Merge lp:~vishvananda/nova/network-refactor into lp:~hudson-openstack/nova/trunk

[Vish Ishaya]

Make network its own worker! This separates the network logic from the api server, allowing us to have multiple network controllers. There a lot of stuff in networking that is ugly and should be modified with the datamodel changes. I've attempted not to mess with those things too much to keep the changeset small(ha!).

Make network its own worker!

This separates the network logic from the api server, allowing us to have multiple network controllers. There a lot of stuff in networking that is ugly and should be modified with the datamodel changes. I've attempted not to mess with those things too much to keep the changeset small(ha!).

One important change is that each project is associated with a particular network host. Each network host has a pool of ips to assign. This seems very apropriate for the one vlan per project model, but may have to be re-examined with multi-cluster networking in mind. The limitation may not be necessary in the Flat networking model, and get_network_topic could perhaps run through the scheduler and go to the least busy network worker.

There is one outstanding issue with vpns, a vpn isn't allocated to a project until set_network_host is called, which requires that the network host is actually running. This means that using nova-manage project zip is no longer guaranteed to give you a zip file that includes vpn credentials.

Everything else should be working. I've done quite a bit of testing on my own, rewrote and fixed a few of the existing tests. More tests need to be written, but I wanted to get this up and merged as soon as possible since it touches a lot of files.

Hopefully I have some time in our next sprint to devote to improving test coverage of all parts of the system. We are in need of it.

Please look over the code, try it out. I haven't done extensive testing with flat network, but I believe that it will very helpful for most deployments. It currently relies on injecting network data and just bridges into whatever bridge is specifed in the flag.

It should be easy to extend the capability to include a network that uses dhcp without vlans, or configures switches, sets up ebtables, etc.

Reviews and comments welcome

[Eric Day (eday)]

Looks great! I have some concern about introducing some lag for the extra roundtrip for looking up the network topic, but this should be fine for now. The only small thing would be the name of the network/networkdata.py file and class. Since this is a model for VPN, what about just network/vpn.py? I guess the network/network* redundancy is the thing that bugs me. :)

review: Needs Fixing

[Jay Pipes (jaypipes)]

Why not /network/model.py? This would match /compute/model.py.

[Eric Day (eday)]

There is already a network/model.py, but it may be that the classes in networkdata.py should move into model.py too.

[Vish Ishaya (vishvananda)]

This is the natural place for it to go, but unfortunately that brings up the
perennial circular import problem. AuthManager needs access to the
NetworkData class to handle requests for the project's vpn ip and port when
it is generating credentials. Other classes in network/model.py need access
to auth_manager to list projects/etc. auth/manager.py import users =>
network/model.py import manager fails.

It could theoretically go in a auth/model.py class, since it does relate to
users specifically, but I feel like it has more to do with the network than
the user. Any suggestions?

On Thu, Aug 5, 2010 at 9:48 AM, Eric Day <email address hidden> wrote:

> There is already a network/model.py, but it may be that the classes in
> networkdata.py should move into model.py too.
> --
> https://code.launchpad.net/~vishvananda/nova/network-refactor/+merge/31808
> You are the owner of lp:~vishvananda/nova/network-refactor.
>

[Jay Pipes (jaypipes)]

Yeah, so I've run into similar issues in prototyping new datastore code. Is the real problem the fact that the Auth objects like Project aren't derived from BasicModel like all the other objects in the system are? If we could have things that are *models* (i.e. plain old data records with some ability to "associate" with each other) all derive from a single class (BasicModel) this problem would go away. This really is a problem with having the models contain business logic (the Rails way...)

-jay

[Jay Pipes (jaypipes)]

Per conversation on IRC, I understand the reasons why this is necessary, and approve this merge as-is. Moving from ActiveRecord to a DataMapper pattern is a much bigger discussion :)

review: Approve

[Vish Ishaya (vishvananda)]

I went ahead and updated this to use vpn.py for the moment. Hopefully this
will be cleaned up in the datamodel refactor.

Vish

On Thu, Aug 5, 2010 at 12:21 PM, Jay Pipes <email address hidden> wrote:

> Yeah, so I've run into similar issues in prototyping new datastore code.
> Is the real problem the fact that the Auth objects like Project aren't
> derived from BasicModel like all the other objects in the system are? If we
> could have things that are *models* (i.e. plain old data records with some
> ability to "associate" with each other) all derive from a single class
> (BasicModel) this problem would go away. This really is a problem with
> having the models contain business logic (the Rails way...)
>
> -jay
> --
> https://code.launchpad.net/~vishvananda/nova/network-refactor/+merge/31808
> You are the owner of lp:~vishvananda/nova/network-refactor.
>

[Eric Day (eday)]

I would also probably rename NetworkData class to VPN or something for consistency, but I don't want to hold this up from getting in any longer. It sounds like we'll be refactoring these data models soon enough and can get it then. :)

review: Approve

[Jay Pipes (jaypipes)]

So...a good chat with Michael on IRC, and the circular import issue has to do with using from nova.auth import manager instead of import nova.auth.manager...

The Vpn class can go back into /network/model.py by changing the import statement. Tested this locally and it works.

-jay

review: Needs Fixing

[OpenStack Infra (hudson-openstack)]

The attempt to merge lp:~vishvananda/nova/network-refactor into lp:nova failed.Below is the output from the failed tests.

nova.tests.access_unittest
  AccessTestCase
    test_001_allow_all ... [OK]
    test_002_allow_none ... [OK]
    test_003_allow_project_manager ... [OK]
    test_004_allow_sys_and_net ... [OK]
    test_005_allow_sys_no_pm ... [OK]
nova.tests.api_unittest
  ApiEc2TestCase
    test_describe_instances ... [OK]
    test_get_all_key_pairs ... [OK]
nova.tests.auth_unittest
  AuthTestCase
    test_001_can_create_users ... [OK]
    test_002_can_get_user ... [OK]
    test_003_can_retreive_properties ... [OK]
    test_004_signature_is_valid ... [OK]
    test_005_can_get_credentials ... [OK]
    test_006_test_key_storage ... [OK]
    test_007_test_key_generation ... [OK]
    test_008_can_list_key_pairs ... [OK]
    test_009_can_delete_key_pair ... [OK]
    test_010_can_list_users ... [OK]
    test_101_can_add_user_role ... [OK]
    test_199_can_remove_user_role ... [OK]
    test_201_can_create_project ... [OK]
    test_202_user1_is_project_member ... [OK]
    test_203_user2_is_not_project_member ... [OK]
    test_204_user1_is_project_manager ... [OK]
    test_205_user2_is_not_project_manager ... [OK]
    test_206_can_add_user_to_project ... [OK]
    test_208_can_remove_user_from_project ... [OK]
    test_209_can_generate_x509 ... [OK]
    test_210_can_add_project_role ... [OK]
    test_211_can_remove_project_role ... [OK]
    test_214_can_retrieve_project_by_user ... [OK]
    test_299_can_delete_project ... [OK]
    test_999_can_delete_users ... [OK]
nova.tests.cloud_unittest
  CloudTestCase
    test_console_output ... [OK]
    test_instance_update_state ... [OK]
    test_run_instances ... [OK]
nova.tests.compute_unittest
  ComputeConnectionTestCase
    test_console_output ... ...

[lp:~vishvananda/nova/network-refactor]

219. By Vish Ishaya on 2010-08-06

merged trunk

220. By Vish Ishaya on 2010-08-06

fix search/replace error

=== modified file 'bin/nova-dhcpbridge'
--- bin/nova-dhcpbridge	2010-07-28 23:11:02 +0000
+++ bin/nova-dhcpbridge	2010-08-06 21:33:45 +0000
@@ -35,32 +35,34 @@
 from nova import flags
 from nova import rpc
 from nova import utils
-from nova.compute import linux_net
-from nova.compute import network
-
+from nova.network import linux_net
+from nova.network import model
+from nova.network import service
 
 FLAGS = flags.FLAGS
 
 
 def add_lease(mac, ip, hostname, interface):
     if FLAGS.fake_rabbit:
-        network.lease_ip(ip)
+        service.VlanNetworkService().lease_ip(ip)
     else:
-        rpc.cast(FLAGS.cloud_topic, {"method": "lease_ip",
-                "args" : {"address": ip}})
+        rpc.cast("%s.%s" (FLAGS.network_topic, FLAGS.node_name),
+                 {"method": "lease_ip",
+                  "args" : {"fixed_ip": ip}})
 
 def old_lease(mac, ip, hostname, interface):
     logging.debug("Adopted old lease or got a change of mac/hostname")
 
 def del_lease(mac, ip, hostname, interface):
     if FLAGS.fake_rabbit:
-        network.release_ip(ip)
+        service.VlanNetworkService().release_ip(ip)
     else:
-        rpc.cast(FLAGS.cloud_topic, {"method": "release_ip",
-                "args" : {"address": ip}})
+        rpc.cast("%s.%s" (FLAGS.network_topic, FLAGS.node_name),
+                 {"method": "release_ip",
+                  "args" : {"fixed_ip": ip}})
 
 def init_leases(interface):
-    net = network.get_network_by_interface(interface)
+    net = model.get_network_by_interface(interface)
     res = ""
     for host_name in net.hosts:
         res += "%s\n" % linux_net.hostDHCP(net, host_name, net.hosts[host_name])

