Welcome and thank you for considering enstratus as your cloud management platform.

Transcription

1 1

2 1.1 Welcome Welcome and thank you for considering enstratus as your cloud management platform. Please read this guide in its entirety before attempting to install enstratus. It contains very useful information for preparing to install the enstratus cloud management software. 1.2 Installation Procedure Installing the enstratus cloud management software on-premise typically proceeds through the following phases, building in more complexity. Each step in this process is an abolute prerequisite for the subsequent steps. An estimated time, in hours, for each step is provided in [ ]. 1. Unit Tests (if possible/applicable) 2. Installation [1-3] 3. Configuration [4] (a) Connecting the Cloud [0.5] i. Cloud auto-discovery [0.5] ii. Integration Testing [1.0] i. Basic provisioning [0.25] ii. Storage Testing [0.25] iii. Users [0.25] iv. Imaging [0.25] (b) Installing the enstratus Agent [1] 4. Configuration Management [1] (a) enstratus [0.5] (b) Chef (if applicable) [0.5] (c) Puppet (if applicable) [0.5] 5. LDAP/AD Integration [2] 6. Operational Tests [6-12] (a) Basic Automation [2-4] (b) Basic Orchestration [2-4] (c) Advanced Automation [2-4] 7. Familiarization and Training [8-24] 2

3 Our goal is, at the end of this process, to provide the operations team a fully-functional and tested installation of the enstratus software. The times above are optimal estimates that should be used as guidelines only. Each installation is unique and comes with its own challenges, and enstratus engineers are ready to help make each project a success. If you choose to have an enstratus engineer visit your datacenter to help you successfully complete your installation, some measure of familiarization and training is a strong factor in making the project a success. To prepare for your engagment with enstratus and the installation of the cloud management software, we have prepared some worksheets at the end of this section that will provide enstratus engineers with the information they need to configure enstratus for your environment. 1.3 Architecture Requirements To install enstratus on 4-5 machines [ Key Management Server ] Compute: 1 Cores Memory: 1 Gb Storage: 10Gb Please install: Sun Java JDK, MySQL [ Dispatcher Server ] Compute: 2-4 Cores Memory: 4-6 Gb Storage: 20Gb Please install: Sun Java JDK, MySQL, RabbitMQ [ Monitor/Worker Server ] Compute: 2-4 Cores Memory: 6-8 Gb Storage: 20Gb Please install: Sun Java JDK, MySQL, JSVC [ Console Server ] Compute: 1-2 Cores Memory: 2-4 Gb Storage: 20Gb Please install: Sun Java JDK [ Storage Server ] Compute: 2 Cores Memory: 2-4 Gb Storage: 20Gb Note: Installing with the minimum requirements may result in a degradation of performance. 3

4 To install enstratus on 2 Machines [ Backend Server ] Compute: 4-6 Cores Memory: 6-12 Gb Storage: 30Gb Please install: Sun Java JDK, MySQL, RabbitMQ, JSVC [ Console Server ] Compute: 1-2 Cores Memory: 2-4 Gb Storage: 10Gb Please install: Sun Java JDK Note: Installing with the bare minimum requirements may result in a degradation of performance. In the case of the 2-server model, the KM, Dispatcher, Monitor, and Worker services will be installed on one machine. Networking Requirements enstratus components must have direct communications with each other. Some other networking considerations to make are: Dispatcher Service The dispatcher service listens on port Provisioned (guest) virtual machines that have the agent installed upon them must be able to reach the dispatcher service on this port. Agent The enstratus agent listens on port 2003 and can be installed on guest virtual machines. The server(s) upon which the dispatcher and workers service runs must be able to communicate to the agent on this port. To summarize: Communication from guest virtual machines to the dispatcher server on port 3302 Communication from the dispatcher service to the guest virtual machines on port 2003 Other Information Required operating system is Linux. Architecture x Preferred distribution is Ubuntu/Debian. While nothing technologically prevents a windows installation, I ll leave that as an exercise for the reader. :) The server onto which enstratus is installed can be virtual. They should not, however, be part of the pool of VMs enstratus is destined to manage. All machines must have direct, non-vpn network access to each other. 4

