{"id":35291,"date":"2019-10-31T22:03:28","date_gmt":"2019-10-31T19:03:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/setevaya-fabrika-dlya-tsoda-cisco-aci-v-pomoshh-adminu\/"},"modified":"2019-10-31T22:03:28","modified_gmt":"2019-10-31T19:03:28","slug":"setevaya-fabrika-dlya-tsoda-cisco-aci-v-pomoshh-adminu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/setevaya-fabrika-dlya-tsoda-cisco-aci-v-pomoshh-adminu","title":{"rendered":"S\u00ed\u0165ov\u00e1 fabrika pro datov\u00e1 centra Cisco ACI - ku pomoci administr\u00e1torovi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"S\u00ed\u0165ov\u00e1
\nS t\u00edmto kouzeln\u00fdm kouskem skriptu Cisco ACI m\u016f\u017eete rychle nastavit s\u00ed\u0165.<\/i><\/p>\n

S\u00ed\u0165ov\u00e1 fabrika pro datov\u00e1 centra Cisco ACI existuje ji\u017e p\u011bt let, ale na Habr o n\u00ed nebylo moc naps\u00e1no, a tak jsem se rozhodl to trochu napravit. Pod\u011bl\u00edm se o svou zku\u0161enost, co to vlastn\u011b je, jak\u00fd m\u00e1 p\u0159\u00ednos a kde jsou jej\u00ed \u00faskal\u00ed. <\/p>\n

Co to je a odkud se vzalo?<\/h3>\n

\nV dob\u011b ozn\u00e1men\u00ed ACI (Application Centric Infrastructure) v roce 2013 \u010delily tradi\u010dn\u00ed p\u0159\u00edstupy k s\u00edt\u00edm datov\u00fdch center konkurenci ze t\u0159\u00ed stran. <\/p>\n

Na jedn\u00e9 stran\u011b slibovala \"prvn\u00ed generace\" SDN \u0159e\u0161en\u00ed zalo\u017een\u00e1 na OpenFlow, \u017ee u\u010din\u00ed s\u00edt\u011b flexibiln\u011bj\u0161\u00edmi a levn\u011bj\u0161\u00edmi z\u00e1rove\u0148. My\u0161lenka spo\u010d\u00edvala v tom, \u017ee by se rozhodov\u00e1n\u00ed, tradi\u010dn\u011b prov\u00e1d\u011bn\u00e9 propriet\u00e1rn\u00edm softwarem p\u0159ep\u00edna\u010d\u016f, p\u0159esunulo na centr\u00e1ln\u00ed kontrol\u00e9r. <\/p>\n

Tento kontrol\u00e9r by m\u011bl jednotn\u00e9 vid\u011bn\u00ed v\u0161eho, co se d\u011bje, a na z\u00e1klad\u011b toho by programoval hardware v\u0161ech p\u0159ep\u00edna\u010d\u016f na \u00farovni pravidel zpracov\u00e1n\u00ed konkr\u00e9tn\u00edch tok\u016f. <\/a><\/noindex>
\nNa druh\u00e9 stran\u011b poskytovala overleayov\u00e1 s\u00ed\u0165ov\u00e1 \u0159e\u0161en\u00ed mo\u017enost realizovat pot\u0159ebnou konektivitu a bezpe\u010dnostn\u00ed politiky bez jak\u00fdchkoli zm\u011bn v fyzick\u00e9 s\u00edti, vytv\u00e1\u0159en\u00edm softwarov\u00fdch tunel\u016f mezi virtualizovan\u00fdmi hostiteli. Nejzn\u00e1m\u011bj\u0161\u00edm p\u0159\u00edkladem takov\u00e9ho p\u0159\u00edstupu bylo \u0159e\u0161en\u00ed od spole\u010dnosti Nicira, kter\u00e1 byla v t\u00e9 dob\u011b ji\u017e koupena spole\u010dnost\u00ed VMWare za 1,26 miliardy dolar\u016f a stala se z\u00e1kladem sou\u010dasn\u00e9ho VMWare NSX. K t\u00e9to situaci ur\u010dit\u00fdm zp\u016fsobem p\u0159isp\u011blo to, \u017ee spoluzakladatel\u00e9 firmy Nicira byli stejn\u00ed lid\u00e9, kte\u0159\u00ed d\u0159\u00edve st\u00e1li u zrodu OpenFlow, a nyn\u00ed tvrdili, \u017ee pro vybudov\u00e1n\u00ed datov\u00e9 tov\u00e1rny. OpenFlow nen\u00ed vhodn\u00e9.<\/a><\/noindex>.<\/p>\n