=== modified file 'bin/nova-manage'
--- bin/nova-manage	2010-07-19 18:19:26 +0000
+++ bin/nova-manage	2010-08-06 21:33:45 +0000
@@ -29,16 +29,12 @@
 from nova import utils
 from nova.auth import manager
 from nova.compute import model
-from nova.compute import network
 from nova.cloudpipe import pipelib
 from nova.endpoint import cloud
 
 
 FLAGS = flags.FLAGS
 
-class NetworkCommands(object):
-    def restart(self):
-        network.restart_nets()
 
 class VpnCommands(object):
     def __init__(self):
@@ -170,6 +166,13 @@
         arguments: name"""
         self.manager.delete_project(name)
 
+    def environment(self, project_id, user_id, filename='novarc'):
+        """exports environment variables to an sourcable file
+        arguments: project_id user_id [filename='novarc]"""
+        rc = self.manager.get_environment_rc(project_id, user_id)
+        with open(filename, 'w') as f:
+            f.write(rc)
+
     def list(self):
         """lists all projects
         arguments: <none>"""
@@ -182,14 +185,11 @@
         self.manager.remove_from_project(user, project)
 
     def zip(self, project_id, user_id, filename='nova.zip'):
-        """exports credentials for user to a zip file
+        """exports credentials for project to a zip file
         arguments: project_id user_id [filename='nova.zip]"""
-        project = self.manager.get_project(project_id)
-        if project:
-            with open(filename, 'w') as f:
-                f.write(project.get_credentials(user_id))
-        else:
-            print "Project %s doesn't exist" % project
+        zip = self.manager.get_credentials(project_id, user_id)
+        with open(filename, 'w') as f:
+            f.write(zip)
 
 
 def usage(script_name):
@@ -197,7 +197,6 @@
 
 
 categories = [
-    ('network', NetworkCommands),
     ('user', UserCommands),
     ('project', ProjectCommands),
     ('role', RoleCommands),

=== modified file 'bin/nova-network'
--- bin/nova-network	2010-07-27 00:14:28 +0000
+++ bin/nova-network	2010-08-06 21:33:45 +0000
@@ -21,12 +21,16 @@
   Twistd daemon for the nova network nodes.
 """
 
+from nova import flags
 from nova import twistd
+
 from nova.network import service
 
+FLAGS = flags.FLAGS
+
 
 if __name__ == '__main__':
     twistd.serve(__file__)
 
 if __name__ == '__builtin__':
-    application = service.NetworkService.create()
+    application = service.type_to_class(FLAGS.network_type).create()

=== modified file 'nova/auth/manager.py'
--- nova/auth/manager.py	2010-08-04 06:17:35 +0000
+++ nova/auth/manager.py	2010-08-06 21:33:45 +0000
@@ -36,6 +36,7 @@
 from nova import utils
 from nova.auth import ldapdriver # for flags
 from nova.auth import signer
+from nova.network import vpn
 
 FLAGS = flags.FLAGS
 
@@ -50,13 +51,14 @@
                   'Roles that apply to all projects')
 
 
-flags.DEFINE_bool('use_vpn', True, 'Support per-project vpns')
 flags.DEFINE_string('credentials_template',
                     utils.abspath('auth/novarc.template'),
                     'Template for creating users rc file')
 flags.DEFINE_string('vpn_client_template',
                     utils.abspath('cloudpipe/client.ovpn.template'),
                     'Template for creating users vpn file')
+flags.DEFINE_string('credential_vpn_file', 'nova-vpn.conf',
+                    'Filename of certificate in credentials zip')
 flags.DEFINE_string('credential_key_file', 'pk.pem',
                     'Filename of private key in credentials zip')
 flags.DEFINE_string('credential_cert_file', 'cert.pem',
@@ -64,19 +66,11 @@
 flags.DEFINE_string('credential_rc_file', 'novarc',
                     'Filename of rc in credentials zip')
 
-flags.DEFINE_integer('vpn_start_port', 1000,
-                    'Start port for the cloudpipe VPN servers')
-flags.DEFINE_integer('vpn_end_port', 2000,
-                    'End port for the cloudpipe VPN servers')
-
 flags.DEFINE_string('credential_cert_subject',
                     '/C=US/ST=California/L=MountainView/O=AnsoLabs/'
                     'OU=NovaDev/CN=%s-%s',
                     'Subject for certificate for users')
 
-flags.DEFINE_string('vpn_ip', '127.0.0.1',
-                    'Public IP for the cloudpipe VPN servers')
-
 flags.DEFINE_string('auth_driver', 'nova.auth.ldapdriver.FakeLdapDriver',
                     'Driver that auth manager uses')
 
@@ -228,86 +222,6 @@
                                                         self.member_ids)
 
 
-class NoMorePorts(exception.Error):
-    pass
-
-
-class Vpn(datastore.BasicModel):
-    """Manages vpn ips and ports for projects"""
-    def __init__(self, project_id):
-        self.project_id = project_id
-        super(Vpn, self).__init__()
-
-    @property
-    def identifier(self):
-        """Identifier used for key in redis"""
-        return self.project_id
-
-    @classmethod
-    def create(cls, project_id):
-        """Creates a vpn for project
-
-        This method finds a free ip and port and stores the associated
-        values in the datastore.
-        """
-        # TODO(vish): get list of vpn ips from redis
-        port = cls.find_free_port_for_ip(FLAGS.vpn_ip)
-        vpn = cls(project_id)
-        # save ip for project
-        vpn['project'] = project_id
-        vpn['ip'] = FLAGS.vpn_ip
-        vpn['port'] = port
-        vpn.save()
-        return vpn
-
-    @classmethod
-    def find_free_port_for_ip(cls, ip):
-        """Finds a free port for a given ip from the redis set"""
-        # TODO(vish): these redis commands should be generalized and
-        #             placed into a base class. Conceptually, it is
-        #             similar to an association, but we are just
-        #             storing a set of values instead of keys that
-        #             should be turned into objects.
-        redis = datastore.Redis.instance()
-        key = 'ip:%s:ports' % ip
-        # TODO(vish): these ports should be allocated through an admin
-        #             command instead of a flag
-        if (not redis.exists(key) and
-            not redis.exists(cls._redis_association_name('ip', ip))):
-            for i in range(FLAGS.vpn_start_port, FLAGS.vpn_end_port + 1):
-                redis.sadd(key, i)
-
-        port = redis.spop(key)
-        if not port:
-            raise NoMorePorts()
-        return port
-
-    @classmethod
-    def num_ports_for_ip(cls, ip):
-        """Calculates the number of free ports for a given ip"""
-        return datastore.Redis.instance().scard('ip:%s:ports' % ip)
-
-    @property
-    def ip(self):
-        """The ip assigned to the project"""
-        return self['ip']
-
-    @property
-    def port(self):
-        """The port assigned to the project"""
-        return int(self['port'])
-
-    def save(self):
-        """Saves the association to the given ip"""
-        self.associate_with('ip', self.ip)
-        super(Vpn, self).save()
-
-    def destroy(self):
-        """Cleans up datastore and adds port back to pool"""
-        self.unassociate_with('ip', self.ip)
-        datastore.Redis.instance().sadd('ip:%s:ports' % self.ip, self.port)
-        super(Vpn, self).destroy()
-
 
 class AuthManager(object):
     """Manager Singleton for dealing with Users, Projects, and Keypairs
@@ -585,8 +499,6 @@
                                                description,
                                                member_users)
             if project_dict:
-                if FLAGS.use_vpn:
-                    Vpn.create(project_dict['id'])
                 return Project(**project_dict)
 
     def add_to_project(self, user, project):
@@ -623,10 +535,10 @@
         @return: A tuple containing (ip, port) or None, None if vpn has
         not been allocated for user.
         """
-        vpn = Vpn.lookup(Project.safe_id(project))
-        if not vpn:
-            return None, None
-        return (vpn.ip, vpn.port)
+        network_data = vpn.NetworkData.lookup(Project.safe_id(project))
+        if not network_data:
+            raise exception.NotFound('project network data has not been set')
+        return (network_data.ip, network_data.port)
 
     def delete_project(self, project):
         """Deletes a project"""
@@ -757,25 +669,27 @@
         rc = self.__generate_rc(user.access, user.secret, pid)
         private_key, signed_cert = self._generate_x509_cert(user.id, pid)
 