5 Provisioned/managed VMs must have direct, non-proxied, non-vpn access to the dispatcher and worker servers. If an enstratus engineer is performing the installation, we will require shell access with root privileges to all of the machines onto which enstratus is to be installed. enstratus engineers can provide their public SSH key to you for remote access or they can work through a VPN. We require port 22, 80, and 443 access externally to our office IP address: Requesting installations over a screenshared session such as webex is strongly discouraged. It is highly inefficient and greatly increases the possibility of error. The enstratus software installation process is most suited to a systems administrator with knowledge of how to install the prerequisites and do basic configuration. The estimated time to complete the installation phase is 3 hours. The file (object) storage server will be used for object (file) storage as is essential to do things like automation and downloading of service images and scripts to running virtual machines. enstratus engineers will also assist on-premise clients with the installation and configuration of the enstratus agent, a pre-requisite for doing automation. With this information, enstratus engineers will help you construct a private cloud endpoint in the provisioning database. 1.4 Cloud/Capability Worksheets OpenStack CloudStack Eucalyptus VCloud Director VSphere Walrus Swift LDAP AD 5

6 1.5 How to use this guide The purpose of this section is to clarify the communication channels required by the individual enstratus components. Ports listed are default and/or standard service ports and are subject to any customizations made by the installing engineers. Example Let s assume that the enstratus installation is as shown in the figure 1. The worker and dispatcher servers and their associated services can be moved as necessary to a separate network provided the communication paths between remain. This principle holds for any of the enstratus components. enstratus has a very flexible architecture. If you are an administrator of the enstratus software, you should feel free to move components and architect the most appropriate solution for your cloud environment. 6

7 1.6 enstratus Internal/External Communications Figure 1: Sample Architecture 7

8 Console Component Listens IP:Port Accepts From: Initiates To: Console $IP:80 Internet (or equivalent) AD/LDAP $IP:443 API Dispatcher Console MySQL $IP:3306 LDAP/AD Console Service API LDAP/AD Table 1: Console Communications Console-MySQL N/A Key Manager Component Listens IP:Port Accepts From: Initiates To: KM $IP:2013 Dispatcher KM-MySQL Worker Monitor KM- MySQL $IP:3306 KM Service N/A Table 2: Key Manager Communications Dispatcher Component Listens IP:Port Accepts From: Initiates To: Dispatcher $IP:3302 Internet (or equivalent) Guest VM API Monitor Worker Console Dispatcher-MySQL Rabbit MQ KM Monitor Worker Cloud API Endpoint Dispatcher- MySQL $IP:3306 Dispatcher Monitor Worker Table 3: Dispatcher Communications Guest VM $IP:2003 N/A 8

9 Monitor/Worker Component Listens IP:Port Accepts From: Initiates To: Monitor Worker N/A N/A Cloud API Dispatcher Dispatcher-MySQL Rabbit MQ Monitor Worker KM Table 4: Monitor/Worker Communications Rabbit MQ Component Listens IP:Port Accepts From: Initiates To: Dispatcher (default) $IP:5672 Dispatcher Monitor Worker N/A Table 5: Rabbit MQ Communications Cloud Files Storage. (EC2: S3, Eucalyptus:Walrus, OpenStack:Swift) enstratus can integrate with these popular cloud files (object/blob) storage solutions. To successfully leverage these technologies, the cloud files storage endpoint must be reachable by the guest VM via the enstratus agent, the dispatcher, monitor, and worker services. API Component Listens IP:Port Accepts From: Initiates To: API $IP:15000 Internet (or equivalent) Dispatcher Console-MySQL Table 6: API Communications 9

10 2 Installation Process 2.1 Install Required Software 1. Key Manager: sun-java6-jdk, MySQL (server and client, client is optional, but useful for testing.) 2. Dispatcher: sun-java6-jdk, MySQL (server and client, client is optional, but useful for testing.) 3. Worker and Scaling: sun-java6-jdk, jsvc, RabbitMQ 4. Console: sun-java6-jdk, MySQL (server and client, client is optional, but useful for testing.) Note: When installing MySQL, please set a root password, it will be required during the installation of services that depend on MySQL. During the installation enstratus will auto-generate mysql users and passwords for the database services it installs. enstratus generates good passwords. Example: K0B6KheBDtrANJOEp1LuWpCmjF If generating your own passwords is something you would like to do. Please do so after completing the installation by referencing the appropriate configuration files and at your own risk. The details of installing this software is dependent on your distribution. Please have this software installed before attempting an installation of the enstratus cloud management software. 2.2 Generate Keys Purpose The purpose of this step is to generate encryption keys and create some bootstrap MySQL information for the Dispatcher and Console services. Required Knowledge 1. enstratus License Key 2. Desired url for the console service. For example, cloud.mycorporation.com 3. IP address of the server that will run the console server. Move the keygen bundle to the server that will contain the Key Management service and extract it. Once extracted, there will be a keygen/ directory containing the following items: 10

