rackspace.com/cloud/private

Transcription

1 rackspace.com/cloud/private

2 Rackspace Private Cloud Software v 2.0 ( ) Copyright 2012 Rackspace All rights reserved. This guide is intended to assist Rackspace customers in downloading and installing Rackspace Private Cloud Software, powered by OpenStack. The document is for informational purposes only and is provided AS IS. RACKSPACE MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF THIS DOCUMENT AND RESERVES THE RIGHT TO MAKE CHANGES TO SPECIFICATIONS AND PRODUCT/SERVICES DESCRIPTION AT ANY TIME WITHOUT NOTICE. RACKSPACE SERVICES OFFERINGS ARE SUBJECT TO CHANGE WITHOUT NOTICE. USERS MUST TAKE FULL RESPONSIBILITY FOR APPLICATION OF ANY SERVICES MENTIONED HEREIN. EXCEPT AS SET FORTH IN RACKSPACE GENERAL TERMS AND CONDITIONS AND/OR CLOUD TERMS OF SERVICE, RACKSPACE ASSUMES NO LIABILITY WHATSOEVER, AND DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO ITS SERVICES INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. Except as expressly provided in any written license agreement from Rackspace, the furnishing of this document does not give you any license to patents, trademarks, copyrights, or other intellectual property. Rackspace, Rackspace logo and Fanatical Support are either registered trademarks or trademarks of Rackspace US, Inc. in the United States and/or other countries. OpenStack is either a registered trademark or trademark of OpenStack, LLC in the United States and/or other countries. All other product names and trademarks in this document are for identification purposes only and are property of their respective owners. ii

3 Table of Contents 1. Overview... 1 Intended Audience... 1 Document Change History... 1 Additional Resources... 1 Contact Rackspace About Rackspace Private Cloud Software... 2 What is Rackspace Private Cloud Software?... 2 The Rackspace Private Cloud Configuration... 2 Installed Components... 2 Folsom Code Base... 2 Supported OpenStack Features... 3 Unsupported OpenStack Features... 3 Rackspace Private Cloud Support Installation Prerequisites... 5 Software Requirements... 5 Network Requirements... 5 Instance Access Considerations... 5 NIC Considerations... 7 Proxy Considerations... 7 Preparing For the Installation Installing Rackspace Private Cloud Software on Physical Hardware... 9 Hardware Requirements... 9 Download the ISO Install the Controller Node Install the Compute Node Operating System Updates Troubleshooting the Installation Adjusting Rate Limits Accessing the Cloud Accessing the Controller Node Accessing the Dashboard Restoring the Default OpenStack Dashboard Using Your Logo In the OpenStack Dashboard Accessing the Graphite Monitoring Tool OpenStack Client Utilities Viewing and Setting Environment Variables Creating an Instance in the Cloud Image Management Create a Project Generate an SSH Keypair Update the Default Security Group Create an Instance Accessing the Instance Logging In to the Instance Accessing the Instance By SSH on the Compute Node Managing Floating IP Addresses What's next? Configuring OpenStack Block Storage iii

4 Block Storage Overview Adding Volume Storage Nodes Node Prerequisites Volume Storage Installation Create a Volume Building a Block Storage All-In-One Node Configuring OpenStack Image Storage Local File Storage Rackspace Cloud Files Swift Storage Rackspace Private Cloud Cookbook Update Procedure Download Current Cookbooks Preparing the Nodes Update the Cookbooks Run chef-client Glossary of Terms iv

