Cloud on TIEN Part I: OpenStack Cloud Deployment. Vasinee Siripoonya Electronic Government Agency of Thailand Kasidit Chanchio Thammasat

Transcription

1 Cloud on TIEN Part I: OpenStack Cloud Deployment Vasinee Siripoonya Electronic Government Agency of Thailand Kasidit Chanchio Thammasat

2 Outline Part I: OpenStack Overview How OpenStack components work Keystone Nova Glance Part II: Demo Use Cases

3 Cloud Distributed Systems that provide Services to users on- demand Focus on Infrastructure As A Service Cloud offers Virtualized Compute Virtualized Storage Virtualized Network

4 Public and Private Cloud Public Cloud: Available over internet Pay- per- use basis Resources are shared by users from anywhere Private Cloud: Available over organizaoon s IT infrastructure Pay by organizaoon Resources are shared by users in same organizaoon

5 Cloud Layers ApplicaOons Cloud OS VirtualizaOon/OS Hardware/Storage/Network

6 Which Cloud OS should I use? CompaObility with your hypervisor/os Cloudstack comes from Xensource OpenStack uses KVM by default. It has good support and documentaoon on Ubuntu vcloud is definitely for vmware Maintainability Provide means to fix the system when things go wrong Etc.

7 OpenStack is an open and scalable cloud compuong pla[orm for building private and public clouds. Invented by Rackspace and NASA. The OpenStack project is provided under the Apache 2.0 license.

8 Par*cipa*ng Companies

9 Main Components OpenStack Compute (Nova): Provision and manage large networks of virtual machines OpenStack Object Storage (Swi;): Create petabytes of secure, reliable storage using standard hardware OpenStack Image Service (Glance): Catalog and manage massive libraries of server images

10 Main Components OpenStack Dashboard (Horizon) : a modular web- based user interface for all the OpenStack services. OpenStack Iden*ty Service (Keystone) : authenocaoon and authorizaoon for all the OpenStack services.

11 OpenStack Releases Nova AusOn Swie Oct 21, 2010 Nova Swie Bexar Glance Feb 3, 2011 Nova Swie Cactus Glance Apr 15, 2011 Nova Swie Diablo Glance Sep 22, 2011 Nova Swie Glance Keystone Folsom Horizon Sep 27, 2012 Quantum Essex Apr 5, 2012 Nova Swie Glance Keystone Horizon

12

13 SushiCloud s System Architecture

14 OpenStack isn t everything Strategic Planning Consultants, Business Process AutomaOon OperaOons Engineers, Technicians, IT professionals, Network Experts Systems Servers, Firewall, Load- balancer, OperaOng Systems OpenStack Management Tools, Storage, Virtualiza*on FaciliOes Data Center, Network, Storage

15 Hardening OpenStack Environments Restrict network and data access to least priviledge Enable security features of underlying soeware Configure security features of underlying OS Harden the Hypervisorfor Use PKI for SSL Implement database security

16 How OpenStack Components work Components in our focuses: Keystone Nova Glance Networking Model Not currently cover Swie

17

18 Keystone A central authenocaoon and authorizaoon User represents someone or something that can gain access through Keystone. Users come with credenoals that can be checked like passwords or API keys. Tenant represents what is called the project in Nova. Users are bound to a tenant by assigning them a role on that tenant. Role represents a number of privileges or rights a user has or acoons they are allowed to perform. To access a service, we have to know its endpoint. So there are endpoint templates in Keystone that provide informaoon about all exisong endpoints of all exisong services.

19 Keystone To access some service, users provide their credenoals to Keystone and receive a token. If the user, for example, wants to spawn a new VM instance in Nova, one can find an URL to Nova in the list of endpoints provided by Keystone and send an appropriate request. Aeer that, Nova verifies the validity of the token in Keystone and should create an instance from some image by the provided image ID and plug it into some network. All the way this token travels between services so that they can ask Keystone or each other for addioonal informaoon or some acoons.

