Network infrastructure migration

1. Select a project for migration.

2. Check which SDNs are connected in your project. If SDN Sprut is not connected, contact technical support.

3. Prepare an administrator workstation for performing the migration:

   1. Create a VM in a subnet with internet access. Specify the following parameters:

      • Operating system: select Ubuntu.
      • Firewall settings: specify ssh for CLI access to the VM.
      • Assign external IP: enable the option.
      • Select the remaining parameters at your discretion.

   2. Wait for the VM to be created and connect to it via SSH.

   3. Update the package indexes by running the command:

       
      sudo apt-get update

   4. Install the jq utility:

       
      sudo apt-get install -y jq

   5. Install the OpenStack client and authenticate in the project.

   6. Clone the repository containing the migration scripts:

       
      git clone https://github.com/vk-cs/neutron-2-sprut.git

   7. Navigate to the neutron-2-sprut directory.

   8. Run the command that will add execution permissions to all files with the .sh extension in this directory:

       
      chmod +x .sh

Assess the project's network infrastructure and identify the entities that need to be migrated:

1. Connect to the administrator VM via SSH.

2. Get the list of VMs:

    
   openstack server list

   In the response, find and save the following information:

   • IDs of those virtual machines that have multiple network interfaces.
   • IDs and IP addresses of those virtual machines that have assigned Floating IP addresses.
   • IDs of all other VMs that need to be migrated.

3. Get the list of routers:

    
   openstack router list

   Save the IDs of the routers that need to be migrated.

4. If your project has IPsec tunnels, save the IDs of the routers used to build the tunnel.

5. Get the list of security groups:

    
   openstack security group list

   Save the names of all security groups except the default groups: all, default, ssh+www.

6. The default groups all, default, ssh+www have the same names in SDN Sprut and Neutron. Find and save the IDs of these groups:

   1. Go to your VK Cloud account.
   2. Select the project.
   3. Navigate to the Virtual Networks → Firewall settings section.
   4. Find and save the IDs of the all, default, ssh+www groups in SDN Sprut and Neutron.

1. Connect to the administrator VM via SSH and navigate to the neutron-2-sprut directory.

2. Create a configuration file in CSV format with a list of routers. The file will be used to copy basic network entities using a script.

   File format:

    
   <ROUTER_1>,<COPY_TYPE><ROUTER_2>,<COPY_TYPE>

   Where:

   • <ROUTER_1>, <ROUTER_2> — router IDs.

   • <COPY_TYPE> — type of the router copy in SDN Sprut:

     • std — the copy will be created as a standard router.
     • adv — the copy will be created as an advanced router. Specify this parameter if the router in your project is used to build an IPsec tunnel.

   Example of a configuration file for copying routers:

    
   35fbfb7c-aaaa-aaaa-aaaa-c3fb4d833dee,adva2dd20ca-bbbb-bbbb-bbbb-7ea8b00a81a6,std

3. Run the router migration script:

    
   ./copy-router-and-networks.sh <FILE_NAME>

   Where <FILE_NAME> is the name of the configuration file with the list of routers.

   Example:

    
   ./copy-router-and-networks.sh config.csv

   As a result of the script execution, the specified routers will be copied to SDN Sprut along with static routes, networks, and subnets they are connected to. The -sprut postfix will be added to the name of each copied entity.

Review the copied entities and make sure that all routers, networks, and subnets have been copied:

1. Check the list of networks:

    
   openstack network list

2. Check the list of subnets:

    
   openstack subnet list

3. Check the list of standard routers:

    
   openstack router list

4. Check the list of added advanced routers. To do this, go to your account or make a REST API request:

    
   sprut_api_base="https://infra.mail.ru:9696/v2.0"token=$(openstack token issue -c id -f value)sprut_advanced_routers=$(curl -s -X GET "${sprut_api_base}/direct_connect/dc_routers" \    -H "Content-Type: application/json" \    -H "X-Auth-Token: $token" \    -H "X-SDN:SPRUT")echo "Advanced routers collected:"echo "$sprut_advanced_routers" | jq .echo ""

If the project uses an IPsec tunnel, configure the advanced router created by the script and prepare it for connecting the IPsec tunnel.

Tunnels with the same selectors (source and target subnet ranges) cannot exist simultaneously, even if they are in different SDNs. Therefore, you cannot create a tunnel in SDN Sprut in advance that is similar to the tunnel in SDN Neutron, as this will cause issues with the original tunnel.

1. Delete the original tunnel in SDN Neutron.
2. Add a new VPN tunnel for the advanced router configured in SDN Sprut, and set the IPsec policy parameters.

1. Connect to the administrator VM via SSH.

2. Navigate to the neutron-2-sprut directory.

3. Copy the security groups to SDN Sprut:

    
   ./copy-security-group.sh \    --group-mapping=<NEUTRON_GROUP_1>=<SPRUT_GROUP_1>,<NEUTRON_GROUP_2>=<SPRUT_GROUP_2>,... \    --groups=<GROUP_3>,<GROUP_4>,...

   Where:

   • --group-mapping — this parameter allows you to map existing security groups of different SDNs to each other by ID. This is needed if the copied groups have rules where the source is not a CIDR but another security group. Typically, these are the all, default, ssh+www groups. Parameter arguments:

     • <NEUTRON_GROUP_1>, <NEUTRON_GROUP_2> — security group IDs in SDN Neutron;
     • <SPRUT_GROUP_1>, <SPRUT_GROUP_2> — security group IDs in SDN Sprut;

   • --groups — this parameter specifies the names of security groups in SDN Neutron that need to be copied to SDN Sprut. Parameter arguments: <GROUP_3>, <GROUP_4> — names of the groups being copied.

   Example command:

    
   ./copy-security-group.sh \    --group-mapping=4a361c99-cccc-cccc-cccc-b59fb469d354=121a7574-dddd-dddd-dddd-66baa01400d6,14f303dc-aaaa-aaaa-aaaa-9637c9c342df=3371584a-bbbb-bbbb-bbbb-1cc9f3e89601 \    --groups=web-server-security,spark-k8s-6681-master,ml_sec_group

   Security groups will be copied with the -sprut postfix.

Make sure that the security groups in SDN Sprut are identical to the security groups in SDN Neutron. SDN Sprut groups copied from SDN Neutron have the -sprut postfix.

1. Connect to the administrator VM via SSH and navigate to the neutron-2-sprut directory.

2. Run the script:

    
   ./check-if-all-sprut-sg-present.sh

   If all required groups are copied, the script will return the following message:

    
   All security groups have corresponding '-sprut' groups.

Floating IP addresses cannot be migrated to another SDN. If your project infrastructure has Floating IP addresses, create new ones in SDN Sprut and write them down.

To move a VM to SDN Sprut, you need to connect its ports to new subnets. This is done in different ways depending on the number of VM ports and the type of connections:

• Multiple VMs can be switched by running a single script, but these VMs must have only one network interface each and must not have direct connections to the ext-net external network.

• A single VM can be switched by running a separate script. This method is suitable if your project has a VM with multiple network interfaces, that is, acting as a router, proxy, or edge firewall.

• If in your configuration the VM is directly connected to the ext-net external network, migrate it to SDN Sprut using any convenient method:

  • Add a Floating IP address in SDN Sprut and connect the VM to it.
  • Recreate the VM in SDN Sprut and connect it to the internet external network.

Check the availability of all VMs after migration.

If you no longer need SDN Neutron resources, delete them:

1. Remove Floating IP addresses from the project.
2. Delete security groups.
3. Delete networks and subnets.
4. Delete routers.