5 1. Overview Rackspace has developed Rackspace Private Cloud Software, a fast, free, and easy way to download and install a Rackspace Private Cloud powered by OpenStack in any data center. Rackspace Private Cloud Software is suitable for anyone who wants to install a stable, tested, and supportable OpenStack private cloud, and can be used for all scenarios from initial evaluations to production deployments. Rackspace Private Cloud Software v 2.0 (Alamo) supports the Folsom release of OpenStack. Intended Audience This guide is intended for anyone who wants to deploy an OpenStack-powered cloud that has been tested and optimized by the OpenStack experts at Rackspace. This document includes an overview of Rackspace Private Cloud Software and instructions for downloading and deploying Rackspace Private Cloud Software in the data center of your choice. To use the product and this document, you should have prior knowledge of OpenStack and cloud computing, basic Linux administration skills, and a side of bacon. :) Document Change History This version of the Rackspace Private Cloud Software replaces and obsoletes all previous versions. The most recent changes are described in the table below: Revision Date Summary of Changes August 15, 2012 Release of Rackspace Private Cloud Software v 1.0. November 15, 2012 Release of Rackspace Private Cloud Software v 2.0. November 21, 2012 Additional Resources Added information about Folsom implementation, OpenStack Block Storage, changing the Horizon dashboard, proxy settings, changing rate limits, updating the cookbooks, and configuring OpenStack Image Storage to use Rackspace Cloud Files. Updated Chapter 6 to reflect Folsom GUI changes. OpenStack Manuals OpenStack API Reference OpenStack - Nova Developer Documentation OpenStack - Glance Developer Documentation OpenStack - Keystone Developer Documentation OpenStack - Horizon Developer Documentation OpenStack - Cinder Developer Documentation Contact Rackspace For more information about sales and support, contact us at <[email protected]>. For feedback on the product and the documentation, contact us at <[email protected]>. For the documentation, you can also leave a comment at the Knowledge Center. 1

6 2. About Rackspace Private Cloud Software This chapter describes the Rackspace Private Cloud configuration and support offerings. What is Rackspace Private Cloud Software? Rackspace Private Cloud Software is a downloadable ISO package that allows you to easily install OpenStack controller, compute, and all-in-one nodes. When the installation process is complete, you will have a working OpenStack cluster configured according to the recommendations of Rackspace OpenStack specialists. The Rackspace Private Cloud Configuration Rackspace Private Cloud Software v 2.0 (Alamo) uses the Folsom release of OpenStack, and includes Compute (Nova), Image Service (Glance), Dashboard (Horizon), Identity (Keystone), and Block Storage (Cinder). Object Storage (Swift) is not included in the ISO wizard, but can be installed manually. Virtual Network Service (Quantum) is not supported at this time. Installed Components The following components are installed by the Rackspace Private Cloud Software: Host OS Ubuntu Hypervisor KVM Nova controller components and APIs, Glance, Horizon, Keystone, rabbitmq, and MySQL. nova-compute, nova-network, and KVM. Opscode Chef server and Rackspace OpenStack cookbooks. Some supported components, such as Cinder volumes and Swift clusters, are not automatically installed by the Rackspace Private Cloud Software installer and must be configured manually. Refer to the appropriate documentation for these features. Folsom Code Base Rackspace Private Cloud Software v 1.0 used the OpenStack Essex code base, and v 2.0 uses the OpenStack Folsom code base. Complete Folsom API updates have not been completed at this time, and Quantum is not included yet; however, nova-volumes is deprecated and Cinder has been implemented in the Rackspace Private Cloud cookbooks. There is no method for a direct upgrade from a v 1.0 cluster to a v 2.0 cluster; instead, you will have to create a new cluster with the Alamo v 2.0 installer. If you want Rackspace assistance in managing and migrating backup images from a v 1.0 cluster to a v2.0 cluster, please us at <[email protected]>. If your OpenStack environment was not installed with Rackspace Private Cloud Software but you still want to use Rackspace Private Cloud cookbooks, you must update your 2