11 1. classes 2. enstratus-utilities.jar 3. files 4. keygen.sh 5. setup Enter the keygen/ directory and, as root, execute the keygen.sh script. You will be promted for the three pieces of information listed above. The outcome of this script will be the creation of a file called install.credentials located in the setup/ directory. note and warning: This file is appended to with headers delimiting each section of the install, such as [ Dispatcher Database Credentials ] [ Dispatcher Configuration Files ] For the database-driven services of Key Manager, Dispatcher, and Console, the respective credentials section of this file are critical. If the installer crashes or is interrupted after the database installs have run and the credentials have been appended and you want to start over with the installation of that service, you must first delete the section in the install.credentials file and the databases that were created. The requirement to do this will cease as the installer is improved. 2.3 Install Key Management Service Purpose The purpose of this step is to install the Key Management Service. Required Knowledge 1. MySQL Root Password Relevant files: kminstaller.tar.gz and the setup directory from Step 2. These files should be placed onto the server where the enstratus Key Management service will be installed. Extract the kminstaller.tar.gz file. There will be km/ directory containing the following items: 1. files 2. installdb.sh 3. installkm.sh 11

12 Move the setup directory from step 2 into the km directory and, as root, execute the installkm.sh script. Follow the prompts and complete the installation of the KM service. Upon completion of this step, you will have installed the enstratus key management software component and the credentials database. The setup/install.credentials file will be appended with the username and password used by the KM service to connect to its database along with a list of the configuration files used to configure the KM service. 2.4 Install Dispatcher Service Purpose The purpose of this step is to install the enstratus Dispatcher service. Required Knowledge 1. IP address/hostname of Key Managment server 2. Credentials and location information for Rabbit MQ 3. IP addresses of dispatcher, monitor, and worker servers Relevant files: dispatcherinstaller.tar.gz and the setup directory used during the installation of the enstratus Key Management software. Extract the dispatcherinstaller.tar.gz file. There will be a dispatcher/ directory containing the following items: 1. files 2. installdb.sh 3. installdispatcher.sh Move the setup directory that was used during the installation of the key management service into the dispatcher directory and, as root, execute the installdispatcher.sh script. Follow the prompts to complete the installation of the dispatcher service. Upon completion of this step, you will have installed and configured the enstratus dispatcher service and the provisioning and analytics databases. The setup/install.credentials file will be appended with the username and password used by the dispatcher service to connect to its database along with a list of the configuration files used to configure the dispatcher service. 2.5 Install Monitor and Workers Service Purpose The purpose of this step is to install the enstratus Monitor and Workers services. 12

13 Required Knowledge 1. IP address/hostname of dispatcher and worker servers Relevant files: monitorworkerinstaller.tar.gz and the setup directory used during the installation of the enstratus Dispatcher software. Extract the monitorworkerinstaller.tar.gz file. There will be a worker/ directory containing the following items: 1. files 2. installmonitor.sh 3. installworker.sh Move the setup directory that was used during the installation of the dispatcher service and, as root, execute the installmonitor.sh and then the installworker.sh script. Follow the prompts to complete the installation of the services. Upon completion of this step, you will have installed and configured the enstratus monitor and worker service. The setup/install.credentials file will be appended with the list of the configuration files used to configure the worker service. 2.6 Install Console Service Purpose The purpose of this step is to install the enstratus Console service. Relevant file: consoleinstaller.tar.gz and the setup directory used during the installation of the enstratus Monitor and Worker services. Extract the consoleinstaller.tar.gz file. There will be a console/ directory containing the following items: 1. files 2. installdb.sh 3. installconsole.sh Move the setup directory that was used during the installation of the monitor/worker service and, as root, execute the installconsole.sh script. Follow the prompts to complete the installation of the console service. Upon completion of this step, you will have installed and configured the enstratus console service along with the console and enstratus console datbases. The setup/install.credentials file will be appended with the username and password used by the console service to connect to its database along with a list of the configuration files used to configure the console service. 13