No, a kone\u010dn\u011b, p\u0159ep\u00ednac\u00ed \u010dipy, dostupn\u00e9 na otev\u0159en\u00e9m trhu (co\u017e se naz\u00fdv\u00e1 merchant silicon), dos\u00e1hly \u00farovn\u011b zralosti, p\u0159i kter\u00e9 se staly re\u00e1lnou hrozbou pro tradi\u010dn\u00ed v\u00fdrobce p\u0159ep\u00edna\u010d\u016f. Zat\u00edmco d\u0159\u00edve si ka\u017ed\u00fd v\u00fdrobce vyv\u00edjel \u010dipy pro sv\u00e9 p\u0159ep\u00edna\u010de s\u00e1m, \u010dasem se \u010dipy od t\u0159et\u00edch stran, zejm\u00e9na od Br\u043eadcom, za\u010daly p\u0159ibli\u017eovat v\u00fdrobn\u00edm \u010dip\u016fm z pohledu funkc\u00ed a co se t\u00fd\u010de pom\u011bru cena\/v\u00fdkon, je p\u0159ekon\u00e1valy. Proto mnoz\u00ed pova\u017eovali dny p\u0159ep\u00edna\u010d\u016f s \u010dipy vlastn\u00ed v\u00fdroby za se\u010dten\u00e9.<\/p>\n

ACI se stala \"asymetrickou reakc\u00ed\" spole\u010dnosti Cisco (p\u0159esn\u011bji \u0159e\u010deno, spole\u010dnosti Insieme, kter\u00e1 byla zalo\u017eena jej\u00edmi b\u00fdval\u00fdmi zam\u011bstnanci) na v\u0161e v\u00fd\u0161e uveden\u00e9. <\/p>\n

Jak\u00fd je rozd\u00edl s OpenFlow?<\/h3>\n

\nZ pohledu rozd\u011blen\u00ed funkc\u00ed je ACI vlastn\u011b opakem OpenFlow.
\nV architektu\u0159e OpenFlow kontrol\u00e9r odpov\u00edd\u00e1 za zapisov\u00e1n\u00ed podrobn\u00fdch pravidel (tok\u016f)
\ndo hardwaru v\u0161ech p\u0159ep\u00edna\u010d\u016f, co\u017e znamen\u00e1, \u017ee v rozs\u00e1hl\u00e9 s\u00edti m\u016f\u017ee n\u00e9st odpov\u011bdnost za uchov\u00e1v\u00e1n\u00ed a, co je nejd\u016fle\u017eit\u011bj\u0161\u00ed, zm\u011bnu des\u00edtek milion\u016f z\u00e1znam\u016f na stovk\u00e1ch m\u00edst v s\u00edti, proto se jej\u00ed v\u00fdkon a spolehlivost ve velk\u00e9m nasazen\u00ed st\u00e1v\u00e1 \u00fazk\u00fdm m\u00edstem.<\/p>\n

V ACI se pou\u017e\u00edv\u00e1 opa\u010dn\u00fd p\u0159\u00edstup: kontrol\u00e9r existuje, samoz\u0159ejm\u011b, ale p\u0159ep\u00edna\u010de dost\u00e1vaj\u00ed od n\u011bj vysoce \u00farov\u0148ov\u00e9 deklarativn\u00ed politiky a jejich p\u0159evod na podrobnosti konkr\u00e9tn\u00edch nastaven\u00ed v hardwaru prov\u00e1d\u00ed samotn\u00fd p\u0159ep\u00edna\u010d. Kontrol\u00e9r m\u016f\u017ee b\u00fdt restartov\u00e1n nebo dokonce vypnut a se s\u00edt\u00ed se nic \u0161patn\u00e9ho nestane, krom\u011b samoz\u0159ejm\u011b absence mo\u017enosti spr\u00e1vy v t\u00e9to chv\u00edli. Zaj\u00edmav\u00e9 je, \u017ee v ACI existuj\u00ed situace, kdy se OpenFlow p\u0159ece jen pou\u017e\u00edv\u00e1, ale lok\u00e1ln\u011b v r\u00e1mci hostitele pro programov\u00e1n\u00ed Open vSwitch.<\/p>\n

