CloudCIX Bootcamp. The essential IaaS getting started guide.

Transcription

1 The essential IaaS getting started guide. Revision Date: 17 th August 2015

2 Contents Acronyms... 2 Table of Figures Welcome Architecture Getting Started Login to CloudCIX Membership App App Store The Compute App CloudCIX Compute Architecture OpenStack Primer Compute App Instance Launch Prerequisites External and Internal Networks Routers Security Groups Key Pair Creation PuTTYgen, Putty & RDP Launching an Instance Accessing an Instance Via the Console via the CloudCIX App Via a Linux Machine Via Windows using PuTTY Managing Instances Volume Storage Introduction Creating Volumes Attaching a Volume to an Instance Launching an Instance from a Volume Images (OpenStack Glance Services) Load Balancer as a Service (LBaaS) Creating a Load Balancer Cork Internet exchange Page 1 Version Date: 17 th August 2015

3 Load Balancing Monitor Firewall as a Service (FWaaS) Create Firewall Rules Create Firewall Policies Add Firewall Rules to Policies Create Firewall and associate with Policies Add Firewall to a Router The DNS App Getting Support Ticketing Web Chat Acronyms API CIX DNS IaaS NOC REST SaaS UI VPS Application Program Interface Cork Internet exchange Domain Name System Infrastructure as a Service Network Operations Centre Representational State Transfer Software as a Service User Interface Virtual Private Server Cork Internet exchange Page 2 Version Date: 17 th August 2015

4 Table of Figures Figure 1 CloudCIX Layers... 5 Figure 2 CloudCIX Architecture... 5 Figure 3 CloudCIX Login... 6 Figure 4 CloudCIX Membership App Screenshot... 7 Figure 5 Switch to the App Store... 8 Figure 6 Install the Compute App... 8 Figure 7 CloudCIX Compute Architecture... 9 Figure 8 OpenStack Projects Figure 9 CloudCIX Compute App Dashboard Figure 10 Create External Network Figure 11 Create Network Details Figure 12 Create Router Figure 13 Adding an interface to a router Figure 14 Verify Router Connection Figure 15 Adding Rules to Security Groups Figure 16 Creating a Key Pair Figure 17 Downloading a Key Pair Figure 18 Launch Instance Figure 19 Instance Details Figure 20 Add Networking and Launch Figure 21 Assign a Floating IP Figure 22 Verify Floating IP Figure 23 PuTTY Key Generator Figure 24 PuTTY Figure 25 Installing Keys in Putty Figure 26 Create a PuTTY Saved Session Figure 27 Create Snapshot Figure 28 Manage Snapshot Image Figure 29 Create Volume Figure 30 Attach Volumes to an Instance Figure 31 Launch an Instance from a Volume Figure 32 Load Balancer as a Service Figure 33 Load Balancer Add VIP Figure 34 Add Monitor Figure 35 Firewall Policy Add Figure 36 Add Rules to a Policy Figure 37 Create Firewall Figure 38 Add a Firewall to a Router Figure 39 CloudCIX DNS App Screenshot Figure 40 CloudCIX Helpdesk App Cork Internet exchange Page 3 Version Date: 17 th August 2015

5 1 Welcome Welcome to the CloudCIX IaaS Bootcamp. This course covers the basic skills necessary to use CloudCIX Cloud Computing effectively. CloudCIX is the Cloud Computing platform of Cork Internet exchange (CIX). CloudCIX has three prime capabilities. 1. Manages your billing and support relationship with CIX. 2. Gives you access to the Software as a Service (SaaS) services, documentation and Apps. 3. Gives you access to the Infrastructure as a service (IaaS) IaaS Cloud Computing capabilities of CloudCIX via the Compute App. This training bootcamp gives an overview of the entire CloudCIX platform but focuses on the IaaS aspects of that platform. Cork Internet exchange Page 4 Version Date: 17 th August 2015

