🔎
Hub-and-Spoke · Multi-AZ · BGP

🌐 Networking — VPC, Hub-Spoke, VPN, Global LB

Kiến trúc mạng tương đương AWS Transit Gateway / Azure Virtual WAN / GCP Network Connectivity Center. Hỗ trợ Hub-Spoke, VPN BGP, multi-NIC, Private Link, Global Load Balancer, DDoS Protection.

Thành phần chính

VPC & Subnet

network-service :8084 — VPC isolated, subnet pools, route tables, security groups, IPAM.

Hub-and-Spoke

TransitHub + TransitHubAttachment + VPCPeering. Thay thế chuỗi peering ngang phức tạp.

VPN Gateway + BGP

vpn-gateway-service :8095 — IPsec/WireGuard, BGP (local_asn, peer_asn, peer_ip).

NAT Gateway

nat-gateway-service :8117 — outbound từ subnet private, port allocation per tenant.

Load Balancer L4/L7

load-balancer-service :8087 — health-checks, sticky session, target groups, SSL termination.

Global LB

global-lb-service :8118 — multi-region, geo + latency routing, weighted (60/40, 70/30…).

DNS

dns-service :8088 — public/private zones, A/AAAA/CNAME/MX/TXT, TTL configurable.

CDN

cdn-service :8099 — origin pull, cache rules, signed URLs, custom domain + TLS.

Private Link

private-link-service :8107 — Private Endpoint truy cập dịch vụ nội bộ qua mạng riêng.

Firewall + WAF + DDoS

firewall-service, waf-service, ddos-service — stateful L3/L4, OWASP L7, DDoS detection & mitigation.

VM Multi-NIC

Một VM gắn nhiều NIC ở các VPC khác nhau, end-to-end với security group riêng.

Bandwidth Policy

BandwidthPolicy{limit_mbps, burst_mbps, direction, scope} — scale 1Gbps→10Gbps không downtime.

Sơ đồ Hub-and-Spoke

                ┌─────────────┐
                │ Transit Hub │  ← BGP, Route Tables tập trung
                └──┬───┬───┬──┘
        ┌──────────┘   │   └──────────┐
        ▼              ▼              ▼
   ┌─────────┐    ┌─────────┐   ┌─────────┐
   │ VPC App │    │ VPC DB  │   │ VPC Mgmt│
   └─────────┘    └─────────┘   └─────────┘
        │              │              │
        └──── Bandwidth Policy ───────┘
                       │
                  ┌────▼────┐
                  │  VPN GW │  ← Site-to-Site BGP
                  └─────────┘
                       │
                  On-prem / 3rd party

OpenStack Network Stack

Overlay / Underlay

Underlay: leaf-spine ECMP. Overlay: VXLAN per-tenant. Chi tiết tại OPENSTACK-NETWORK-OVERLAY-UNDERLAY.md.

SDN Control Plane

Neutron + OVN, distributed virtual router (DVR), port security, security group.

Benchmark & Latency

# Đo VPC peering latency / throughput
bash scripts/network-peering-benchmark.sh \
  --src-vpc app-prod --dst-vpc db-prod --duration 60s