-        vpn = Vpn.lookup(pid)
-        if not vpn:
-            raise exception.Error("No vpn data allocated for project %s" %
-                                  project.name)
-        configfile = open(FLAGS.vpn_client_template,"r")
-        s = string.Template(configfile.read())
-        configfile.close()
-        config = s.substitute(keyfile=FLAGS.credential_key_file,
-                              certfile=FLAGS.credential_cert_file,
-                              ip=vpn.ip,
-                              port=vpn.port)
-
         tmpdir = tempfile.mkdtemp()
         zf = os.path.join(tmpdir, "temp.zip")
         zippy = zipfile.ZipFile(zf, 'w')
         zippy.writestr(FLAGS.credential_rc_file, rc)
         zippy.writestr(FLAGS.credential_key_file, private_key)
         zippy.writestr(FLAGS.credential_cert_file, signed_cert)
-        zippy.writestr("nebula-client.conf", config)
+
+        network_data = vpn.NetworkData.lookup(pid)
+        if network_data:
+            configfile = open(FLAGS.vpn_client_template,"r")
+            s = string.Template(configfile.read())
+            configfile.close()
+            config = s.substitute(keyfile=FLAGS.credential_key_file,
+                                  certfile=FLAGS.credential_cert_file,
+                                  ip=network_data.ip,
+                                  port=network_data.port)
+            zippy.writestr(FLAGS.credential_vpn_file, config)
+        else:
+            logging.warn("No vpn data for project %s" %
+                                  pid)
+
         zippy.writestr(FLAGS.ca_file, crypto.fetch_ca(user.id))
         zippy.close()
         with open(zf, 'rb') as f:
@@ -784,6 +698,15 @@
         shutil.rmtree(tmpdir)
         return buffer
 
+    def get_environment_rc(self, user, project=None):
+        """Get credential zip for user in project"""
+        if not isinstance(user, User):
+            user = self.get_user(user)
+        if project is None:
+            project = user.id
+        pid = Project.safe_id(project)
+        return self.__generate_rc(user.access, user.secret, pid)
+
     def __generate_rc(self, access, secret, pid):
         """Generate rc file for user"""
         rc = open(FLAGS.credentials_template).read()

=== modified file 'nova/compute/service.py'
--- nova/compute/service.py	2010-07-28 23:11:02 +0000
+++ nova/compute/service.py	2010-08-06 21:33:45 +0000
@@ -39,9 +39,9 @@
 from nova import utils
 from nova.compute import disk
 from nova.compute import model
-from nova.compute import network
 from nova.compute import power_state
 from nova.compute.instance_types import INSTANCE_TYPES
+from nova.network import service as network_service
 from nova.objectstore import image # for image_path flag
 from nova.virt import connection as virt_connection
 from nova.volume import service as volume_service
@@ -117,12 +117,17 @@
         """ launch a new instance with specified options """
         logging.debug("Starting instance %s..." % (instance_id))
         inst = self.instdir.get(instance_id)
-        if not FLAGS.simple_network:
-            # TODO: Get the real security group of launch in here
-            security_group = "default"
-            net = network.BridgedNetwork.get_network_for_project(inst['user_id'],
-                                                             inst['project_id'],
-                                            security_group).express()
+        # TODO: Get the real security group of launch in here
+        security_group = "default"
+        # NOTE(vish): passing network type allows us to express the
+        #             network without making a call to network to find
+        #             out which type of network to setup
+        network_service.setup_compute_network(
+                                           inst.get('network_type', 'vlan'),
+                                           inst['user_id'],
+                                           inst['project_id'],
+                                           security_group)
+
         inst['node_name'] = FLAGS.node_name
         inst.save()
         # TODO(vish) check to make sure the availability zone matches

=== modified file 'nova/endpoint/cloud.py'
--- nova/endpoint/cloud.py	2010-07-31 01:32:12 +0000
+++ nova/endpoint/cloud.py	2010-08-06 21:33:45 +0000
@@ -36,11 +36,11 @@
 from nova.auth import rbac
 from nova.auth import manager
 from nova.compute import model
-from nova.compute import network
 from nova.compute.instance_types import INSTANCE_TYPES
-from nova.compute import service as compute_service
 from nova.endpoint import images
-from nova.volume import service as volume_service
+from nova.network import service as network_service
+from nova.network import model as network_model
+from nova.volume import service
 
 
 FLAGS = flags.FLAGS
@@ -64,7 +64,6 @@
 """
     def __init__(self):
         self.instdir = model.InstanceDirectory()
-        self.network = network.PublicNetworkController()
         self.setup()
 
     @property
@@ -76,7 +75,7 @@
     def volumes(self):
         """ returns a list of all volumes """
         for volume_id in datastore.Redis.instance().smembers("volumes"):
-            volume = volume_service.get_volume(volume_id)
+            volume = service.get_volume(volume_id)
             yield volume
 
     def __str__(self):
@@ -222,7 +221,7 @@
                 callback=_complete)
             return d
 
-        except users.UserError, e:
+        except manager.UserError as e:
             raise
 
     @rbac.allow('all')
@@ -308,7 +307,7 @@
 
     def _get_address(self, context, public_ip):
         # FIXME(vish) this should move into network.py
-        address = self.network.get_host(public_ip)
+        address = network_model.PublicAddress.lookup(public_ip)
         if address and (context.user.is_admin() or address['project_id'] == context.project.id):
             return address
         raise exception.NotFound("Address at ip %s not found" % public_ip)
@@ -330,7 +329,7 @@
         raise exception.NotFound('Instance %s could not be found' % instance_id)
 
     def _get_volume(self, context, volume_id):
-        volume = volume_service.get_volume(volume_id)
+        volume = service.get_volume(volume_id)
         if context.user.is_admin() or volume['project_id'] == context.project.id:
             return volume
         raise exception.NotFound('Volume %s could not be found' % volume_id)
@@ -417,7 +416,7 @@
                 'code': instance.get('state', 0),
                 'name': instance.get('state_description', 'pending')
             }
-            i['public_dns_name'] = self.network.get_public_ip_for_instance(
+            i['public_dns_name'] = network_model.get_public_ip_for_instance(
                                                         i['instance_id'])
             i['private_dns_name'] = instance.get('private_dns_name', None)
             if not i['public_dns_name']:
@@ -452,10 +451,10 @@
 
     def format_addresses(self, context):
         addresses = []
-        for address in self.network.host_objs:
+        for address in network_model.PublicAddress.all():
             # TODO(vish): implement a by_project iterator for addresses
             if (context.user.is_admin() or
-                address['project_id'] == self.project.id):
+                address['project_id'] == context.project.id):
                 address_rv = {
                     'public_ip': address['address'],
                     'instance_id' : address.get('instance_id', 'free')
@@ -470,41 +469,63 @@
         return {'addressesSet': addresses}
 
     @rbac.allow('netadmin')
+    @defer.inlineCallbacks
     def allocate_address(self, context, **kwargs):
-        address = self.network.allocate_ip(
-                                context.user.id, context.project.id, 'public')
-        return defer.succeed({'addressSet': [{'publicIp' : address}]})
+        network_topic = yield self._get_network_topic(context)
+        alloc_result = yield rpc.call(network_topic,
+                         {"method": "allocate_elastic_ip",
+                          "args": {"user_id": context.user.id,
+                                   "project_id": context.project.id}})
+        public_ip = alloc_result['result']
+        defer.returnValue({'addressSet': [{'publicIp' : public_ip}]})
 
     @rbac.allow('netadmin')
+    @defer.inlineCallbacks
     def release_address(self, context, public_ip, **kwargs):
-        self.network.deallocate_ip(public_ip)
-        return defer.succeed({'releaseResponse': ["Address released."]})
+        # NOTE(vish): Should we make sure this works?
+        network_topic = yield self._get_network_topic(context)
+        rpc.cast(network_topic,
+                         {"method": "deallocate_elastic_ip",
+                          "args": {"elastic_ip": public_ip}})
+        defer.returnValue({'releaseResponse': ["Address released."]})
 
