Chapter 9. Using Quality of Service (QoS) policies to manage data traffic

Procedure

1. Log in to the undercloud host as the stack user.

2. Source the undercloud credentials file:

   $ source ~/stackrc

3. Confirm that the qos service plug-in is not already loaded.

   $ openstack network qos policy list

   If the qos service plug-in is not loaded, then you receive a ResourceNotFound error. If you do not receive the error, then the plug-in is loaded and you do not need to perform the steps in this topic.

4. Create a YAML custom environment file.

   Example

   $ vi /home/stack/templates/my-neutron-environment.yaml

5. Your environment file must contain the keywords parameter_defaults. On a new line below parameter_defaults add qos to the NeutronServicePlugins parameter:

   parameter_defaults:
      NeutronServicePlugins: "qos"

6. If you use ML2/OVS and ML2/SR-IOV mechanism drivers, then you must also load the qos extension on the agent, by using either the NeutronAgentExtensions or the NeutronSriovAgentExtensions variable, respectively:

   • ML2/OVS

     parameter_defaults:
       NeutronServicePlugins: "qos"
       NeutronAgentExtensions: "qos"

   • ML2/SR-IOV

     parameter_defaults:
       NeutronServicePlugins: "qos"
       NeutronSriovAgentExtensions: "qos"

7. If you want to schedule VM instances by using minimum bandwidth QoS policies, then you must also do the following:

   1. Add placement to the list of plug-ins and ensure the list also includes qos:

      parameter_defaults:
         NeutronServicePlugins: "qos,placement"

   2. If the hypervisor name matches the canonical hypervisor name used by the Compute service (nova), skip to step 7.iii.

      If the hypervisor name does not match the canonical hypervisor name used by the Compute service, specify the alternative hypervisor name, using resource_provider_default_hypervisor:

      • ML2/OVS

        parameter_defaults:
          NeutronServicePlugins: "qos,placement"
          ExtraConfig:
            Neutron::agents::ml2::ovs::resource_provider_default_hypervisor: %{hiera('fqdn_canonical')}

      • ML2/SR-IOV

        parameter_defaults:
          NeutronServicePlugins: "qos,placement"
          ExtraConfig:
            Neutron::agents::ml2::sriov::resource_provider_default_hypervisor: %{hiera('fqdn_canonical')}

        Important

        Another method for setting the alternative hypervisor name is to use resource_provider_hypervisor:

        • ML2/OVS

          parameter_defaults:
            ExtraConfig:
               Neutron::agents::ml2::ovs::resource_provider_hypervisors:"ens5:%{hiera('fqdn_canonical')},ens6:%{hiera('fqdn_canonical')}"

        • ML2/SR-IOV

          parameter_defaults:
            ExtraConfig:
               Neutron::agents::ml2::sriov::resource_provider_hypervisors:
               "ens5:%{hiera('fqdn_canonical')},ens6:%{hiera('fqdn_canonical')}"

   3. Configure the resource provider ingress and egress bandwidths for the relevant agents on each Compute node that needs to provide a minimum bandwidth.

      You can configure egress, ingress, or both, using the following formats:

      • Configure only egress bandwidth, in kbps:

        NeutronOvsResourceProviderBandwidths: <bridge0>:<egress_kbps>:,<bridge1>:<egress_kbps>:,...,<bridgeN>:<egress_kbps>:

      • Configure only ingress bandwidth, in kbps:

        NeutronOvsResourceProviderBandwidths: <bridge0>::<ingress_kbps>,<bridge1>::<ingress_kbps>,...,<bridgeN>::<ingress_kbps>

      • Configure both egress and ingress bandwidth, in kbps:

        NeutronOvsResourceProviderBandwidths: <bridge0>:<egress_kbps>:<ingress_kbps>,<bridge1>:<egress_kbps>:<ingress_kbps>,...,<bridgeN>:<egress_kbps>:<ingress_kbps>

        Example - OVS agent

        To configure the resource provider ingress and egress bandwidths for the OVS agent, add the following configuration to your network environment file:

        parameter_defaults:
          ...
          NeutronBridgeMappings: physnet0:br-physnet0
          NeutronOvsResourceProviderBandwidths: br-physnet0:10000000:10000000