ACI je zcela postavena na overlay transportu zalo\u017een\u00e9m na VXLAN, ale z\u00e1rove\u0148 zahrnuje v r\u00e1mci jednoho \u0159e\u0161en\u00ed i spodn\u00ed IP transport. Cisco to nazvalo term\u00ednem \u201eintegrovan\u00fd overlay\u201c. Jako bod terminace overlay v ACI se v v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f pou\u017e\u00edvaj\u00ed p\u0159ep\u00edna\u010de fabriky (prov\u00e1d\u011bj\u00ed to rychlost\u00ed kan\u00e1lu). Host\u00e9 nemus\u00ed nic v\u011bd\u011bt o fabrice, enkapsulaci atd., nicm\u00e9n\u011b v n\u011bkter\u00fdch p\u0159\u00edpadech (nap\u0159\u00edklad pro p\u0159ipojen\u00ed OpenStack host\u016f) m\u016f\u017ee b\u00fdt VXLAN provoz dod\u00e1v\u00e1n i k nim.<\/p>\n

Overlay se v ACI pou\u017e\u00edvaj\u00ed nejen pro zaji\u0161t\u011bn\u00ed flexibiln\u00ed konektivity p\u0159es transportn\u00ed s\u00ed\u0165, ale tak\u00e9 pro p\u0159enos meta-informac\u00ed (ta se pou\u017e\u00edv\u00e1 nap\u0159\u00edklad pro uplatn\u011bn\u00ed bezpe\u010dnostn\u00edch politik). <\/p>\n

\u010cipy od Broadcom byly d\u0159\u00edve pou\u017eity v p\u0159ep\u00edna\u010d\u00edch Cisco \u0159ady Nexus 3000. V rodin\u011b Nexus 9000, kter\u00e1 byla speci\u00e1ln\u011b vydan\u00e1 pro podporu ACI, byla nejprve implementov\u00e1na hybridn\u00ed model nazvan\u00fd Merchant+. V p\u0159ep\u00edna\u010di byly sou\u010dasn\u011b pou\u017eity nov\u00fd \u010dip Broadcom Trident 2 a dopl\u0148kov\u00fd \u010dip vyvinut\u00fd spole\u010dnost\u00ed Cisco, kter\u00fd realizoval ve\u0161kerou magii ACI. Z\u0159ejm\u011b to umo\u017enilo urychlit uveden\u00ed produktu na trh a sn\u00ed\u017eit cenu p\u0159ep\u00edna\u010de na \u00farove\u0148 bl\u00edzkou model\u016fm pouze na Trident 2. Tento p\u0159\u00edstup sta\u010dil na prvn\u00ed dva a\u017e t\u0159i roky dod\u00e1vek ACI. B\u011bhem t\u00e9to doby Cisco vyvinula a uvedla na trh dal\u0161\u00ed generaci Nexus 9000 ji\u017e na sv\u00fdch vlastn\u00edch \u010dipech, kter\u00e9 m\u011bly vy\u0161\u0161\u00ed v\u00fdkon a funk\u010dnost, ale za stejn\u00e9 ceny. Vn\u011bj\u0161\u00ed specifikace z hlediska interakce ve fabrice z\u016fstaly zcela zachov\u00e1ny. Intern\u00ed v\u00fdbava se v\u0161ak zcela zm\u011bnila: n\u011bco jako refaktoring, ale pro hardware.<\/p>\n