     @rbac.allow('netadmin')
-    def associate_address(self, context, instance_id, **kwargs):
+    @defer.inlineCallbacks
+    def associate_address(self, context, instance_id, public_ip, **kwargs):
         instance = self._get_instance(context, instance_id)
-        self.network.associate_address(
-                            kwargs['public_ip'],
-                            instance['private_dns_name'],
-                            instance_id)
-        return defer.succeed({'associateResponse': ["Address associated."]})
+        address = self._get_address(context, public_ip)
+        network_topic = yield self._get_network_topic(context)
+        rpc.cast(network_topic,
+                         {"method": "associate_elastic_ip",
+                          "args": {"elastic_ip": address['address'],
+                                   "fixed_ip": instance['private_dns_name'],
+                                   "instance_id": instance['instance_id']}})
+        defer.returnValue({'associateResponse': ["Address associated."]})
 
     @rbac.allow('netadmin')
+    @defer.inlineCallbacks
     def disassociate_address(self, context, public_ip, **kwargs):
         address = self._get_address(context, public_ip)
-        self.network.disassociate_address(public_ip)
-        # TODO - Strip the IP from the instance
-        return defer.succeed({'disassociateResponse': ["Address disassociated."]})
-
-    def release_ip(self, context, private_ip, **kwargs):
-        self.network.release_ip(private_ip)
-        return defer.succeed({'releaseResponse': ["Address released."]})
-
-    def lease_ip(self, context, private_ip, **kwargs):
-        self.network.lease_ip(private_ip)
-        return defer.succeed({'leaseResponse': ["Address leased."]})
+        network_topic = yield self._get_network_topic(context)
+        rpc.cast(network_topic,
+                         {"method": "disassociate_elastic_ip",
+                          "args": {"elastic_ip": address['address']}})
+        defer.returnValue({'disassociateResponse': ["Address disassociated."]})
+
+    @defer.inlineCallbacks
+    def _get_network_topic(self, context):
+        """Retrieves the network host for a project"""
+        host = network_service.get_host_for_project(context.project.id)
+        if not host:
+            result = yield rpc.call(FLAGS.network_topic,
+                                    {"method": "set_network_host",
+                                     "args": {"user_id": context.user.id,
+                                              "project_id": context.project.id}})
+            host = result['result']
+        defer.returnValue('%s.%s' %(FLAGS.network_topic, host))
 
     @rbac.allow('projectmanager', 'sysadmin')
+    @defer.inlineCallbacks
     def run_instances(self, context, **kwargs):
         # make sure user can access the image
         # vpn image is private so it doesn't show up on lists
@@ -536,15 +557,20 @@
                 raise exception.ApiError('Key Pair %s not found' %
                                          kwargs['key_name'])
             key_data = key_pair.public_key
+        network_topic = yield self._get_network_topic(context)
         # TODO: Get the real security group of launch in here
         security_group = "default"
-        if FLAGS.simple_network:
-            bridge_name = FLAGS.simple_network_bridge
-        else:
-            net = network.BridgedNetwork.get_network_for_project(
-                    context.user.id, context.project.id, security_group)
-            bridge_name = net['bridge_name']
         for num in range(int(kwargs['max_count'])):
+            vpn = False
+            if image_id  == FLAGS.vpn_image_id:
+                vpn = True
+            allocate_result = yield rpc.call(network_topic,
+                     {"method": "allocate_fixed_ip",
+                      "args": {"user_id": context.user.id,
+                               "project_id": context.project.id,
+                               "security_group": security_group,
+                               "vpn": vpn}})
+            allocate_data = allocate_result['result']
             inst = self.instdir.new()
             inst['image_id'] = image_id
             inst['kernel_id'] = kernel_id
@@ -557,24 +583,11 @@
             inst['key_name'] = kwargs.get('key_name', '')
             inst['user_id'] = context.user.id
             inst['project_id'] = context.project.id
-            inst['mac_address'] = utils.generate_mac()
             inst['ami_launch_index'] = num
-            inst['bridge_name'] = bridge_name
-            if FLAGS.simple_network:
-                address = network.allocate_simple_ip()
-            else:
-                if inst['image_id'] == FLAGS.vpn_image_id:
-                    address = network.allocate_vpn_ip(
-                            inst['user_id'],
-                            inst['project_id'],
-                            mac=inst['mac_address'])
-                else:
-                    address = network.allocate_ip(
-                            inst['user_id'],
-                            inst['project_id'],
-                            mac=inst['mac_address'])
-            inst['private_dns_name'] = str(address)
-            # TODO: allocate expresses on the router node
+            inst['security_group'] = security_group
+            for (key, value) in allocate_data.iteritems():
+                inst[key] = value
+
             inst.save()
             rpc.cast(FLAGS.compute_topic,
                  {"method": "run_instance",
@@ -582,40 +595,49 @@
             logging.debug("Casting to node for %s's instance with IP of %s" %
                       (context.user.name, inst['private_dns_name']))
         # TODO: Make Network figure out the network name from ip.
-        return defer.succeed(self._format_instances(
-                                context, reservation_id))
+        defer.returnValue(self._format_instances(context, reservation_id))
 
     @rbac.allow('projectmanager', 'sysadmin')
+    @defer.inlineCallbacks
     def terminate_instances(self, context, instance_id, **kwargs):
         logging.debug("Going to start terminating instances")
+        network_topic = yield self._get_network_topic(context)
         for i in instance_id:
             logging.debug("Going to try and terminate %s" % i)
             try:
                 instance = self._get_instance(context, i)
             except exception.NotFound:
-                logging.warning("Instance %s was not found during terminate" % i)
+                logging.warning("Instance %s was not found during terminate"
+                                % i)
                 continue
-            try:
-                self.network.disassociate_address(
-                    instance.get('public_dns_name', 'bork'))
-            except:
-                pass
-            if instance.get('private_dns_name', None):
-                logging.debug("Deallocating address %s" % instance.get('private_dns_name', None))
-                if FLAGS.simple_network:
-                    network.deallocate_simple_ip(instance.get('private_dns_name', None))
-                else:
-                    try:
-                        self.network.deallocate_ip(instance.get('private_dns_name', None))
-                    except Exception, _err:
-                        pass
-            if instance.get('node_name', 'unassigned') != 'unassigned':  #It's also internal default
+            elastic_ip = network_model.get_public_ip_for_instance(i)
+            if elastic_ip:
+                logging.debug("Disassociating address %s" % elastic_ip)
+                # NOTE(vish): Right now we don't really care if the ip is
+                #             disassociated.  We may need to worry about
+                #             checking this later.  Perhaps in the scheduler?
+                rpc.cast(network_topic,
+                         {"method": "disassociate_elastic_ip",
+                          "args": {"elastic_ip": elastic_ip}})
+
+            fixed_ip = instance.get('private_dns_name', None)
+            if fixed_ip:
+                logging.debug("Deallocating address %s" % fixed_ip)
+                # NOTE(vish): Right now we don't really care if the ip is
+                #             actually removed.  We may need to worry about
+                #             checking this later.  Perhaps in the scheduler?
+                rpc.cast(network_topic,
+                         {"method": "deallocate_fixed_ip",
+                          "args": {"fixed_ip": fixed_ip}})
+
+            if instance.get('node_name', 'unassigned') != 'unassigned':
+                # NOTE(joshua?): It's also internal default
                 rpc.cast('%s.%s' % (FLAGS.compute_topic, instance['node_name']),
-                             {"method": "terminate_instance",
-                              "args" : {"instance_id": i}})
+                         {"method": "terminate_instance",
+                          "args": {"instance_id": i}})
             else:
                 instance.destroy()
-        return defer.succeed(True)
+        defer.returnValue(True)
 
     @rbac.allow('projectmanager', 'sysadmin')
     def reboot_instances(self, context, instance_id, **kwargs):

=== renamed file 'nova/compute/exception.py' => 'nova/network/exception.py'
--- nova/compute/exception.py	2010-07-15 23:13:48 +0000
+++ nova/network/exception.py	2010-08-06 21:33:45 +0000
@@ -17,7 +17,7 @@
 #    under the License.
 
 """
-Exceptions for Compute Node errors, mostly network addressing.
+Exceptions for network errors.
 """
 
 from nova.exception import Error

=== renamed file 'nova/compute/linux_net.py' => 'nova/network/linux_net.py'
=== renamed file 'nova/compute/network.py' => 'nova/network/model.py'
--- nova/compute/network.py	2010-07-27 21:16:49 +0000
+++ nova/network/model.py	2010-08-06 21:33:45 +0000
@@ -17,7 +17,7 @@
 #    under the License.
 