14 2.7 Starting Services At this point, it s time to start some services and test your enstratus installation. Follow this procedure to start each service: 1. KM. /etc/init.d/enstratus-km start 2. Dispatcher. /etc/init.d/enstratus-dispatcher start 3. Console. /etc/init.d/enstratus-console start To see if the km service is running, issue the command: ps -ef grep km If the key management service is running, there should be a tomcat service running in /services/km. As a further check, there should also be a java process listening on port netstat -tnlup grep 2013 Key Management Log: The key management log is located in /services/km/tomcat/logs/- catalina.out. To see if the dispatcher service is running issue the command: ps -ef grep dispatcher If the dispatcher service is running, there should be a tomcat service running in /services/dispatcher. As a further check, there should also be a java process listening on port 3302: netstat -tnlup grep 3302 Dispatcher Log: The dispatcher log is located in /services/dispatcher/tomcat/logs/catalina.out. To verify the start of the console service, issue the command: ps -ef grep console If the console service is running, there should be a tomcat service running in /services/console. Console Log: The console log is located in /services/console/tomcat/logs/catalina.out. Once you have completed these steps, and the services are started, navigate to the url: URL/page/1/register.jsp Where CONSOLE URL is the selection made in the keygen step. The easiest way to test this is to create a hosts file entry on your local machine. 14

15 Complete the registration steps. After successfully completing the registration, you will be directed to the login page. Login using the address and password created during registration. Next, start the monitor and worker services: On the monitor/worker server, as root, issue the command: /etc/init.d/enstratus-monitor start The output of this command will be a list of individual monitor process starting up. This may take a few moments. To check if the monitor services are running, issue the command: ps -ef grep Assign A running assignment service is the best indicator of whether things are working or not. Monitor Logs: Each monitor has its own associated log in /services/monitor/log. enstratus Worker Service. The enstratus worker service is composed of two primary components, a Publisher and a Subcriber. The details of these services is beyond the scope this document. /etc/init.d/enstratus-workers start The output of this command should reference the starting of the Publisher and Subscriber processes. Worker Logs: Logs for both the Publisher and Subscriber are located in /services/worker/log. There will be other logs generated in this directory as automation and configuration processes are executed. Choose a cloud provider and enter the appropriate credentials. This will start the autodiscover process for the cloud account and you should be able to begin provisioning immediately. The autodiscovery process can take up to an hour to fully discover your infrastructure. Refer to the file called setup/install.credentials for a list of all relevant configuration files for each service, and other useful information from the installation. 15

16 2.8 Installation Minutae Purpose The purpose of this section is to give advice to fellow administrators charged with installing software to support the enstratus services. This information is provided in the hopes that it may be useful, and feedback is welcome. Java Cryptographic Extensions enstratus software requires good encryption, but cannot in all cases install it for you. Install the Java Cryptographic Extensions (JCE) for good cryptography. Reference: enstratus will only work with Java 6, please install the JCE that match that version. Sun Java 6 JDK The enstratus services depend on a Java JDK. The Sun published JDK is preferred. 1. On Ubuntu/Debian Place the following repository entry in your /etc/apt/sources.list file: deb lucid partner Replacing lucid with the appropriate distribution. Then execute: apt-get update && apt-get -y install sun-java6-jdk 2. On CentOS/Red Hat Probably the best bet here is to head to: MySQL to download and install. The version of MySQL should be >= 5.0. MySQL software should be available in most software repositories and installable by competent package management systems. 1. On Ubuntu/Debian apt-get update && apt-get -y install mysql-client,server is sufficient to pull in the MySQL packages in most cases. 2. On CentOS/Red Hat yum update && yum -y install mysql-client,server 16