6 2 Architecture CloudCIX is a pubic cloud offering both SaaS and IaaS services. The following diagram represents the structure of CloudCIX. The diagram is best understood as layers, starting at the bottom and working up. Each layer depends on the layers beneath. Layer Name Layer Function 5) Custom Applications Users and Third Parties can develop their own front end Applications or integrations by consuming the REST API. 4) Web Apps Browser based Web Apps give users the ability to interact directly with CloudCIX. 3) REST APIs The Applications expose REST web service interfaces. Powerful solutions can be developed by mixing and matching the web services from different applications. 2) Application Layer The Applications come next in the hierarchy. Applications are divided into two groups, IaaS and SaaS. IaaS Applications are based on the OpenStack open source cloud computing. 1) Membership Layer Membership in the foundation of CloudCIX and it manages security and access to resources. Figure 1 CloudCIX Layers The diagram below shows how these layers are connected. Figure 2 CloudCIX Architecture Cork Internet exchange Page 5 Version Date: 17 th August 2015

7 3 Getting Started 3.1 Login to CloudCIX Login to CloudCIX from the login menu item on or directly from the webpage Figure 3 CloudCIX Login If your organisation is already a customer of CIX then you have a CloudCIX Membership. Contact the CIX network operations centre (NOC) if you wish to check if your Organisation is already a Member of CloudCIX. Cork Internet exchange Page 6 Version Date: 17 th August 2015

8 3.2 Membership App Immediately after successfully logging into CloudCIX, the Membership App will load. Membership is the identity management system of CloudCIX. Having an integrated identity Management system for all of CloudCIX allows for single sign for all CloudCIX IaaS and SaaS services. Every Membership has at least one Administrator user account. The Administrator creates, expires and sets privileges for other User accounts. The Administrator account never expires. Figure 4 CloudCIX Membership App Screenshot Membership is an extension of the OpenStack Keystone identity management system. Cork Internet exchange Page 7 Version Date: 17 th August 2015

9 4 App Store Immediately you login to CloudCIX, the Membership App will load. Click on the All apps menu item to change to a different App. If an App you need is not installed then load the App Store to install it. Installing Apps is an Administrator only capability. All users in a Membership have the same Apps available to them. Figure 5 Switch to the App Store Once the App Store is loaded the screen will look like the picture below. Figure 6 Install the Compute App If the Compute App is available in the App Store then click install. If the Compute App is not available in the App Store then you must contact CIX to get it enabled for your Membership. For security and credit control reasons, the Compute App must be enabled by CIX for each Member before use. Cork Internet exchange Page 8 Version Date: 17 th August 2015

10 5 The Compute App The CloudCIX IaaS functionality is based on the open source cloud computing platform, OpenStack. Block and Object Storage are based on the open sthe CloudCIX Compute App provides a user interface to this functionality. 5.1 CloudCIX Compute Architecture Figure 7 CloudCIX Compute Architecture Cork Internet exchange Page 9 Version Date: 17 th August 2015

11 5.2 OpenStack Primer CloudCIX is based on OpenStack. OpenStack itself consists of a number of Services, each of which exposed a RESTful API. In order to launch a compute instance these OpenStack services must work together in the background. The Compute App will orchestrate these services for you but it is a good idea to understand each service and what its function is. The Compute App itself is based on the Horizon dashboard project within OpenStack. The following table outlines the OpenStack projects used in CloudCIX and the function of each. Project Name Horizon Nova Glance Cinder Swift Neutron Figure 8 OpenStack Projects Function User Interface Compute Server Image Service Volume Storage Service Object Storage Service Networking Service 5.3 Compute App After logging into the Compute App you will see a screen like this Figure 9 CloudCIX Compute App Dashboard You are now ready to manage your Cloud computing infrastructure. Cork Internet exchange Page 10 Version Date: 17 th August 2015

12 5.4 Instance Launch Prerequisites The following list is useful to define what needs to be in place to launch a compute instance (a.k.a. virtual private server VPS). 1. Network( external network is predefined, User needs to create their own internal network) 2. Connectivity between internal and external Network (Router) 3. Security Groups to allow communication to instances 4. Key pair to Access instances 5. PuTTYgen tool to convert key-pairs to supported format 6. PuTTY tools to access Linux based VPS or RDP tools to access Windows Server We will cover each of these six prerequisites one at a time External and Internal Networks The External network is predefined for each Project. External networks can be viewed under the Transaction > Network > Topology menu but they cannot be modified. The User needs to create their own internal network. Internal networks can be seen under both the Transaction > Network > Topology and Transaction > Network > Networks menu items. Figure 10 Create External Network Cork Internet exchange Page 11 Version Date: 17 th August 2015