 """
-Classes for network control, including VLANs, DHCP, and IP allocation.
+Model Classes for network control, including VLANs, DHCP, and IP allocation.
 """
 
 import IPy
@@ -26,12 +26,12 @@
 import time
 
 from nova import datastore
-from nova import exception
+from nova import exception as nova_exception
 from nova import flags
 from nova import utils
 from nova.auth import manager
-from nova.compute import exception as compute_exception
-from nova.compute import linux_net
+from nova.network import exception
+from nova.network import linux_net
 
 
 FLAGS = flags.FLAGS
@@ -53,26 +53,6 @@
 flags.DEFINE_integer('cloudpipe_start_port', 12000,
                         'Starting port for mapped CloudPipe external ports')
 
-flags.DEFINE_boolean('simple_network', False,
-                       'Use simple networking instead of vlans')
-flags.DEFINE_string('simple_network_bridge', 'br100',
-                       'Bridge for simple network instances')
-flags.DEFINE_list('simple_network_ips', ['192.168.0.2'],
-                       'Available ips for simple network')
-flags.DEFINE_string('simple_network_template',
-                    utils.abspath('compute/interfaces.template'),
-                    'Template file for simple network')
-flags.DEFINE_string('simple_network_netmask', '255.255.255.0',
-                       'Netmask for simple network')
-flags.DEFINE_string('simple_network_network', '192.168.0.0',
-                       'Network for simple network')
-flags.DEFINE_string('simple_network_gateway', '192.168.0.1',
-                       'Broadcast for simple network')
-flags.DEFINE_string('simple_network_broadcast', '192.168.0.255',
-                       'Broadcast for simple network')
-flags.DEFINE_string('simple_network_dns', '8.8.4.4',
-                       'Dns for simple network')
-
 logging.getLogger().setLevel(logging.DEBUG)
 
 
@@ -156,7 +136,6 @@
 
 # CLEANUP:
 # TODO(ja): Save the IPs at the top of each subnet for cloudpipe vpn clients
-# TODO(ja): use singleton for usermanager instead of self.manager in vlanpool et al
 # TODO(ja): does vlanpool "keeper" need to know the min/max - shouldn't FLAGS always win?
 # TODO(joshua): Save the IPs at the top of each subnet for cloudpipe vpn clients
 
@@ -241,7 +220,7 @@
         for idx in range(self.num_static_ips, len(self.network)-(1 + FLAGS.cnt_vpn_clients)):
             address = str(self.network[idx])
             if not address in self.hosts.keys():
-                yield str(address)
+                yield address
 
     @property
     def num_static_ips(self):
@@ -253,7 +232,7 @@
             self._add_host(user_id, project_id, address, mac)
             self.express(address=address)
             return address
-        raise compute_exception.NoMoreAddresses("Project %s with network %s" %
+        raise exception.NoMoreAddresses("Project %s with network %s" %
                                                 (project_id, str(self.network)))
 
     def lease_ip(self, ip_str):
@@ -261,7 +240,7 @@
 
     def release_ip(self, ip_str):
         if not ip_str in self.assigned:
-            raise compute_exception.AddressNotAllocated()
+            raise exception.AddressNotAllocated()
         self.deexpress(address=ip_str)
         self._rem_host(ip_str)
 
@@ -349,14 +328,14 @@
             logging.debug("Not launching dnsmasq: no hosts.")
         self.express_cloudpipe()
 
-    def allocate_vpn_ip(self, mac):
+    def allocate_vpn_ip(self, user_id, project_id, mac):
         address = str(self.network[2])
-        self._add_host(self['user_id'], self['project_id'], address, mac)
+        self._add_host(user_id, project_id, address, mac)
         self.express(address=address)
         return address
 
     def express_cloudpipe(self):
-        private_ip = self.network[2]
+        private_ip = str(self.network[2])
         linux_net.confirm_rule("FORWARD -d %s -p udp --dport 1194 -j ACCEPT"
                                % (private_ip, ))
         linux_net.confirm_rule("PREROUTING -t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
@@ -394,6 +373,7 @@
         addr.save()
         return addr
 
+
 DEFAULT_PORTS = [("tcp",80), ("tcp",22), ("udp",1194), ("tcp",443)]
 class PublicNetworkController(BaseNetwork):
     override_type = 'network'
@@ -420,12 +400,6 @@
         for address in self.assigned:
             yield PublicAddress(address)
 
-    def get_public_ip_for_instance(self, instance_id):
-        # FIXME: this should be a lookup - iteration won't scale
-        for address_record in self.host_objs:
-            if address_record.get('instance_id', 'available') == instance_id:
-                return address_record['address']
-
     def get_host(self, host):
         if host in self.assigned:
             return PublicAddress(host)
@@ -439,16 +413,20 @@
         PublicAddress(host).destroy()
         datastore.Redis.instance().hdel(self._hosts_key, host)
 
+    def deallocate_ip(self, ip_str):
+        # NOTE(vish): cleanup is now done on release by the parent class
+	self.release_ip(ip_str)
+
     def associate_address(self, public_ip, private_ip, instance_id):
         if not public_ip in self.assigned:
-            raise compute_exception.AddressNotAllocated()
+            raise exception.AddressNotAllocated()
         # TODO(joshua): Keep an index going both ways
         for addr in self.host_objs:
             if addr.get('private_ip', None) == private_ip:
-                raise compute_exception.AddressAlreadyAssociated()
+                raise exception.AddressAlreadyAssociated()
         addr = self.get_host(public_ip)
         if addr.get('private_ip', 'available') != 'available':
-            raise compute_exception.AddressAlreadyAssociated()
+            raise exception.AddressAlreadyAssociated()
         addr['private_ip'] = private_ip
         addr['instance_id'] = instance_id
         addr.save()
@@ -456,10 +434,10 @@
 
     def disassociate_address(self, public_ip):
         if not public_ip in self.assigned:
-            raise compute_exception.AddressNotAllocated()
+            raise exception.AddressNotAllocated()
         addr = self.get_host(public_ip)
         if addr.get('private_ip', 'available') == 'available':
-            raise compute_exception.AddressNotAssociated()
+            raise exception.AddressNotAssociated()
         self.deexpress(address=public_ip)
         addr['private_ip'] = 'available'
         addr['instance_id'] = 'available'
@@ -535,63 +513,42 @@
                 return vlan
             else:
                 return Vlan.create(project_id, vnum)
-    raise compute_exception.AddressNotAllocated("Out of VLANs")
-
-def get_network_by_interface(iface, security_group='default'):
-    vlan = iface.rpartition("br")[2]
-    return get_project_network(Vlan.dict_by_vlan().get(vlan), security_group)
+    raise exception.AddressNotAllocated("Out of VLANs")
+
+def get_project_network(project_id, security_group='default'):
+    """ get a project's private network, allocating one if needed """
+    project = manager.AuthManager().get_project(project_id)
+    if not project:
+        raise nova_exception.NotFound("Project %s doesn't exist." % project_id)
+    manager_id = project.project_manager_id
+    return DHCPNetwork.get_network_for_project(manager_id,
+                                               project.id,
+                                               security_group)
+
 
 def get_network_by_address(address):
+    # TODO(vish): This is completely the wrong way to do this, but
+    #             I'm getting the network binary working before I
+    #             tackle doing this the right way.
     logging.debug("Get Network By Address: %s" % address)
     for project in manager.AuthManager().get_projects():
         net = get_project_network(project.id)
         if address in net.assigned:
             logging.debug("Found %s in %s" % (address, project.id))
             return net
-    raise compute_exception.AddressNotAllocated()
-
-def allocate_simple_ip():
-    redis = datastore.Redis.instance()
-    if not redis.exists('ips') and not len(redis.keys('instances:*')):
-        for address in FLAGS.simple_network_ips:
-            redis.sadd('ips', address)
-    address = redis.spop('ips')
-    if not address:
-        raise exception.NoMoreAddresses()
-    return address
-
-def deallocate_simple_ip(address):
-    datastore.Redis.instance().sadd('ips', address)
-
-
-def allocate_vpn_ip(user_id, project_id, mac):
-    return get_project_network(project_id).allocate_vpn_ip(mac)
-
-def allocate_ip(user_id, project_id, mac):
-    return get_project_network(project_id).allocate_ip(user_id, project_id, mac)
-
-def deallocate_ip(address):
-    return get_network_by_address(address).deallocate_ip(address)
-
-def release_ip(address):
-    return get_network_by_address(address).release_ip(address)
-
-def lease_ip(address):
-    return get_network_by_address(address).lease_ip(address)
-
-def get_project_network(project_id, security_group='default'):
-    """ get a project's private network, allocating one if needed """
-    # TODO(todd): It looks goofy to get a project from a UserManager.
-    #             Refactor to still use the LDAP backend, but not User specific.
-    project = manager.AuthManager().get_project(project_id)
-    if not project:
-        raise exception.Error("Project %s doesn't exist, uhoh." %
-                                   project_id)
-    return DHCPNetwork.get_network_for_project(project.project_manager_id,
-                                               project.id, security_group)
-
-
-def restart_nets():
-    """ Ensure the network for each user is enabled"""
-    for project in manager.AuthManager().get_projects():
-        get_project_network(project.id).express()
+    raise exception.AddressNotAllocated()
+
+
+def get_network_by_interface(iface, security_group='default'):
+    vlan = iface.rpartition("br")[2]
+    project_id = Vlan.dict_by_vlan().get(vlan)
+    return get_project_network(project_id, security_group)
+
+
+
+def get_public_ip_for_instance(instance_id):
+    # FIXME: this should be a lookup - iteration won't scale
+    for address_record in PublicAddress.all():
+        if address_record.get('instance_id', 'available') == instance_id:
+            return address_record['address']
+