Jak je uspo\u0159\u00e1d\u00e1na architektura Cisco ACI <\/h3>\n

\nV nejjednodu\u0161\u0161\u00edm p\u0159\u00edpad\u011b ACI stav\u00ed podle topologie Clos, nebo jak se \u010dasto \u0159\u00edk\u00e1, Spine-Leaf. P\u0159ep\u00edna\u010d\u016f na \u00farovni Spine m\u016f\u017ee b\u00fdt od dvou (nebo jednoho, pokud n\u00e1s nezaj\u00edm\u00e1 odolnost proti selh\u00e1n\u00ed) do \u0161esti. \u010c\u00edm v\u00edce jich je, t\u00edm vy\u0161\u0161\u00ed je odolnost (men\u0161\u00ed sn\u00ed\u017een\u00ed \u0161\u00ed\u0159ky p\u00e1sma a spolehlivosti p\u0159i hav\u00e1rii nebo \u00fadr\u017eb\u011b jednoho Spine) a celkov\u00fd v\u00fdkon. V\u0161echny vn\u011bj\u0161\u00ed p\u0159ipojen\u00ed jdou do p\u0159ep\u00edna\u010d\u016f na \u00farovni Leaf: to jsou servery, p\u0159ipojen\u00ed k extern\u00edm s\u00edt\u00edm p\u0159es L2 nebo L3 a p\u0159ipojen\u00ed kontroler\u016f APIC. Celkov\u011b s ACI nejen konfigurace, ale tak\u00e9 shroma\u017e\u010fov\u00e1n\u00ed statistiky, monitorov\u00e1n\u00ed selh\u00e1n\u00ed a dal\u0161\u00ed \u2014 v\u0161e se prov\u00e1d\u00ed prost\u0159ednictv\u00edm rozhran\u00ed kontroler\u016f, kter\u00fdch je v zaveden\u00edch b\u011b\u017en\u00e9 velikosti \u2014 t\u0159i kusy. <\/p>\n

K p\u0159ep\u00edna\u010d\u016fm se nikdy nemus\u00ed p\u0159ipojovat konzole, ani p\u0159i spu\u0161t\u011bn\u00ed s\u00edt\u011b: kontroler s\u00e1m objevuje p\u0159ep\u00edna\u010de a sestavuje z nich fabriku, v\u010detn\u011b nastaven\u00ed v\u0161ech slu\u017eebn\u00edch protokol\u016f, proto je mimochodem velmi d\u016fle\u017eit\u00e9 p\u0159i mont\u00e1\u017ei zapsat s\u00e9riov\u00e1 \u010d\u00edsla instalovan\u00e9 techniky, aby se pak nemuselo h\u00e1dat, kter\u00fd p\u0159ep\u00edna\u010d je v kter\u00e9 sk\u0159\u00edni. Pro \u0159e\u0161en\u00ed probl\u00e9m\u016f se k p\u0159ep\u00edna\u010d\u016fm v p\u0159\u00edpad\u011b pot\u0159eby d\u00e1 p\u0159ipojit p\u0159es SSH: na nich jsou dost pe\u010dliv\u011b reprodukov\u00e1ny b\u011b\u017en\u00e9 show-p\u0159\u00edkazy Cisco. <\/p>\n

Uvnit\u0159 fabriky se vyu\u017e\u00edv\u00e1 IP transport, tak\u017ee zde nen\u00ed \u017e\u00e1dn\u00fd Spanning Tree a podobn\u00e9 hr\u016fzy minulosti: v\u0161echny linky jsou vyu\u017eity a konvergence p\u0159i v\u00fdpadc\u00edch je velmi rychl\u00e1. Provoz ve fabrice je p\u0159en\u00e1\u0161en prost\u0159ednictv\u00edm tunel\u016f zalo\u017een\u00fdch na VXLAN. P\u0159esn\u011bji \u0159e\u010deno, samotn\u00e1 Cisco naz\u00fdv\u00e1 enkapsulaci iVXLAN, a li\u0161\u00ed se od b\u011b\u017en\u00e9ho VXLAN t\u00edm, \u017ee rezervovan\u00e1 pole v s\u00ed\u0165ov\u00e9 hlavi\u010dce se pou\u017e\u00edvaj\u00ed k p\u0159enosu \u0159\u00edzen\u00ed informac\u00ed, p\u0159edev\u0161\u00edm o vztahu provozu k EPG skupin\u011b. To umo\u017e\u0148uje implementovat pravidla interakce mezi skupinami v hardwaru, pou\u017e\u00edvaj\u00edc\u00ed jejich \u010d\u00edsla stejn\u011b, jako se v b\u011b\u017en\u00fdch p\u0159\u00edstupov\u00fdch listech pou\u017e\u00edvaj\u00ed adresy. <\/p>\n