20 Keystone Control Flow User Keystone Nova Glance credenoals token token + request for VM verify token token + request for image verify token image successful response

21

22 Nova Nova handles instances provisioning on compute resources. Nova- api inioates most acovioes Nova components communicate via queue and nova database Nova- scheduler decides where to launch instances Nova- compute launches instances Nova- compute periodically report host and network capabilioes to Nova- scheduler

23 Nova Control Flow Request Nova- api Run instance Message Q Host provision Nova- scheduler Make decision: - Filter hosts - Weight hosts Nova- compute Host provision Host/Network capabilioes Launch instance Update Capability informaoon

24

25 Glance Glance manage all kinds of images to instanoate VM instances Glance- api takes image retrieval requests from nova- compute and pass them to glance- registry OpenStack create a new copy of the image on a host where the VM instance runs Glance- registry check image metadata from database Glance stores Image data in its image store (S3, HTTP, Local, Swie)

26 Glance Control Flow User Image retrieval Glance- api retrieve image Glance- registry Check image s Metadata from Glance DB Image store Upload/delete Upload/delete image Update image s Metadata on Glance DB

27 How OpenStack Components work Components in our focuses: Keystone Nova Glance Networking Model Not currently cover Swie

28 OpenStack Network Model Flat Network: A network administrator specifies a subnet from which all the virtual machines pulls IP addresses from a pool of available fixed addresses. Flat DHCP Network: The server that runs nova- network is a gateway to the compute nodes running virtual machines. Instances receive their fixed IPs by doing a dhcpdiscover. Like Flat Mode, all instances are akached to a single bridge on the compute node. VLAN Network: Compute creates a VLAN and bridge for each project. The project gets a range of private IPs that are only accessible from inside the VLAN. In this mode, each project gets its own VLAN, Linux networking bridge, and subnet.

29 IP address Fixed IPs are IP addresses that are assigned to an instance on creaoon and stay the same unol the instance is explicitly terminated. FloaOng IPs are addresses that can be dynamically associated with an instance. A floaong IP address can be disassociated and associated with another instance at any Ome.

30

31 Flat network, all- in- one server installaoon for development setup all- in- one nova- network nova- scheduler nova- api nova- compute VM VM VM eth br100:

32 Flat network, mulople compute nodes with a single network adapter for smoke tesong or a proof of concept controller nova- network nova- scheduler nova- api compute nova- compute VM VM VM compute nova- compute VM VM VM eth eth eth br100: br100 br100

33 Flat network, mulople compute nodes with mulople network adapters for separate admin and data traffic eth1 eth1 eth1 controller compute compute nova- network nova- scheduler nova- api nova- compute VM VM VM nova- compute VM VM VM eth0 br100: eth0 br100 eth0 br100

34 Flat DHCP network, mulople interfaces, mulople servers for High Availability Networking controller eth0 eth0 eth0 nova- compute nova- network compute nova- compute nova- network public switch compute nova- compute nova- network VM VM VM VM VM VM VM VM VM eth eth eth br100: br100: br100: private switch

35 eth0 controller nova- network nova- scheduler nova- api nova- compute nova- volume keystone dashboard VM VM VM eth1 OpenStack Deployment on SushiCloud Thammasat University eth2 br compute nova- compute VM VM VM eth0 eth1 br100 image glance- api glance- registry memcache eth

36 OpenStack InstallaOon InstrucOons Scripted installaoon for proof- of- concept, learning, or development: DevStack (hkp://devstack.org/) Manual installaoon on Ubuntu, Debian, CentOS, Fedora or Red Hat Enterprise Linux 6 for deployment / producoon: OpenStack Manuals (hkp://docs.openstack.org/) Other InstallaOon ISO DistribuOon InstallaOon: StackOps Distro - Community EdiOon / Enterprise EdiOon ( hkp:// Puppet Deployment Tool (dodai- deploy): OpenStack Manuals ( hkp://docs.openstack.org/)

37 Part II: Demo