Juju models networks using spaces, which can be mapped to one or more subnets of the chosen backing cloud. When a space's subnets span multiple availability zones Juju will automatically distribute application units across subnets and zones, thereby providing a degree of high-availability.
From a security standpoint, with spaces, the Juju environment network topology can be organised in a way such that applications possess only the network connectivity they require.
Here are a few properties to keep in mind:
- Any given subnet can be part of one and only one space.
- All subnets within a space are considered "equal" in terms of routing.
Note: Network spaces are currently only supported by the MAAS and EC2 providers.
Consider a model divided into three segments with distinct security requirements:
- The "dmz" space for publicly-accessible applications (e.g. HAProxy) providing access to the CMS application behind it.
- The "cms" space for content-management applications accessible via the "dmz" space only.
- The "db" space for backend database applications, which should be accessible only by the applications.
HAProxy is deployed inside the "dmz" space, it is accessible from the internet and proxies HTTP requests to one or more Joomla units in the "cms" space. The backend MySQL for Joomla is running in the "db" space. All subnets within the "cms" and "db" spaces provide no access from outside the environment for security reasons.
Note: Future development will implement isolation among spaces via firewall and/or access control rules. This measns that only network traffic required for the applications to function will be allowed between spaces.
Spaces are created with the
add-space command. The following command maps a
db-space with subnet 192.168.123.0/24:
juju add-space db-space 192.168.123.0/24
To see which spaces have been added, along with any subnets belonging to those
spaces, use the
juju spaces command. Its output will look similar to the
Space Subnets db-space 192.168.123.0/24 public undefined 192.168.122.0/24
To map an existing subnet to a space use the
add-subnet command. Here we map
subnet 192.168.124.0/24 to space 'db-space':
juju add-subnet 192.168.124.0/24 db-space
juju subnets command will list all subnets known to Juju with output
similar to the following:
subnets: 192.168.122.0/24: type: ipv4 provider-id: "5" status: in-use space: undefined zones: - default 192.168.123.0/24: type: ipv4 provider-id: "6" status: in-use space: undefined zones: - default
MAAS has a native knowledge of spaces. Within MAAS, spaces can be created,
configured, and destroyed. This allows Juju to leverage MAAS spaces without the
need to add/remove spaces and subnets. However, this also means that Juju needs
to "pull" such information from MAAS. This is done by default upon
controller-creation. The command
juju reload-spaces is used to refresh Juju's
knowledge of MAAS spaces and works on a per-model basis.
juju reload-spaces command does not currently pull in all
information. This is being worked upon. See LP #1747998.
Juju creates bridges for containers only when Juju knows the spaces an application may require, and the container's bridge for that application will only connect to the required network interfaces.
Once all desired spaces have been added and/or configured they can be called upon using either a constraint or a binding:
A space constraint, like any other constraint, operates at the machine level. It requests that certain network connections be made available to the Juju machine. When a constraint is used, all application endpoints get associated with the space.
A binding is a space-specific, software level operation and is a more fine-grained request. It associates an application endpoint with a subnet.