962146 - Automated assignment of VLANs to systems

Status: RESOLVED WONTFIX

(Infrastructure & Operations Graveyard :: NetOps: Projects, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

As a part of the larger TaskCluster project, we'll be working to implement bare-metal provisioning of systems within releng.  That means doing fully automated installs on various hardware systems in the releng BU, of different types of systems.

Based on our security model of segregating different types of systems into different VLANs, that means that the same device will need to be provisioned in different VLANs over time.  Which means we need an automated way to change the VLAN assigned to a system's switch port.

From discussion with Adam, it looks like the way to implement this is via inventory, just like DNS/DHCP work now.  Presumably that would mean that we have a System object for the hardware and a separate System object for the virtual instance running on it, with some kind of pointer between the two.  That virtual System object would specify a VLAN (and DNS and whatnot), which would then be automatically configured, after which the hardware is booted (via PXE, IPMI, PDUs, etc.) and the installation begun.

One tricky bit is that we'd need to have a way to know exactly when the VLAN, DHCP, and DNS changes have taken effect, and that would need to be reasonably quick.  Sleeping for 15 minutes to let changes propagate will add 15 minutes to our deployment process, which is undesirable.

This model has the advantage that it will be useful to more than just releng :)

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Timing: it'd be great to be confident that a workable solution is in hand by the end of Q1, but not necessary that anything actually work until Q2.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

This isn't something we're interested in anymore -- integrating this sort of thing with openstack is just too open-ended a project.  Instead, we'll use fixed pools of systems in fixed VLANs.