Re: [v6ops] State of play as of today

[Tom Herbert <[e-mail]>]

>>> I do have a proposal from Tom Herbert (formerly Google, now Facebook) to discuss https://tools.ietf.org/html/draft-herbert-nvo3-ila. This is interesting in the context of allocation of a /64 to a host in a >data center. He tells me that there are a few changes (notably a routable interior address) in a version he is about to post, and that Facebook plans some "canary" deployments to test the concepts. I >tend to think it would be an interesting discussion, but have not heard from the working group.
>>
>> If Tom could please update the document with an email that does not bounce back when people contact him for his submission, I'd appreciate it.
>
Sorry about that, I'll update the draft soon.

> He seems to be using [e-mail]
>
Yes.

>>  Certainly, this work could be discussed including the fact whether the consensus is to remain within the 64-bit boundary between the interface-id vs. not for any IPv6 addressing.
>>
>> Other comments:
>>
>> In section5.1.2 , the document says "Since migrations should be relatively rare events,".   If migration is a rare event, is it worth solving the task move problem?  Why not stay with "not to migrate" until the task runs to completion and not work on any ILA?
>>
Rare is relative here, in a large data center we could be migrating
hundreds of jobs per second. There are also instances where we need to
a mass migration like when we need to bring down a cluster for repair.
The salient property is that the cost of adding the ability to migrate
is near zero when tasks that are not migrating.

>> The WG  and the author could decide if the document serves the purpose for ILA and task move but keeps away from tenant separation because the security  in section 5.2 and its 3rd paragraph which ends in "not considered a significant risk" is questionable.   I suspect security will take lot more effort.

It's not a significant security risk in the sense that all tenants are
already part of the same entity. In a cloud application with third
party untrusting tenants then ILA would probably not offer adequate
security (although I would point out that this is no worse security
than with VXLAN).

Tom

>>
>> Thanks,
>>
>> Hemant
>