Tunely umo\u017e\u0148uj\u00ed roz\u0161i\u0159ovat jak L2 segmenty, tak L3 (tedy VRF) prost\u0159ednictv\u00edm intern\u00edho IP transportu. P\u0159itom je v\u00fdchoz\u00ed br\u00e1na distribuovan\u00e1. To znamen\u00e1, \u017ee sm\u011brov\u00e1n\u00edm p\u0159\u00edchoz\u00edho provozu do fabriky se zab\u00fdv\u00e1 ka\u017ed\u00fd switch. Z hlediska logiky p\u0159enosu provozu je ACI podobn\u00e9 tov\u00e1rn\u011b na b\u00e1zi VXLAN\/EVPN. <\/p>\n

Pokud je tomu tak, jak\u00e9 jsou rozd\u00edly? Ve v\u0161em ostatn\u00edm! <\/h3>\n

\nRozd\u00edl \u010d\u00edslo jedna, se kter\u00fdm se v ACI setk\u00e1v\u00e1te, je to, jak se servery p\u0159ipojuj\u00ed do s\u00edt\u011b. V tradi\u010dn\u00edch s\u00edt\u00edch se p\u0159ipojen\u00ed jak fyzick\u00fdch server\u016f, tak virtu\u00e1ln\u00edch st\u00e1v\u00e1 v VLAN, a od nich se odv\u00edj\u00ed v\u0161e ostatn\u00ed: konektivita, zabezpe\u010den\u00ed atd. V ACI se v\u0161ak pou\u017e\u00edv\u00e1 struktura, kterou Cisco naz\u00fdv\u00e1 EPG (End-point Group), od kter\u00e9 se nelze odstoupit. Lze ji rovnat VLAN? Ano, ale v takov\u00e9m p\u0159\u00edpad\u011b hroz\u00ed ztr\u00e1ta v\u011bt\u0161iny toho, co ACI poskytuje. <\/p>\n

Ve vztahu k EPG se formuluj\u00ed v\u0161echna pravidla p\u0159\u00edstupu, a v ACI se standardn\u011b pou\u017e\u00edv\u00e1 princip \"b\u00edl\u00e9ho seznamu\", co\u017e znamen\u00e1, \u017ee povolen je pouze provoz, jeho\u017e propou\u0161t\u011bn\u00ed je v\u00fdslovn\u011b povoleno. To znamen\u00e1, \u017ee m\u016f\u017eeme vytvo\u0159it EPG skupiny \"Web\" a \"MySQL\" a definovat pravidlo, kter\u00e9 povoluje interakci mezi nimi pouze na portu 3306. To bude fungovat bez vazby na s\u00ed\u0165ov\u00e9 adresy a dokonce i v r\u00e1mci jedn\u00e9 pods\u00edt\u011b! <\/p>\n

M\u00e1me z\u00e1kazn\u00edky, kte\u0159\u00ed si vybrali ACI pr\u00e1v\u011b kv\u016fli t\u00e9to funkce, proto\u017ee umo\u017e\u0148uje omezit p\u0159\u00edstupy mezi servery (virtu\u00e1ln\u00edmi \u010di fyzick\u00fdmi - nez\u00e1le\u017e\u00ed), ani\u017e by bylo nutn\u00e9 je p\u0159esouvat mezi pods\u00edt\u011bmi, co\u017e znamen\u00e1, \u017ee se nem\u011bn\u00ed adresace. Ano, v\u00edme, nikdo toti\u017e ru\u010dn\u011b nezad\u00e1v\u00e1 IP adres<\/a> do konfigurac\u00ed aplikac\u00ed, \u017ee?<\/p>\n

Pravidla pro p\u0159esm\u011brov\u00e1n\u00ed provozu v ACI se naz\u00fdvaj\u00ed kontrakty. V takov\u00e9m kontraktu se jedna nebo v\u00edce skupin nebo vrstev v aplikaci s v\u00edce \u00farovn\u011bmi st\u00e1v\u00e1 poskytovatelem slu\u017eby (dejme tomu, slu\u017eba datab\u00e1ze), zat\u00edmco jin\u00e9 jsou spot\u0159ebiteli. Kontrakt m\u016f\u017ee pouze p\u0159esm\u011brovat provoz, nebo m\u016f\u017ee ud\u011blat n\u011bco sofistikovan\u011bj\u0161\u00edho, nap\u0159\u00edklad p\u0159esm\u011brovat na firewall nebo vyva\u017eova\u010d, a tak\u00e9 zm\u011bnit hodnotu QoS.<\/p>\n