17 3. On Windows On what? You will need to set and know your MySQL root password. This step should be satisified during the installation of those packages. If not, use this command to set your MySQL root password: mysqladmin -uroot password yourpasswordhere RabbitMQ The version of RabbitMQ should be the latest one you can find from: There are packages available for all major linux distributions. To configure RabbitMQ server, issue the following commands: rabbitmqctl add user qsmq enstratus This command instructs the RabbitMQ broker to create a (non-administrative) user named qsmq with (initial) password enstratus. rabbitmqctl set permissions qsmq ".*" ".*" ".*" This command instructs the RabbitMQ broker to grant the user named qsmq access with configure, write, and read permissions on all resources. Restart the rabbit MQ service with the command: /etc/init.d/rabbitmq-server restart JSVC This is the native application for launching Java applications implementing certain interfaces from the libcommons-daemon-java package as daemons. It is typically installable from package repositories. 1. On Ubuntu/Debian via the command: apt-get install jsvc 2. On Centos/Red Hat Your mileage will vary depending on your repository configuration. Ask your local system administrator for help if necessary. 17

18 2.9 Backing Up The purpose of this section is to instruct the user on how to backup the enstratus system. The details of the recommended backups may differ in your environment. This document is not meant to be a cut-and-paste guide. The enstratus cloud management system has 5 databases, at least 5 services, and typically 4 or more servers running the enstratus software. We will break down the backup approach into two main groups: Services and Databases. Services enstratus services are typically installed into the /services directory. For example: 1. Key Manager /services/km 2. Dispatcher /services/dispatcher 3. Monitor /services/monitor 4. Worker /services/worker 5. Console /services/console Remember these services may not reside on the same server. 18

19 To back up the services, do something like this: #!/bin/bash TAR=/bin/tar GZIP=/bin/gzip PGP=/usr/bin/gpg DIR=/backups/services DA=$(date +%Y%m%d-%H%M%S) SERVICES= dispatcher monitor worker km for service in $SERVICES; do if [ -d /services/$service ]; then BASE=$(basename $service) FILE=${DIR}/${BASE}-${DA}.tar.gpg.gz find ${DIR} -type f -mtime +2 xargs rm -f cd /services/${base} && $TAR -c. \ $PGP -r enstratusbackup@enstratus.com -e \ $GZIP -9 > ${FILE} chown enstratus ${FILE} chmod 700 ${FILE} fi done Databases enstratus has 5 databases. 1. Key Manager: credentials 2. Dispatcher: provisioning and analytics 3. Console: console and enstratus console Here is an example of a script that can be used to backup the MySQL database running on a server: #!/bin/bash # # Setup configuration values # HOST=$(hostname) USER=dbuser PASSWORD=abcdef12345 DA=$(date +%Y%m%d-%H%M%S) MYSQL=/usr/bin/mysql 19

20 MYSQLDUMP=/usr/bin/mysqldump GZIP=/bin/gzip PGP=/usr/bin/gpg CONFIG=/etc/mysql/my.cnf if [ $# -gt 0 ] ; then CONFIG=$1 fi BASE=$(basename ${CONFIG}.cnf) LOGFILE=/var/log/backups-${BASE}.log DATABASES=$(${MYSQL} --defaults-file=${config} -u${user} -p${password} -Bse show databases ) DIR=/backups/db echo "" >> ${LOGFILE} echo "Starting MySQL database backup for ${DA}..." >> ${LOGFILE} # # Make sure the directory exists # if [! -d ${DIR} ] ; then mkdir ${DIR} chmod 700 ${DIR} chown enstratus ${DIR} fi # # Delete all old files # find ${DIR} -type f -mtime +2 xargs rm -f # # Backup each database # for db in ${DATABASES} do sleep 10 NOW=$(date +%Y%m%d-%H%M%S) echo -n " Backing up: ${db} at ${NOW}... " >> ${LOGFILE} FILE=${DIR}/${db}-${DA}.sql.gpg.gz $MYSQLDUMP --defaults-file=${config} --single-transaction -u${user} -p${password} $db $PGP -r enstratusbackup@enstratus.com -e $GZIP -9 > ${FILE} chown enstratus ${FILE} chmod 700 ${FILE} NOW=$(date +%Y%m%d-%H%M%S) echo "Done at ${NOW}." >> ${LOGFILE} done 20

21 echo "MySQL database backup complete at ${NOW}." >> ${LOGFILE} echo "" >> ${LOGFILE} Offload Once the backups are taken, it is good practice to move them to a remote location that is physically separate from the host upon which each service/db is running. Here is an example script for using rsync: #!/bin/bash /usr/bin/rsync --rsync-path=/usr/bin/rsync --delete --rsh="ssh -l user" -azv /backups/db/ enstratus@offsitehost.com:/backups/provisioning/db &> /dev/null 21

