • build

    • scrub

Robot Drivers
Robot RCC
© Copyright 2020 - 2024, CloudCIX authors and contributors. Created using Sphinx.