Jak se servery dostanou do t\u011bchto skupin? Pokud se jedn\u00e1 o fyzick\u00e9 servery nebo n\u011bco, co je zahrnuto do st\u00e1vaj\u00edc\u00ed s\u00edt\u011b, do kter\u00e9 jsme vytvo\u0159ili VLAN trunk, pak pro jejich za\u0159azen\u00ed do EPG bude pot\u0159eba uv\u00e9st port p\u0159ep\u00edna\u010de a pou\u017e\u00edvan\u00fd VLAN. Jak vid\u00edme, VLANy se objevuj\u00ed tam, kde bez nich nelze.<\/p>\n

Pokud jsou servery virtu\u00e1ln\u00ed, sta\u010d\u00ed odk\u00e1zat na p\u0159ipojen\u00e9 prost\u0159ed\u00ed virtualizace, a pak se stane v\u0161e automaticky: vytvo\u0159\u00ed se portov\u00e1 skupina (pokud mluv\u00edme v term\u00ednech VMWare) pro p\u0159ipojen\u00ed VM, p\u0159id\u011bl\u00ed se pot\u0159ebn\u00e9 VLANy nebo VXLANy, a zap\u00ed\u0161\u00ed se na pot\u0159ebn\u00e9 porty p\u0159ep\u00edna\u010d\u016f atd. Tak\u017ee, i kdy\u017e je ACI postavena kolem fyzick\u00e9 s\u00edt\u011b, p\u0159ipojen\u00ed pro virtu\u00e1ln\u00ed servery vypadaj\u00ed mnohem jednodu\u0161eji ne\u017e pro fyzick\u00e9. ACI ji\u017e obsahuje integraci s VMWare a MS Hyper-V, stejn\u011b jako podporu pro OpenStack a RedHat Virtualization. Od ur\u010dit\u00e9ho okam\u017eiku se objevila i vestav\u011bn\u00e1 podpora pro kontejnerov\u00e9 platformy: Kubernetes, OpenShift, Cloud Foundry, p\u0159i\u010dem\u017e se tato podpora t\u00fdk\u00e1 jak aplikace politik, tak monitorov\u00e1n\u00ed, tedy s\u00ed\u0165ov\u00fd administr\u00e1tor m\u016f\u017ee okam\u017eit\u011b vid\u011bt, na jak\u00fdch hostitel\u00edch jak\u00e9 pody b\u011b\u017e\u00ed a do jak\u00fdch skupin se dostali.<\/p>\n

Krom\u011b za\u0159azen\u00ed do ur\u010dit\u00e9 portov\u00e9 skupiny maj\u00ed virtu\u00e1ln\u00ed servery dal\u0161\u00ed vlastnosti: jm\u00e9no, atributy atd., kter\u00e9 lze pou\u017e\u00edt jako krit\u00e9ria pro jejich p\u0159esun do jin\u00e9 skupiny, nap\u0159\u00edklad p\u0159i p\u0159ejmenov\u00e1n\u00ed VM nebo p\u0159i z\u00edsk\u00e1n\u00ed dal\u0161\u00edho \u0161t\u00edtku. Cisco tomu \u0159\u00edk\u00e1 mikrossegrega\u010dn\u00ed skupiny, i kdy\u017e, ve skute\u010dnosti, samotn\u00e1 konstrukce s mo\u017enost\u00ed vytv\u00e1\u0159et v\u00edce bezpe\u010dnostn\u00edch segment\u016f ve form\u011b EPG ve stejn\u00e9 pods\u00edti je tak\u00e9 docela mikrossegregace. No, vendorovi je to jasn\u011bj\u0161\u00ed. <\/p>\n