22 3 enstratus Overview Figure 1: enstratus Architecture, 4 Server Model 22

23 Component Console Key Management Worker Dispatcher Function Front-end web interface for accessing the enstratus console. Key Manager store for cloud account credentials. The credentials are stored in a de-identified AES256-encrypted MySQL database. Access to this component should be limited. The monitor server (or servers) is responsible for polling cloud infrastructure for state changes such as the addition of new infrastructure, requirements for scaling/recovery of servers, firewall alterations, auto-discovery of cloud infrastructure, and more. The provisioning server interfaces directly with cloud infrastructure such as servers and volumes, and is responsible for carrying out actions initiated by users in the console. Additionally, this component communicates directly with servers that have the enstratus agent installed to accomplish tasks such as formatting and mounting volumes, adding users, and starting/stopping servers. Table 1: enstratus Components The separation of components shown in the diagram above are meant to be logical divisions, not necessarily physical. For example, it is possible, although not recommended, to combine all of the components onto one physical server. The requirements for installing enstratus on-premise vary according to the expected load on the system. For a deployment that will manage thousands of virtual machines and users, the following specifications should be sufficient. Component Console Key Manager Worker Dispatcher Hardware 2 CPU cores, 4 GB memory, 10G storage 2 CPU cores, 4 GB memory, 10G storage 4 CPU cores, 12 GB memory, 10G storage 4 CPU cores, 12 GB memory, 10G storage Table 2: enstratus Component Requirements, 4 server model As an on-premise model, enstratus is offered as deployable software for installation in a private data center. In this capacity, enstratus provides all of the capabilities in the SaaS model done privately. Customers pursuing an on-premise installation are typically enterprise level corporations seeking a unified management interface for managing an internal private cloud or a hybrid cloud. 2 Server Model It is possible to deploy the enstratus cloud management software in a two server model as shown below. This is typically done by combining the Dispatcher, Worker, and Key Management services into one server called the backend server and leaving the console and API servers as the frontend. This deployment model has the advantage of being somewhat simpler and quicker to set up. It can be easily scaled to a four server model should the needs of the enterprise require growing to that model. 23

24 The two server model will potentially place very high resource demands on the backend server. As such, we recommend the following specifications: Component Backend Console Hardware 12 CPU cores, 24 GB memory, 50G storage 2 CPU cores, 4 GB memory, 10G storage Table 3: enstratus Component Requirements, 2-server model Figure 2: enstratus Architecture, 2 Sever Model 3.1 Deployment Best Practices Deploying the enstratus cloud management software is a process that typically takes between 2 to 3 hours. Installing the software should proceed quickly, with the majority of the postinstallation effort spent smoothing the integration with cloud components such as storage. enstratus engineers will also assist on-premise clients with the installation and configuration of the enstratus agent, a pre-requisite for doing automation. 3.2 Required Information Your cloud engineers can help the installation proceed by providing essential information en- Stratus requires to successfully integrate with your cloud. 1. Cloud (API) compute endpoint The enstratus cloud management software requires access to your cloud API endpoint. The syntax of the cloud endpoint is typically something like 24

25 but will vary depending on your cloud provider. Refer to the table below for a list of examples. 2. Cloud compute API credentials API credentials should be non-administrative, but permissive enough to perform cloud infrastruture management duties. enstratus inherits the permissions given via the API credentials. enstratus does not need to have the ability to manage the cloud itself, just the capabilities presented by the cloud. What this means in practice is enstratus is not concerned with doing things like adding additional cloud hosts/nodes or with altering the network scheme of the cloud. It is concerned with the operation of the cloud. enstratus enables self-provisioning for end users. 3. Cloud (API) storage endpoint If the storage endpoint of your cloud is different than the compute endpoint, enstratus requires this information. 4. Cloud storage API credentials If the storage endpoint is different than the compute endpoint, enstratus requires the credentials necessary to connect to the storage endpoint. Cloud API example Credentials Example Eucalyptus Account, User Name, Password OpenStack Account, User Name, Password CloudStack Account, User Name, Password VCloud Director Account, User Name, Password VSphere Account, User Name, Password Nimbula Account, User Name, Password Table 4: enstratus Components 25