=== modified file 'nova/network/service.py'
--- nova/network/service.py	2010-07-27 00:14:28 +0000
+++ nova/network/service.py	2010-08-06 21:33:45 +0000
@@ -20,16 +20,211 @@
 Network Nodes are responsible for allocating ips and setting up network
 """
 
-import logging
-
+from nova import datastore
 from nova import flags
 from nova import service
-
+from nova import utils
+from nova.auth import manager
+from nova.exception import NotFound
+from nova.network import exception
+from nova.network import model
+from nova.network import vpn
 
 FLAGS = flags.FLAGS
 
-class NetworkService(service.Service):
-    """Allocates ips and sets up networks"""
-
-    def __init__(self):
-        logging.debug("Network node working")
+flags.DEFINE_string('network_type',
+                    'flat',
+                    'Service Class for Networking')
+flags.DEFINE_string('flat_network_bridge', 'br100',
+                    'Bridge for simple network instances')
+flags.DEFINE_list('flat_network_ips',
+                  ['192.168.0.2','192.168.0.3','192.168.0.4'],
+                  'Available ips for simple network')
+flags.DEFINE_string('flat_network_network', '192.168.0.0',
+                       'Network for simple network')
+flags.DEFINE_string('flat_network_netmask', '255.255.255.0',
+                       'Netmask for simple network')
+flags.DEFINE_string('flat_network_gateway', '192.168.0.1',
+                       'Broadcast for simple network')
+flags.DEFINE_string('flat_network_broadcast', '192.168.0.255',
+                       'Broadcast for simple network')
+flags.DEFINE_string('flat_network_dns', '8.8.4.4',
+                       'Dns for simple network')
+
+def type_to_class(network_type):
+    if network_type == 'flat':
+        return FlatNetworkService
+    elif network_type  == 'vlan':
+        return VlanNetworkService
+    raise NotFound("Couldn't find %s network type" % network_type)
+
+
+def setup_compute_network(network_type, user_id, project_id, security_group):
+    srv = type_to_class(network_type)
+    srv.setup_compute_network(network_type, user_id, project_id, security_group)
+
+
+def get_host_for_project(project_id):
+    redis = datastore.Redis.instance()
+    return redis.get(_host_key(project_id))
+
+
+def _host_key(project_id):
+    return "network_host:%s" % project_id
+
+
+class BaseNetworkService(service.Service):
+    """Implements common network service functionality
+
+    This class must be subclassed.
+    """
+    def __init__(self, *args, **kwargs):
+        self.network = model.PublicNetworkController()
+
+    def set_network_host(self, user_id, project_id, *args, **kwargs):
+        """Safely sets the host of the projects network"""
+        redis = datastore.Redis.instance()
+        key = _host_key(project_id)
+        if redis.setnx(key, FLAGS.node_name):
+            self._on_set_network_host(user_id, project_id,
+                                      security_group='default',
+                                      *args, **kwargs)
+            return FLAGS.node_name
+        else:
+            return redis.get(key)
+
+    def allocate_fixed_ip(self, user_id, project_id,
+                          security_group='default',
+                          *args, **kwargs):
+        """Subclass implements getting fixed ip from the pool"""
+        raise NotImplementedError()
+
+    def deallocate_fixed_ip(self, fixed_ip, *args, **kwargs):
+        """Subclass implements return of ip to the pool"""
+        raise NotImplementedError()
+
+    def _on_set_network_host(self, user_id, project_id,
+                              *args, **kwargs):
+        """Called when this host becomes the host for a project"""
+        pass
+
+    @classmethod
+    def setup_compute_network(self, user_id, project_id, security_group,
+                              *args, **kwargs):
+        """Sets up matching network for compute hosts"""
+        raise NotImplementedError()
+
+    def allocate_elastic_ip(self, user_id, project_id):
+        """Gets a elastic ip from the pool"""
+        # NOTE(vish): Replicating earlier decision to use 'public' as
+        #             mac address name, although this should probably
+        #             be done inside of the PublicNetworkController
+        return self.network.allocate_ip(user_id, project_id, 'public')
+
+    def associate_elastic_ip(self, elastic_ip, fixed_ip, instance_id):
+        """Associates an elastic ip to a fixed ip"""
+        self.network.associate_address(elastic_ip, fixed_ip, instance_id)
+
+    def disassociate_elastic_ip(self, elastic_ip):
+        """Disassociates a elastic ip"""
+        self.network.disassociate_address(elastic_ip)
+
+    def deallocate_elastic_ip(self, elastic_ip):
+        """Returns a elastic ip to the pool"""
+        self.network.deallocate_ip(elastic_ip)
+
+
+class FlatNetworkService(BaseNetworkService):
+    """Basic network where no vlans are used"""
+
+    @classmethod
+    def setup_compute_network(self, user_id, project_id, security_group,
+                              *args, **kwargs):
+        """Network is created manually"""
+        pass
+
+    def allocate_fixed_ip(self, user_id, project_id,
+                          security_group='default',
+                          *args, **kwargs):
+        """Gets a fixed ip from the pool
+
+        Flat network just grabs the next available ip from the pool
+        """
+        # NOTE(vish): Some automation could be done here.  For example,
+        #             creating the flat_network_bridge and setting up
+        #             a gateway.  This is all done manually atm
+        redis = datastore.Redis.instance()
+        if not redis.exists('ips') and not len(redis.keys('instances:*')):
+            for fixed_ip in FLAGS.flat_network_ips:
+                redis.sadd('ips', fixed_ip)
+        fixed_ip = redis.spop('ips')
+        if not fixed_ip:
+            raise exception.NoMoreAddresses()
+        return {'inject_network': True,
+                'network_type': FLAGS.network_type,
+                'mac_address': utils.generate_mac(),
+                'private_dns_name': str(fixed_ip),
+                'bridge_name': FLAGS.flat_network_bridge,
+                'network_network': FLAGS.flat_network_network,
+                'network_netmask': FLAGS.flat_network_netmask,
+                'network_gateway': FLAGS.flat_network_gateway,
+                'network_broadcast': FLAGS.flat_network_broadcast,
+                'network_dns': FLAGS.flat_network_dns}
+
+    def deallocate_fixed_ip(self, fixed_ip, *args, **kwargs):
+        """Returns an ip to the pool"""
+        datastore.Redis.instance().sadd('ips', fixed_ip)
+
+class VlanNetworkService(BaseNetworkService):
+    """Vlan network with dhcp"""
+    # NOTE(vish): A lot of the interactions with network/model.py can be
+    #             simplified and improved.  Also there it may be useful
+    #             to support vlans separately from dhcp, instead of having
+    #             both of them together in this class.
+    def allocate_fixed_ip(self, user_id, project_id,
+                          security_group='default',
+                          vpn=False, *args, **kwargs):
+        """Gets a fixed ip from the pool """
+        mac = utils.generate_mac()
+        net = model.get_project_network(project_id)
+        if vpn:
+            fixed_ip = net.allocate_vpn_ip(user_id, project_id, mac)
+        else:
+            fixed_ip = net.allocate_ip(user_id, project_id, mac)
+        return {'network_type': FLAGS.network_type,
+                'bridge_name': net['bridge_name'],
+                'mac_address': mac,
+                'private_dns_name' : fixed_ip}
+
+    def deallocate_fixed_ip(self, fixed_ip,
+                            *args, **kwargs):
+        """Returns an ip to the pool"""
+        return model.get_network_by_address(fixed_ip).deallocate_ip(fixed_ip)
+
+    def lease_ip(self, address):
+        return model.get_network_by_address(address).lease_ip(address)
+
+    def release_ip(self, address):
+        return model.get_network_by_address(address).release_ip(address)
+
+    def restart_nets(self):
+        """Ensure the network for each user is enabled"""
+        for project in manager.AuthManager().get_projects():
+            model.get_project_network(project.id).express()
+
+    def _on_set_network_host(self, user_id, project_id,
+                             *args, **kwargs):
+        """Called when this host becomes the host for a project"""
+        vpn.NetworkData.create(project_id)
+
+    @classmethod
+    def setup_compute_network(self, user_id, project_id, security_group,
+                              *args, **kwargs):
+        """Sets up matching network for compute hosts"""
+        # NOTE(vish): Use BridgedNetwork instead of DHCPNetwork because
+        #             we don't want to run dnsmasq on the client machines
+        net = model.BridgedNetwork.get_network_for_project(
+                                            user_id,
+                                            project_id,
+                                            security_group)
+        net.express()