EPG jsou \u010dist\u011b logick\u00e9 konstrukce, kter\u00e9 nejsou v\u00e1z\u00e1ny na konkr\u00e9tn\u00ed switche, servery atd., tak\u017ee s nimi a jejich odvozen\u00fdmi konstrukcemi (aplikacemi a tenanty) lze d\u011blat v\u011bci, kter\u00e9 jsou v b\u011b\u017en\u00fdch s\u00edt\u00edch obt\u00ed\u017en\u011b provediteln\u00e9, nap\u0159\u00edklad klonov\u00e1n\u00ed. D\u00edky tomu je velmi snadn\u00e9 vytvo\u0159it klon produk\u010dn\u00edho prost\u0159ed\u00ed, aby se z\u00edskalo testovac\u00ed prost\u0159ed\u00ed zaru\u010den\u011b identick\u00e9 s produk\u010dn\u00edm. To lze prov\u00e9st ru\u010dn\u011b, ale lep\u0161\u00ed (a jednodu\u0161\u0161\u00ed) je to ud\u011blat p\u0159es API. <\/p>\n

Logika spr\u00e1vy v ACI se obecn\u011b v\u016fbec nepodob\u00e1 tomu, co b\u011b\u017en\u011b potk\u00e1v\u00e1te
\nv tradi\u010dn\u00edch s\u00edt\u00edch od stejn\u00e9 firmy Cisco: programov\u00e9 rozhran\u00ed je prim\u00e1rn\u00ed, zat\u00edmco GUI nebo CLI jsou sekund\u00e1rn\u00ed, proto\u017ee funguj\u00ed p\u0159es stejn\u00e9 API. Proto se t\u00e9m\u011b\u0159 ka\u017ed\u00fd, kdo se zab\u00fdv\u00e1 ACI, po ur\u010dit\u00e9 dob\u011b za\u010d\u00edn\u00e1 orientovat v objektov\u00e9m modelu, kter\u00fd se pou\u017e\u00edv\u00e1 pro spr\u00e1vu, a n\u011bco si automatizovat podle sv\u00fdch pot\u0159eb. Nejjednodu\u0161\u0161\u00ed to ud\u011blat v Pythonu: pro n\u011bj existuj\u00ed pohodln\u00e9 hotov\u00e9 n\u00e1stroje. <\/p>\n

P\u0159isl\u00edben\u00e9 n\u00e1strahy<\/h3>\n

\nHlavn\u00ed probl\u00e9m spo\u010d\u00edv\u00e1 v tom, \u017ee mnoho v\u011bc\u00ed v ACI je realizov\u00e1no jinak. Abyste s t\u00edm mohli spr\u00e1vn\u011b pracovat, mus\u00edte se p\u0159eu\u010dit. To se t\u00fdk\u00e1 zejm\u00e9na t\u00fdm\u016f pro s\u00ed\u0165ov\u00fd provoz u velk\u00fdch z\u00e1kazn\u00edk\u016f, kde se in\u017een\u00fd\u0159i po l\u00e9ta v\u011bnuj\u00ed \u201e\u0161\u00ed\u0159en\u00ed VLAN\u016f\u201c podle po\u017eadavk\u016f. To, \u017ee nyn\u00ed VLAN d\u011bl\u00e1 v\u00edce ne\u017e jen VLAN, a pro vytv\u00e1\u0159en\u00ed nov\u00fdch s\u00edt\u00ed ve virtualizovan\u00fdch hostitelsk\u00fdch stroj\u00edch nen\u00ed nutn\u00e9 vytv\u00e1\u0159et VLANy ru\u010dn\u011b, \u00fapln\u011b \u201erozsype hlavu\u201c tradi\u010dn\u00edm s\u00ed\u0165a\u0159\u016fm a nut\u00ed je dr\u017eet se zaveden\u00fdch p\u0159\u00edstup\u016f. Je t\u0159eba poznamenat, \u017ee Cisco se sna\u017eila trochu usnadnit situaci a do kontrol\u00e9ru p\u0159idala \u201eCLI podobn\u00e9 NXOS\u201c, kter\u00e9 umo\u017e\u0148uje konfiguraci z rozhran\u00ed podobn\u00e9ho tradi\u010dn\u00edm switch\u016fm. Nicm\u00e9n\u011b pro to, abyste mohli norm\u00e1ln\u011b pou\u017e\u00edvat ACI, budete muset pochopit, jak to funguje. <\/p>\n

