Public IPs in shared guest network

[SviridoffA]

Hello everyone!! I understand that this most likely does not exist yet, but perhaps someone has found some kind of workaround, or can give some advise. How can we control IPs in shared networks? I mean somfthing like limits for users, or acces restrictions. Is there any mechanism to limit the issuance of public addresses in these networks as in Public network of zone for example?

[DaanHoogland]

@SviridoffA , if you mean the usage per user, this is in the user quota and unfortunately not per network, If you mean in the network in general it is in the network creation dialog/API

Having the combination limited, e.g. make sure that user1 can use up to 4 IP addresses in each of 4 existing shared networks, would require you to do some automation, I think, like deleting surpluses that you find. Is it the latter you are looking at?

It would sound like you would want a scriptable permission hook allowing the operator to configure his own pre-execution script to APIs so they can refuse user actions at will. Implementing this is a less generic way would make the system needlessly complex, but implementing this generic solution could make it error prone.

Thanks for starting this discussion (As I hope a lot of people will chime in)

cc @weizhouapache @wido @andrijapanicsb (and everybody between W and A)

[weizhouapache]

@SviridoffA
do you mean the resource limitation on the IPs of shared network ?

currently the resource limitation/calculation of public IP only consider the Public IP for isolated networks and VPC.
the IPs of Shared networks are not included.

[SviridoffA]

Thanks for your replys guys.
@DaanHoogland When you say user quota, do you mean quota plugin? Unfortunately, we couldn't research it enough, it looks like it doesn't work properly in 4.19 yet, so we just have it disabled. I mean restrictions per user or per domain. Automation.. yes, I'm looking in that direction now, but I wanted something more trivial :).

@weizhouapache Yes. I mean limits of shared networks IPs per user or per domain. And I noticed that they not included. But asking, maybe some one have tricks for this :)

We have cases when we need to provide Internet access to virtual machines, as for regular VPS (with out static nat).
And shared networks looks good for this, but dont have any restrictions and limitations, we can only create specific IPs pool.
Ideally, it would be great to have restriction settings as for public IPs, but for shared IPs.

[weizhouapache]

Thanks for your replys guys. @DaanHoogland When you say user quota, do you mean quota plugin? Unfortunately, we couldn't research it enough, it looks like it doesn't work properly in 4.19 yet, so we just have it disabled. I mean restrictions per user or per domain. Automation.. yes, I'm looking in that direction now, but I wanted something more trivial :).

@weizhouapache Yes. I mean limits of shared networks IPs per user or per domain. And I noticed that they not included. But asking, maybe some one have tricks for this :)

We have cases when we need to provide Internet access to virtual machines, as for regular VPS (with out static nat). And shared networks looks good for this, but dont have any restrictions and limitations, we can only create specific IPs pool. Ideally, it would be great to have restriction settings as for public IPs, but for shared IPs.

looks like a valid use case

[DaanHoogland]

agreed, but in a shared network this would also imply a VM limitation; 4 ips limit + 5 vms limit would make the vm limit moot (thanks @NuxRo )

whereas 5 ip limit + 4 vm limit would mean that last IP can only be used as a secondary ip on a vm. Is this what we intend with this functionality?

[SviridoffA]

Initially, I created this discussion not as a improvement request , but simply as a request for help. But since this discussion went this way, let me fantasize a little :). As far as I understand, the main problem is that there may be cases when there is more than one shared network and some of them may be local networks, not public. And the restrictions will apply to all networks, imposing restrictions where they are not needed. I would suggest solving this issue by creating an additional switch in this type of network. This switch can, for example, enable and disable ignoring restrictions, or for example, enable the public IP mode in which these addresses will be taken into account in the public IP restrictions. Unfortunately, these are just my thoughts, I am a DevOps engineer and only know a couple of scripting languages, but I do not know Java. As for us, at the moment we have decided to refuse to use Cloudstack in this way, it is critical for us to control the use of public addresses. Instead, we will use the classic usecase with a static NAT 1:1, and in some cases provide a separate dedicated pool of public IPs. This is not entirely convenient, but we are grateful for what we have. Thank you for your work ;).

[alexandremattioli]

@SviridoffA only root admins can create Shared Networks with public IPs, therefore the operator control the address spaces provided and can apply any internal limits.

[SviridoffA]

That’s true. And this will work when you create a dedicated shared network for the client and give this client a separate pool. But if the client wants to get only one IP address directly on their VM, without NAT, there are no limitations mechanisms. It doesn’t really matter when you’re using a pay-as-you-go model, but when you need to control this usage, there’s no way, only with external automation.