=== added file 'nova/network/vpn.py'
--- nova/network/vpn.py	1970-01-01 00:00:00 +0000
+++ nova/network/vpn.py	2010-08-06 21:33:45 +0000
@@ -0,0 +1,116 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Network Data for projects"""
+
+from nova import datastore
+from nova import exception
+from nova import flags
+from nova import utils
+
+FLAGS = flags.FLAGS
+
+
+flags.DEFINE_string('vpn_ip', utils.get_my_ip(),
+                    'Public IP for the cloudpipe VPN servers')
+flags.DEFINE_integer('vpn_start_port', 1000,
+                    'Start port for the cloudpipe VPN servers')
+flags.DEFINE_integer('vpn_end_port', 2000,
+                    'End port for the cloudpipe VPN servers')
+
+class NoMorePorts(exception.Error):
+    pass
+
+
+class NetworkData(datastore.BasicModel):
+    """Manages network host, and vpn ip and port for projects"""
+    def __init__(self, project_id):
+        self.project_id = project_id
+        super(NetworkData, self).__init__()
+
+    @property
+    def identifier(self):
+        """Identifier used for key in redis"""
+        return self.project_id
+
+    @classmethod
+    def create(cls, project_id):
+        """Creates a vpn for project
+
+        This method finds a free ip and port and stores the associated
+        values in the datastore.
+        """
+        # TODO(vish): will we ever need multiiple ips per host?
+        port = cls.find_free_port_for_ip(FLAGS.vpn_ip)
+        network_data = cls(project_id)
+        # save ip for project
+        network_data['host'] = FLAGS.node_name
+        network_data['project'] = project_id
+        network_data['ip'] = FLAGS.vpn_ip
+        network_data['port'] = port
+        network_data.save()
+        return network_data
+
+    @classmethod
+    def find_free_port_for_ip(cls, ip):
+        """Finds a free port for a given ip from the redis set"""
+        # TODO(vish): these redis commands should be generalized and
+        #             placed into a base class. Conceptually, it is
+        #             similar to an association, but we are just
+        #             storing a set of values instead of keys that
+        #             should be turned into objects.
+        redis = datastore.Redis.instance()
+        key = 'ip:%s:ports' % ip
+        # TODO(vish): these ports should be allocated through an admin
+        #             command instead of a flag
+        if (not redis.exists(key) and
+            not redis.exists(cls._redis_association_name('ip', ip))):
+            for i in range(FLAGS.vpn_start_port, FLAGS.vpn_end_port + 1):
+                redis.sadd(key, i)
+
+        port = redis.spop(key)
+        if not port:
+            raise NoMorePorts()
+        return port
+
+    @classmethod
+    def num_ports_for_ip(cls, ip):
+        """Calculates the number of free ports for a given ip"""
+        return datastore.Redis.instance().scard('ip:%s:ports' % ip)
+
+    @property
+    def ip(self):
+        """The ip assigned to the project"""
+        return self['ip']
+
+    @property
+    def port(self):
+        """The port assigned to the project"""
+        return int(self['port'])
+
+    def save(self):
+        """Saves the association to the given ip"""
+        self.associate_with('ip', self.ip)
+        super(NetworkData, self).save()
+
+    def destroy(self):
+        """Cleans up datastore and adds port back to pool"""
+        self.unassociate_with('ip', self.ip)
+        datastore.Redis.instance().sadd('ip:%s:ports' % self.ip, self.port)
+        super(NetworkData, self).destroy()
+

=== modified file 'nova/rpc.py'
--- nova/rpc.py	2010-07-28 23:11:02 +0000
+++ nova/rpc.py	2010-08-06 21:33:45 +0000
@@ -238,12 +238,12 @@
                                       exchange=msg_id,
                                       auto_delete=True,
                                       exchange_type="direct",
-                                      routing_key=msg_id,
-                                      durable=False)
+                                      routing_key=msg_id)
         consumer.register_callback(generic_response)
 
     publisher = messaging.Publisher(connection=Connection.instance(),
                                     exchange=FLAGS.control_exchange,
+                                    durable=False,
                                     exchange_type="topic",
                                     routing_key=topic)
     publisher.send(message)

=== modified file 'nova/tests/auth_unittest.py'
--- nova/tests/auth_unittest.py	2010-08-05 23:56:23 +0000
+++ nova/tests/auth_unittest.py	2010-08-06 21:33:45 +0000
@@ -187,20 +187,6 @@
         self.manager.remove_role('test1', 'sysadmin')
         self.assertFalse(project.has_role('test1', 'sysadmin'))
 
-    def test_212_vpn_ip_and_port_looks_valid(self):
-        project = self.manager.get_project('testproj')
-        self.assert_(project.vpn_ip)
-        self.assert_(project.vpn_port >= FLAGS.vpn_start_port)
-        self.assert_(project.vpn_port <= FLAGS.vpn_end_port)
-
-    def test_213_too_many_vpns(self):
-        vpns = []
-        for i in xrange(manager.Vpn.num_ports_for_ip(FLAGS.vpn_ip)):
-            vpns.append(manager.Vpn.create("vpnuser%s" % i))
-        self.assertRaises(manager.NoMorePorts, manager.Vpn.create, "boom")
-        for vpn in vpns:
-            vpn.destroy()
-
     def test_214_can_retrieve_project_by_user(self):
         project = self.manager.create_project('testproj2', 'test2', 'Another test project', ['test2'])
         self.assert_(len(self.manager.get_projects()) > 1)

=== modified file 'nova/tests/network_unittest.py'
--- nova/tests/network_unittest.py	2010-07-28 23:11:02 +0000
+++ nova/tests/network_unittest.py	2010-08-06 21:33:45 +0000
@@ -24,8 +24,10 @@
 from nova import test
 from nova import utils
 from nova.auth import manager
-from nova.compute import network
-from nova.compute.exception import NoMoreAddresses
+from nova.network import model
+from nova.network import service
+from nova.network import vpn
+from nova.network.exception import NoMoreAddresses
 
 FLAGS = flags.FLAGS
 
@@ -52,7 +54,8 @@
             self.projects.append(self.manager.create_project(name,
                                                              'netuser',
                                                              name))
-        self.network = network.PublicNetworkController()
+        self.network = model.PublicNetworkController()
+        self.service = service.VlanNetworkService()
 
     def tearDown(self):
         super(NetworkTestCase, self).tearDown()
@@ -66,16 +69,17 @@
         self.assertTrue(IPy.IP(address) in pubnet)
         self.assertTrue(IPy.IP(address) in self.network.network)
 
-    def test_allocate_deallocate_ip(self):
-        address = network.allocate_ip(
-                self.user.id, self.projects[0].id, utils.generate_mac())
+    def test_allocate_deallocate_fixed_ip(self):
+        result  = yield self.service.allocate_fixed_ip(
+                self.user.id, self.projects[0].id)
+        address = result['private_dns_name']
+        mac = result['mac_address']
         logging.debug("Was allocated %s" % (address))
-        net = network.get_project_network(self.projects[0].id, "default")
+        net = model.get_project_network(self.projects[0].id, "default")
         self.assertEqual(True, is_in_project(address, self.projects[0].id))
-        mac = utils.generate_mac()
         hostname = "test-host"
         self.dnsmasq.issue_ip(mac, address, hostname, net.bridge_name)
-        rv = network.deallocate_ip(address)
+        rv = self.service.deallocate_fixed_ip(address)
 