13 Complete the details in the popup window to complete the creation of the Internal Network Figure 11 Create Network Details The newly created internal network will now be visible under Transaction > Network > Topology. Cork Internet exchange Page 12 Version Date: 17 th August 2015

14 5.4.2 Routers Routers connect Internal and External Networks. Routers can be created from the menu item Transaction > Network > Routers > Create Router. Figure 12 Create Router Cork Internet exchange Page 13 Version Date: 17 th August 2015

15 After a router is created it must be connected to the internal network by creating an interface on the router and connecting that interface to the internal network. Click Transaction > Network > Routers. Select your Router. Click on Interfaces tab. Click Add Interface. Select Subnet as Internal network. Adding an IP address is optional. If not added one will automatically be selected from internal subnet. Figure 13 Adding an interface to a router. Cork Internet exchange Page 14 Version Date: 17 th August 2015

16 Verify connectivity by navigating to Network > Topology and ensure both networks are connected via the router. Figure 14 Verify Router Connection Cork Internet exchange Page 15 Version Date: 17 th August 2015

17 5.4.3 Security Groups Overview:- By default Instances not allowed any communication with other instances Communications are allowed by creating security rules in security groups New security groups can be created with new rules or new rules can be added to default security group Adding rules to default security groups:- Example: Adding SSH rules to security group Navigate to Transaction >> Compute >> Access and Permissions Under Security Group tab, default rule should be listed Click Manage Rules in front of default rule Click Add Rule Under Rule select Custom TCP Rule Under Direction select Ingress Under Open Port Select Port Under Port enter 22 Under Remote select CIDR Under CIDR enter /0 to allow ssh from all hosts Click ADD Cork Internet exchange Page 16 Version Date: 17 th August 2015

18 Figure 15 Adding Rules to Security Groups Cork Internet exchange Page 17 Version Date: 17 th August 2015

19 5.4.4 Key Pair Creation Passwords are disabled by default on Openstack images and instances needs to be accessed using private key pairs. Key pairs needs to be created and downloaded before launching an instance that will be used to access instances later on. Instances will be launched with the key pair created in this step Creating a Key Pair Figure 16 Creating a Key Pair Navigate to Transaction > Compute > Access and Permissions Select the second tab Key Pairs Click Create Key Pair and a popup window appears. Name the key pair. Click Create Key Pair button on the popup window. Download and save the.pem file to a safe location. Cork Internet exchange Page 18 Version Date: 17 th August 2015

20 Figure 17 Downloading a Key Pair PuTTYgen, Putty & RDP An Instance can be accessed from Windows machine using Putty. The downloaded key pair needs to be converted to format supported by putty. The key which downloads as.pem needs to be converted to.ppk format. Putty and Puttygen can be downloaded from Cork Internet exchange Page 19 Version Date: 17 th August 2015

21 5.5 Launching an Instance With all the prerequisites in place, we are now ready to launch a compute instance. Figure 18 Launch Instance In the Details tab under Availability Zone select Nova Under Instance Name specify a name for your instance Under Flavor select m1.small Under Instance count enter 1 Under Instance Boot Source select Boot from image Under Image Name select Ubuntu Trusty(2.2 GB) Cork Internet exchange Page 20 Version Date: 17 th August 2015

22 Figure 19 Instance Details Cork Internet exchange Page 21 Version Date: 17 th August 2015

23 Navigate to the second tab Access & Security Under Key Pair select the key pair you created earlier Under Security Groups make sure the checkbox in front of default security group is checked Navigate to the third tab Networking From Available networks drag the internal network you created to Selected networks and click Launch Figure 20 Add Networking and Launch Cork Internet exchange Page 22 Version Date: 17 th August 2015

24 Assign a floating IP to the Instance: The newly created instance will show up under Transaction>>Instances A floating IP needs to be assigned to make it accessible from public network Identity your instance and click the drop down arrow with Instance Details on the right end of the listing Click Associate Floating IP On the next screen Manage Floating IP Associations Click on the + sign Figure 21 Assign a Floating IP On the next screen under Pool select your external network ext-net and click Allocate IP. A new public IP will be allocated. Under Port to be associated select your instance. Verify the floating IP assignment by navigating to the instance listing under Transaction>>Compute>>Instances Figure 22 Verify Floating IP Cork Internet exchange Page 23 Version Date: 17 th August 2015