7 environment variables to include a package_component attribute. The attribute should be set to folsom to be compatible with our cookbooks, as in the following example: "default_attributes": { "mysql": { "allow_remote_root": true, "root_network_acl": "%" }, "package_component": "folsom", "floating": "false" }, Supported OpenStack Features Rackspace supports integration with the other components of OpenStack, as well as features such as floating IP address management, security groups, availability zones, and the python-novaclient command line client. The following features are also supported: Single and dual NIC configurations NFS and ISCSI file storage as backing stores for VM storage VNC Proxy KVM hypervisor Nova Multi Scheduler instead of Filter Scheduler Keystone integrated authentication Glance integrated image service Horizon dashboard Cinder block storage service Swift object storage service Linux and Windows guests to the extent to which they accept handoff from KVM and boot Single metadata server running on each device Cloud management through OpenStack APIs Rackspace also supports the use of Rackspace Cloud Files as a backend for OpenStack Image Storage. For information about OpenStack Object Storage, refer to Rackspace Private Cloud OpenStack Object Storage installation. Unsupported OpenStack Features The following features are not supported: Nova high availability Nova object store Nova volumes NFS and ISCSI file storage via volumes for guest VMs Clustered file system solutions xpvnc Xen and other hypervisors Centralized metadata servers Quantum Software Defined Networking 3

8 Any other OpenStack project, extension or configuration not explicitly listed in the supported features or installed components sections Rackspace Private Cloud Software is an evolving product and we will continue to develop and enhance it. Rackspace Private Cloud Support Rackspace Private Cloud is offered primarily as a "do it yourself" package, free of charge. You can also access the Rackspace Private Cloud Support Forum, a Rackspace-provided user forum, at the following URL: The forum is open to all Rackspace Private Cloud users and is moderated and maintained by Rackspace personnel and OpenStack specialists. Rackspace offers 365x24x7 support for Rackspace Private Cloud Software. If you are interested in purchasing Rackspace Private Cloud Support, or you plan to install on more than 20 nodes, please us at <[email protected]>. 4

9 3. Installation Prerequisites This chapter discusses the networking prerequisites for installing Rackspace Private Cloud Software. Software Requirements Rackspace Private Cloud Software reformats the node on which it is installed and does not have any specific software requirements. Warning During the installation process, the node will be completely reformatted. Do not install Rackspace Private Cloud Software on a node that has any other data on it. Network Requirements Internet access is required to complete the installation, so ensure that the node IP addresses that you use have internet access to download the installation files. Rackspace Private Cloud Software creates a FlatDHCP network, in which nova-network software is installed and configured on each server that is running nova-compute. Further conceptual information about Flat DHCP networking is available in the OpenStack Compute Administration Manual. Refer to the following topics: Configuring flat DHCP networking Libvirt Flat DHCP Networking Instance Access Considerations By default, the instances that you create can only be publicly accessed via NAT by assigning floating IP addresses to them. Before you assign a floating IP address to an instance, you must have a pool of addresses to choose from. Your network security team must provision an address range and assign it to your environment. These addresses need to be publicly accessible. Floating IP addresses are not specified during the installation process; once the controller node is operational, you can add them with the nova-manage floating create -- ip_range command. Refer to "Managing Floating IP Addresses". 5

10 You can also make the instances accessible to other hosts in the network by default by configuring the cloud with a network DMZ. The network DMZ range cannot be the same as the nova fixed network range. Specifying a DMZ enables NAT-free network traffic between the virtual machine instances and resources outside of the nova fixed network. For example, if the nova fixed network is /16 and you specify a DMZ of /12, any devices or hosts in that range will be able to communicate with the instances on the nova fixed network. To use the DMZ, you must have at least two NICs on the deployment servers. One NIC must be dedicated to the VM instances. 6