         # Doesn't go away until it's dhcp released
         self.assertEqual(True, is_in_project(address, self.projects[0].id))
@@ -84,15 +88,18 @@
         self.assertEqual(False, is_in_project(address, self.projects[0].id))
 
     def test_range_allocation(self):
-        mac = utils.generate_mac()
-        secondmac = utils.generate_mac()
         hostname = "test-host"
-        address = network.allocate_ip(
-                    self.user.id, self.projects[0].id, mac)
-        secondaddress = network.allocate_ip(
-                self.user, self.projects[1].id, secondmac)
-        net = network.get_project_network(self.projects[0].id, "default")
-        secondnet = network.get_project_network(self.projects[1].id, "default")
+        result = yield self.service.allocate_fixed_ip(
+                    self.user.id, self.projects[0].id)
+        mac = result['mac_address']
+        address = result['private_dns_name']
+        result = yield self.service.allocate_fixed_ip(
+                self.user, self.projects[1].id)
+        secondmac = result['mac_address']
+        secondaddress = result['private_dns_name']
+
+        net = model.get_project_network(self.projects[0].id, "default")
+        secondnet = model.get_project_network(self.projects[1].id, "default")
 
         self.assertEqual(True, is_in_project(address, self.projects[0].id))
         self.assertEqual(True, is_in_project(secondaddress, self.projects[1].id))
@@ -103,46 +110,64 @@
         self.dnsmasq.issue_ip(secondmac, secondaddress,
                                 hostname, secondnet.bridge_name)
 
-        rv = network.deallocate_ip(address)
+        rv = self.service.deallocate_fixed_ip(address)
         self.dnsmasq.release_ip(mac, address, hostname, net.bridge_name)
         self.assertEqual(False, is_in_project(address, self.projects[0].id))
 
         # First address release shouldn't affect the second
         self.assertEqual(True, is_in_project(secondaddress, self.projects[1].id))
 
-        rv = network.deallocate_ip(secondaddress)
+        rv = self.service.deallocate_fixed_ip(secondaddress)
         self.dnsmasq.release_ip(secondmac, secondaddress,
                                 hostname, secondnet.bridge_name)
         self.assertEqual(False, is_in_project(secondaddress, self.projects[1].id))
 
     def test_subnet_edge(self):
-        secondaddress = network.allocate_ip(self.user.id, self.projects[0].id,
-                                utils.generate_mac())
+        result = yield self.service.allocate_fixed_ip(self.user.id,
+                                                       self.projects[0].id)
+        firstaddress = result['private_dns_name']
         hostname = "toomany-hosts"
         for i in range(1,5):
             project_id = self.projects[i].id
-            mac = utils.generate_mac()
-            mac2 = utils.generate_mac()
-            mac3 = utils.generate_mac()
-            address = network.allocate_ip(
-                    self.user, project_id, mac)
-            address2 = network.allocate_ip(
-                    self.user, project_id, mac2)
-            address3 = network.allocate_ip(
-                    self.user, project_id, mac3)
+            result = yield self.service.allocate_fixed_ip(
+                    self.user, project_id)
+            mac = result['mac_address']
+            address = result['private_dns_name']
+            result = yield self.service.allocate_fixed_ip(
+                    self.user, project_id)
+            mac2 = result['mac_address']
+            address2 = result['private_dns_name']
+            result = yield self.service.allocate_fixed_ip(
+                   self.user, project_id)
+            mac3 = result['mac_address']
+            address3 = result['private_dns_name']
             self.assertEqual(False, is_in_project(address, self.projects[0].id))
             self.assertEqual(False, is_in_project(address2, self.projects[0].id))
             self.assertEqual(False, is_in_project(address3, self.projects[0].id))
-            rv = network.deallocate_ip(address)
-            rv = network.deallocate_ip(address2)
-            rv = network.deallocate_ip(address3)
-            net = network.get_project_network(project_id, "default")
+            rv = self.service.deallocate_fixed_ip(address)
+            rv = self.service.deallocate_fixed_ip(address2)
+            rv = self.service.deallocate_fixed_ip(address3)
+            net = model.get_project_network(project_id, "default")
             self.dnsmasq.release_ip(mac, address, hostname, net.bridge_name)
             self.dnsmasq.release_ip(mac2, address2, hostname, net.bridge_name)
             self.dnsmasq.release_ip(mac3, address3, hostname, net.bridge_name)
-        net = network.get_project_network(self.projects[0].id, "default")
-        rv = network.deallocate_ip(secondaddress)
-        self.dnsmasq.release_ip(mac, secondaddress, hostname, net.bridge_name)
+        net = model.get_project_network(self.projects[0].id, "default")
+        rv = self.service.deallocate_fixed_ip(firstaddress)
+        self.dnsmasq.release_ip(mac, firstaddress, hostname, net.bridge_name)
+
+    def test_212_vpn_ip_and_port_looks_valid(self):
+        vpn.NetworkData.create(self.projects[0].id)
+        self.assert_(self.projects[0].vpn_ip)
+        self.assert_(self.projects[0].vpn_port >= FLAGS.vpn_start_port)
+        self.assert_(self.projects[0].vpn_port <= FLAGS.vpn_end_port)
+
+    def test_too_many_vpns(self):
+        vpns = []
+        for i in xrange(vpn.NetworkData.num_ports_for_ip(FLAGS.vpn_ip)):
+            vpns.append(vpn.NetworkData.create("vpnuser%s" % i))
+        self.assertRaises(vpn.NoMorePorts, vpn.NetworkData.create, "boom")
+        for network_datum in vpns:
+            network_datum.destroy()
 
     def test_release_before_deallocate(self):
         pass
@@ -169,7 +194,7 @@
                                                NUM_RESERVED_VPN_IPS)
         usable addresses
         """
-        net = network.get_project_network(self.projects[0].id, "default")
+        net = model.get_project_network(self.projects[0].id, "default")
 
         # Determine expected number of available IP addresses
         num_static_ips = net.num_static_ips
@@ -183,22 +208,23 @@
         macs = {}
         addresses = {}
         for i in range(0, (num_available_ips - 1)):
-            macs[i] = utils.generate_mac()
-            addresses[i] = network.allocate_ip(self.user.id, self.projects[0].id, macs[i])
+            result = yield self.service.allocate_fixed_ip(self.user.id, self.projects[0].id)
+            macs[i] = result['mac_address']
+            addresses[i] = result['private_dns_name']
             self.dnsmasq.issue_ip(macs[i], addresses[i], hostname, net.bridge_name)
 
-        self.assertRaises(NoMoreAddresses, network.allocate_ip, self.user.id, self.projects[0].id, utils.generate_mac())
+        self.assertFailure(self.service.allocate_fixed_ip(self.user.id, self.projects[0].id), NoMoreAddresses)
 
         for i in range(0, (num_available_ips - 1)):
-            rv = network.deallocate_ip(addresses[i])
+            rv = self.service.deallocate_fixed_ip(addresses[i])
             self.dnsmasq.release_ip(macs[i], addresses[i], hostname, net.bridge_name)
 
 def is_in_project(address, project_id):
-    return address in network.get_project_network(project_id).list_addresses()
+    return address in model.get_project_network(project_id).list_addresses()
 
 def _get_project_addresses(project_id):
     project_addresses = []
-    for addr in network.get_project_network(project_id).list_addresses():
+    for addr in model.get_project_network(project_id).list_addresses():
         project_addresses.append(addr)
     return project_addresses
 

=== modified file 'nova/virt/libvirt_conn.py'
--- nova/virt/libvirt_conn.py	2010-08-04 06:17:35 +0000
+++ nova/virt/libvirt_conn.py	2010-08-06 21:33:45 +0000
@@ -46,6 +46,9 @@
 flags.DEFINE_string('libvirt_xml_template',
                     utils.abspath('compute/libvirt.xml.template'),
                     'Libvirt XML Template')
+flags.DEFINE_string('injected_network_template',
+                    utils.abspath('compute/interfaces.template'),
+                    'Template file for injected network')
 
 flags.DEFINE_string('libvirt_type',
                     'kvm',
@@ -205,14 +208,14 @@
 
         key = data['key_data']
         net = None
-        if FLAGS.simple_network:
-            with open(FLAGS.simple_network_template) as f:
+        if data.get('inject_network', False):
+            with open(FLAGS.injected_network_template) as f:
                 net = f.read() % {'address': data['private_dns_name'],
-                                  'network': FLAGS.simple_network_network,
-                                  'netmask': FLAGS.simple_network_netmask,
-                                  'gateway': FLAGS.simple_network_gateway,
-                                  'broadcast': FLAGS.simple_network_broadcast,
-                                  'dns': FLAGS.simple_network_dns}
+                                  'network': data['network_network'],
+                                  'netmask': data['network_netmask'],
+                                  'gateway': data['network_gateway'],
+                                  'broadcast': data['network_broadcast'],
+                                  'dns': data['network_dns']}
         if key or net:
             logging.info('Injecting data into image %s', data['image_id'])
             yield disk.inject_data(basepath('disk-raw'), key, net, execute=execute)