Z pohledu cen na velk\u00fdch a st\u0159edn\u00edch s\u00edt\u00edch ACI se od tradi\u010dn\u00edch s\u00edt\u00ed na za\u0159\u00edzen\u00edch Cisco v podstat\u011b neli\u0161\u00ed, nebo\u0165 pro jejich stavbu se pou\u017e\u00edvaj\u00ed stejn\u00e9 switche (Nexus 9000 m\u016f\u017ee fungovat jak v re\u017eimu ACI, tak v tradi\u010dn\u00edm re\u017eimu a stalo se nyn\u00ed hlavn\u00edm \"kon\u011bm\" pro nov\u00e9 projekty v datov\u00fdch centrech). Pro datov\u00e1 centra se dv\u011bma switchemi p\u0159\u00edtomnost kontroler\u016f a architektura Spine-Leaf samoz\u0159ejm\u011b d\u00e1v\u00e1 o sob\u011b v\u011bd\u011bt. Ned\u00e1vno se objevila Mini ACI fabrika, kde byly dva kontrolery z t\u0159\u00ed nahrazeny virtu\u00e1ln\u00edmi stroji. To umo\u017e\u0148uje sn\u00ed\u017eit rozd\u00edl v n\u00e1kladech, ale st\u00e1le z\u016fst\u00e1v\u00e1. Tak\u017ee pro z\u00e1kazn\u00edka je volba ur\u010dena t\u00edm, jak moc je zainteresov\u00e1n na funkc\u00edch bezpe\u010dnosti, integrace s virtualizac\u00ed, jedin\u00e9 spr\u00e1vy a dal\u0161\u00edch.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u043e\u0442 \u044d\u0442\u043e\u0433\u043e \u0432\u043e\u043b\u0448\u0435\u0431\u043d\u043e\u0433\u043e \u043a\u0443\u0441\u043a\u0430 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 Cisco ACI \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0441\u0435\u0442\u044c. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0444\u0430\u0431\u0440\u0438\u043a\u0430 \u0434\u043b\u044f \u0426\u041e\u0414\u0430 Cisco ACI c\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0443\u0436\u0435 \u043f\u044f\u0442\u044c \u043b\u0435\u0442, \u043d\u043e \u043d\u0430 \u0425\u0430\u0431\u0440\u0435 \u043f\u0440\u043e \u043d\u0435\u0451 \u0442\u043e\u043b\u043a\u043e\u043c \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043d\u043e, \u0432\u043e\u0442 \u0438 \u0440\u0435\u0448\u0438\u043b \u044d\u0442\u043e \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c. \u0420\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u043d\u0430 \u0441\u0432\u043e\u0451\u043c \u043e\u043f\u044b\u0442\u0435, \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435, \u043a\u0430\u043a\u0430\u044f \u043e\u0442 \u043d\u0435\u0451 \u043f\u043e\u043b\u044c\u0437\u0430 \u0438 \u0433\u0434\u0435 \u0443 \u043d\u0435\u0451 \u0433\u0440\u0430\u0431\u043b\u0438. \u0427\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35291","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00ed\u0165ov\u00e1 fabrika pro datov\u00e9 centrum Cisco ACI - pro administr\u00e1tory | ProHoster","description":"S pomoc\u00ed tohoto kouzeln\u00e9ho kusu skriptu.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/setevaya-fabrika-dlya-tsoda-cisco-aci-v-pomoshh-adminu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0444\u0430\u0431\u0440\u0438\u043a\u0430 \u0434\u043b\u044f \u0426\u041e\u0414\u0430 Cisco ACI \u2014 \u0432 \u043f\u043e\u043c\u043e\u0449\u044c \u0430\u0434\u043c\u0438\u043d\u0443 | ProHoster","og:description":"\u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u043e\u0442 \u044d\u0442\u043e\u0433\u043e \u0432\u043e\u043b\u0448\u0435\u0431\u043d\u043e\u0433\u043e \u043a\u0443\u0441\u043a\u0430 \u0441\u043a\u0440\u0438\u043f\u0442\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/setevaya-fabrika-dlya-tsoda-cisco-aci-v-pomoshh-adminu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:28+00:00","article:modified_time":"2019-10-31T19:03:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35291","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:06:24","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35291"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35291\/revisions"}],"predecessor-version":[{"id":157819,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35291\/revisions\/157819"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}