25 5.6 Accessing an Instance Via the Console via the CloudCIX App. Navigate to Transaction >> Compute >> Instances Click on your instance Name>> Click on the tab Console Via a Linux Machine Copy the downloaded key pair to your Linux machine using WinScp tool. Note down the floating IP of your instance Use the SSH command to make a secure connection to the instance. Insert your key pair with SSH command Cork Internet exchange Page 24 Version Date: 17 th August 2015

26 5.6.3 Via Windows using PuTTY The key pair that was created before is in.pem format. It needs to be converted to.ppk format to be used with Putty. Run the Puttygen tool we downloaded before and click on Load Browse and select your keypair file keypair.pem>>click Save Private Key and save it at a safe location. Figure 23 PuTTY Key Generator Launch the Putty tool that was downloaded before. In Host Name (or IP address) add the Floating IP address from your instance: Cork Internet exchange Page 25 Version Date: 17 th August 2015

27 Figure 24 PuTTY Cork Internet exchange Page 26 Version Date: 17 th August 2015

28 Under Category: select Connection -> SSH -> Auth. Click Browse and locate your.ppk file that was saved before. Figure 25 Installing Keys in Putty Cork Internet exchange Page 27 Version Date: 17 th August 2015

29 Go back to Session at the top of the Category column on the left. In Saved Sessions input the Instance ID, or anything you'd like to name your instance, and click Save: Figure 26 Create a PuTTY Saved Session You can now Open the session by highlighting your instance under Saved Sessions and clicking Open: NOTE: The default username for Ubuntu version and after is "ubuntu". You are now connected to your CloudCIX Instance! Cork Internet exchange Page 28 Version Date: 17 th August 2015

30 5.7 Managing Instances Openstack instance disks are destroyed on terminating an instance. Snapshots are created to preserve the disk state of an instance. Navigate back to the list of instances >> click the dropdown arrow in front of your instance details>>click Create Snapshot. Figure 27 Create Snapshot Figure 28 Manage Snapshot Image Cork Internet exchange Page 29 Version Date: 17 th August 2015

31 5.8 Volume Storage Introduction Volume Storage (also known as Block Storage) provides users with access to persistent storage. By default CloudCIX creates VMs with ephemeral storage. The ephemeral disks associated with a VM disappear when the VM is terminated Creating Volumes Navigate to Transaction > Compute > Volumes Click Create Volume button on the top right. On the Create Volume screen, enter the Volume Name and Description to identify the volume. In Volume source choose empty to create a Non-Partitioned volume or Image to create a bootable volume. Choose Ubuntu Trusty(2.2GB as image source. Under Type select rbd but can be any available type. Choose a size of the storage you require. Under Availability Zone select Nova Click Create Volume Figure 29 Create Volume Cork Internet exchange Page 30 Version Date: 17 th August 2015

32 5.8.3 Attaching a Volume to an Instance Navigate to Transaction>>Compute>>Volumes Identify your volume and click the drop down error in front of Edit Volume Click on Manage Attachments Figure 30 Attach Volumes to an Instance Cork Internet exchange Page 31 Version Date: 17 th August 2015

33 5.8.4 Launching an Instance from a Volume An instance can be launched with a bootable volume. This provides a persistence local storage to instances and hard drive does not destroy until specified explicitly To launch an instance from volume, navigate to volume lists and click drop down arrow in front of Edit volume corresponding to your volume. Click Launch as Instance Figure 31 Launch an Instance from a Volume Specify an instance name, flavor, count of instance. Select Instance Boot Source as Boot from volume Under Volume select your volume Do not check Delete on terminate Select default security group and key pair from next tab Access and Security Select internal network from the Networking tab Click Launch Cork Internet exchange Page 32 Version Date: 17 th August 2015

34 5.9 Images (OpenStack Glance Services) Public images are shared with all CloudCIX Members and are used to launch instances. Snapshot of instances are stored in the list of images and an instance can also be launched from a snapshot image. CloudCix offers a list of different base OS images and custom images on demand. Cork Internet exchange Page 33 Version Date: 17 th August 2015