        Example - SRIOV agent

        To configure the resource provider ingress and egress bandwidths for the SRIOV agent, add the following configuration to your network environment file:

        parameter_defaults:
          ...
          NeutronML2PhysicalNetworkMtus: physnet0:1500,physnet1:1500
          NeutronSriovResourceProviderBandwidths: ens5:40000000:40000000,ens6:40000000:40000000

   4. Optional: To mark vnic_types as not supported when multiple ML2 mechanism drivers support them by default and multiple agents are being tracked in the Placement service, also add the following configuration to your environment file:

      Example - OVS agent

      parameter_defaults:
        ...
        NeutronOvsVnicTypeBlacklist: direct

      Example - SRIOV agent

      parameter_defaults:
        ...
        NeutronSriovVnicTypeBlacklist: direct

8. If you want to create DSCP marking policies and use ML2/OVS with a tunneling protocol (VXLAN or GRE), then under NeutronAgentExtensions, add the following lines:

   parameter_defaults:
     ...
     ControllerExtraConfig:
       neutron::config::server_config:
           agent/dscp_inherit:
               value: true

   When dscp_inherit is true, the Networking service copies the DSCP value of the inner header to the outer header.

9. Run the deployment command and include the core heat templates, other environment files, and this new custom environment file.

   Important

   The order of the environment files is important because the parameters and resources defined in subsequent environment files take precedence.

   Example

   $ openstack overcloud deploy --templates \
   -e <other_environment_files> \
   -e /home/stack/templates/my-neutron-environment.yaml

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Confirm that the qos service plug-in is loaded in the Networking service:

   $ openstack network qos policy list

   If the qos service plug-in is not loaded, then you receive a ResourceNotFound error, and you must load the qos services plug-in before you can continue. For more information, see Section 9.2, “Configuring the Networking service for QoS policies”.

3. Identify the ID of the project you want to create the QoS policy for:

   $ openstack project list

   Sample output

   +----------------------------------+----------+
   | ID                               | Name     |
   +----------------------------------+----------+
   | 4b0b98f8c6c040f38ba4f7146e8680f5 | auditors |
   | 519e6344f82e4c079c8e2eabb690023b | services |
   | 80bf5732752a41128e612fe615c886c6 | demo     |
   | 98a2f53c20ce4d50a40dac4a38016c69 | admin    |
   +----------------------------------+----------+

4. Using the project ID from the previous step, create a QoS policy for the project.

   Example

   In this example, a QoS policy named bw-limiter is created for the admin project:

   $ openstack network qos policy create --share --project 98a2f53c20ce4d50a40dac4a38016c69 bw-limiter

5. Configure the rules for the policy.

   Note

   You can add more than one rule to a policy, as long as the type or direction of each rule is different. For example, You can specify two bandwidth-limit rules, one with egress and one with ingress direction.

   Example

   In this example, QoS ingress and egress rules are created for the policy named bw-limiter with a bandwidth limit of 50000 kbps and a maximum burst size of 50000 kbps:

   $ openstack network qos rule create --type bandwidth-limit \
       --max-kbps 50000 --max-burst-kbits 50000 --ingress bw-limiter
   
   $ openstack network qos rule create --type bandwidth-limit \
       --max-kbps 50000 --max-burst-kbits 50000 --egress bw-limiter

6. You can create a port with a policy attached to it, or attach a policy to a pre-existing port.

   Example - create a port with a policy attached

   In this example, the policy bw-limiter is associated with port port2:

   $ openstack port create --qos-policy bw-limiter --network private port2

   Sample output

   +-----------------------+--------------------------------------------------+
   | Field                 | Value                                            |
   +-----------------------+--------------------------------------------------+
   | admin_state_up        | UP                                               |
   | allowed_address_pairs |                                                  |
   | binding_host_id       |                                                  |
   | binding_profile       |                                                  |
   | binding_vif_details   |                                                  |
   | binding_vif_type      | unbound                                          |
   | binding_vnic_type     | normal                                           |
   | created_at            | 2022-07-04T19:20:24Z                             |
   | data_plane_status     | None                                             |
   | description           |                                                  |
   | device_id             |                                                  |
   | device_owner          |                                                  |
   | dns_assignment        | None                                             |
   | dns_name              | None                                             |
   | extra_dhcp_opts       |                                                  |
   | fixed_ips             | ip_address='192.0.2.210', subnet_id='292f8c-...' |
   | id                    | f51562ee-da8d-42de-9578-f6f5cb248226             |
   | ip_address            | None                                             |
   | mac_address           | fa:16:3e:d9:f2:ba                                |
   | name                  | port2                                            |
   | network_id            | 55dc2f70-0f92-4002-b343-ca34277b0234             |
   | option_name           | None                                             |
   | option_value          | None                                             |
   | port_security_enabled | False                                            |
   | project_id            | 98a2f53c20ce4d50a40dac4a38016c69                 |
   | qos_policy_id         | 8491547e-add1-4c6c-a50e-42121237256c             |
   | revision_number       | 6                                                |
   | security_group_ids    | 0531cc1a-19d1-4cc7-ada5-49f8b08245be             |
   | status                | DOWN                                             |
   | subnet_id             | None                                             |
   | tags                  | []                                               |
   | trunk_details         | None                                             |
   | updated_at            | 2022-07-04T19:23:00Z                             |
   +-----------------------+--------------------------------------------------+

   Example - attach a policy to a pre-existing port

   In this example, the policy bw-limiter is associated with port1:

   $ openstack port set --qos-policy bw-limiter port1

Procedure

1. Source your credentials file.

   Example

   $ source ~/overcloudrc

2. Confirm that the qos service plug-in is loaded in the Networking service:

   $ openstack network qos policy list

   If the qos service plug-in is not loaded, then you receive a ResourceNotFound error, and you must configure the Networking service before you can continue. For more information, see Section 9.2, “Configuring the Networking service for QoS policies”.

3. Identify the ID of the project you want to create the QoS policy for:

   $ openstack project list

   Sample output

   +----------------------------------+----------+
   | ID                               | Name     |
   +----------------------------------+----------+
   | 4b0b98f8c6c040f38ba4f7146e8680f5 | auditors |
   | 519e6344f82e4c079c8e2eabb690023b | services |
   | 80bf5732752a41128e612fe615c886c6 | demo     |
   | 98a2f53c20ce4d50a40dac4a38016c69 | admin    |
   +----------------------------------+----------+

4. Using the project ID from the previous step, create a QoS policy for the project.

   Example

   In this example, a QoS policy named qos-web-servers is created for the admin project:

   openstack network qos policy create --project 98a2f53c20ce4d50a40dac4a38016c69 qos-web-servers

5. Create a DSCP rule and apply it to a policy.

   Example

   In this example, a DSCP rule is created using DSCP mark 18 and is applied to the qos-web-servers policy:

   openstack network qos rule create --type dscp-marking --dscp-mark 18 qos-web-servers

   Sample output

   Created a new dscp_marking_rule:
   +-----------+--------------------------------------+
   | Field     | Value                                |
   +-----------+--------------------------------------+
   | dscp_mark | 18                                   |
   | id        | d7f976ec-7fab-4e60-af70-f59bf88198e6 |
   +-----------+--------------------------------------+

6. You can change the DSCP value assigned to a rule.

   Example

   In this example, the DSCP mark value is changed to 22 for the rule, d7f976ec-7fab-4e60-af70-f59bf88198e6, in the qos-web-servers policy:

   $ openstack network qos rule set --dscp-mark 22 qos-web-servers d7f976ec-7fab-4e60-af70-f59bf88198e6

7. You can delete a DSCP rule.

   Example

   In this example, the DSCP rule, d7f976ec-7fab-4e60-af70-f59bf88198e6, in the qos-web-servers policy is deleted:

   $ openstack network qos rule delete qos-web-servers d7f976ec-7fab-4e60-af70-f59bf88198e6