35 5.10 Load Balancer as a Service (LBaaS) Load balancer helps to manage traffic across VMs Load balancer helps to create multiple VMs with same role and manage workload amongst them Creating a Load Balancer Navigate to Transaction >> Network >>Load Balancers Under Pools click on Add Pool On the Add Pool Screen, specify a name and description for the pool Under provider leave haproxy(default) as selected Under Subnet select your internal network Under protocol select HTTP for web requests Under Load Balancing Method select Round_Robin or any other method as required Leave Admin State as UP and click Add Figure 32 Load Balancer as a Service Cork Internet exchange Page 34 Version Date: 17 th August 2015

36 Add a Virtual IP to the Pool Click on the drop down arrow in front of Edit Pool corresponding to your pool and select Add VIP Figure 33 Load Balancer Add VIP On the Add VIP screen, specify a name and description for VIP Under VIP Subnet, select your internal network Leave Specify a free IP address from the selected subnet as blank Under Protocol Port select port 80 for web services Under Protocol select HTTP Under Session Persistence select No Session Persisitence Under Connection Limit select -1 for unlimited connection Cork Internet exchange Page 35 Version Date: 17 th August 2015

37 Load Balancing Monitor Monitors check the health and availability of the VMs and automatically notify a load balancer not to send requests to the instance that is down. Navigate to Transaction>>Network>>Load Balancers >> Monitors tab Click Add Monitor Under Type select PING and Under Delay specify minimum time in second between regular check of a member Under Timeout specify a time in second for monitor to wait for reply Under Max Retries enter a number for retries before changing the status of member to inactive Click Add Figure 34 Add Monitor Cork Internet exchange Page 36 Version Date: 17 th August 2015

38 5.11 Firewall as a Service (FWaaS) Firewall as a Service is used to regulate traffic to the instances. Different rules can be added to a firewall policy which in turn can be associated with a firewall. The firewall is then added to a Router to regulate network traffic. These are the steps required to setup a Firewall. 1. Create Firewall Rules 2. Create Firewall Policies 3. Add Firewall rules to the Policies 4. Create Firewall and associate to policies 5. Add Firewall to a Router Cork Internet exchange Page 37 Version Date: 17 th August 2015

39 Create Firewall Rules Navigate to Transaction >> Network >> Firewall Click on the last tab Firewall Rules and click Add Rule Under Add Rule window specify a name and description for the rule Select Protocol as ICMP for ping Under action select Deny or Allow as per the requirement Click Add Cork Internet exchange Page 38 Version Date: 17 th August 2015

40 Create Firewall Policies Figure 35 Firewall Policy Add Click on the second tab under Firewalls Firewall Policies and click Add Policy Specify a name and description. Cork Internet exchange Page 39 Version Date: 17 th August 2015

41 Add Firewall Rules to Policies Now click on the tab Rules Select your rule and click Add Figure 36 Add Rules to a Policy Cork Internet exchange Page 40 Version Date: 17 th August 2015

42 Create Firewall and associate with Policies Click on the first tab Firewall and click Create Firewalls On the next screen under Add Firewall specify a name and description for the firewall Select your policy from the drop down Figure 37 Create Firewall Cork Internet exchange Page 41 Version Date: 17 th August 2015

43 Add Firewall to a Router Click on the second tab Routers Drag your router from Available Routers to Selected Routers Figure 38 Add a Firewall to a Router Cork Internet exchange Page 42 Version Date: 17 th August 2015

44 6 The DNS App The CloudCIX DNS functionality is based on the Rage 4 DNS service. This service uses a distributed anycast network to deliver low latency DNS services globally. Figure 39 CloudCIX DNS App Screenshot Cork Internet exchange Page 43 Version Date: 17 th August 2015

45 7 Getting Support CIX maintain a 24x7 network operations centre (NOC) to monitor our systems and to support our customers. All available support options can be seen by visiting 1. The NOC operates a ticketing system. Every customer support request becomes a ticket. 2. There is an online web-chat support facility. Use this to get immediate feedback on questions. 3. You can communicate directly with the NOC via phone or The twitter will update you on service affecting issues with CloudCIX. 7.1 Ticketing The CloudCIX Helpdesk App enables you to create and manage support tickets. Figure 40 CloudCIX Helpdesk App 7.2 Web Chat Cork Internet exchange Page 44 Version Date: 17 th August 2015