11 NIC Considerations Rackspace Private Cloud Software v 2.0 supports single- and dual-nic installations and comes with a network bridge defined and configured in advance. During the installation process, you will be prompted to supply NIC information, and if you have more than one NIC, you must designate one as public and one as private. There are several considerations of which you should be aware. OpenStack compute requires NIC ordering to be the same on all hosts in the nova network. For example, when configuring the controller, you may choose eth1 as your public NIC and eth0 as private. When you configure the compute nodes, you must configure their NICs in exactly the same way. You cannot mix single-nic and multi-nic configurations. If you configure the controller with one NIC, all associated compute nodes must also be single-nic. If your server has more than one network card, you cannot perform a single-nic installation, and will be required to select a public and private NIC during the installation process. Proxy Considerations Rackspace Private Cloud Software v 2.0 allows you to enter a proxy gateway address during the installation process. When a proxy is enabled, all internet traffic going to and from the cluster will pass through the proxy, including the Rackspace Private Cloud installation files. After you define the type of node that you want to install, you will be prompted to enter the proxy address. If you do not have one, you can press Enter to leave it blank and skip the step. Proxy settings can only be configured during the installation process. If you need to change the settings, it is recommended that you re-run the ISO. Preparing For the Installation Before you begin, have the following networking information prepared and available: The NIC address or addresses that the nova fixed network will use. If you have more than one NIC address, you must designate one as public and one as private. The IP addresses that you want to assign to each controller and compute node. This can be an IPv4 address in the format xxx.xxx.xxx.xxx or a CIDR range, and it must be able to access the internet to download installation files. Network subnet mask. Network default public gateway. This address is usually a xxx.xxx.xxx.1 address. The IP address of your proxy gateway, if you have one. The address of your nameserver. The server host name. You may be able to define this yourself, or you may need to contact your network administrator for the name. 7

12 Fully-qualified domain name for the host. The address for the nova fixed network, in CIDR format. Instances created in the OpenStack cluster will have IP addresses in this range. Optional DMZ network address and the gateway address in the fixed network that is on the router that routes to the DMZ. The DMZ network address is in CIDR format. A password for an admin OpenStack user. A password for a non-admin OpenStack user, as well as a username if you do not want to use the default of demo. A full real name, username, and password for an operating system user. You must also ensure that the server is configured to boot from an ISO. You can monitor the progress of the installation from a console directly connected to the server or via a remote management tool, such as Dell DRAC or HP Ilo. Finally, you should ensure that the server has virtualization support enabled in the BIOS. 8

13 4. Installing Rackspace Private Cloud Software on Physical Hardware This chapter discusses the process for installing Rackspace Private Cloud Software and tips for troubleshooting the installation. Warning During the installation process, the node will be completely reformatted. Do not install Rackspace Private Cloud Software on a node that has any other data on it. Hardware Requirements Rackspace strongly recommends that you install Rackspace Private Cloud Software on physical hardware nodes (bare metal) for best results. The minimum node footprint is a 2-node installation of one controller node and one compute node. Other compute nodes may be added as needed, up to a total of 20 nodes. An all-in-one installation is available, but it is not recommended that you build a working system on it. Note If you need to install on more than 20 nodes, please contact us at <[email protected]>. The hardware on which Rackspace Private Cloud Software is installed should support VT-x and meet the following recommended minimum hardware specifications: Controller Node: 16 GB RAM 144 GB disk space Dual socket CPU with dual core, or single socket quad core Compute Node: 32 GB RAM 144 GB disk space Dual socket CPU with dual core, or single socket quad core CPU overcommit is set at 16:1 VCPUs to cores, and memory overcommit is set to 1.5:1. Each physical core can support up to 16 virtual cores; for example, one dual-core processor can support up to 32 virtual cores. If you require more virtual cores, adjust your sizing appropriately. 9

14 Download the ISO To download the Rackspace Private Cloud Software ISO, navigate to the product website at the following URL: After you complete and submit the form, you will receive instructions for downloading the ISO. The ISO is a 2 GB file. If you will be copying it to a USB drive; ensure that the drive has sufficient capacity. You will need to make the USB stick bootable. This process has been documented by Ubuntu on their web site. Refer to the procedure that is appropriate for your operating system: Create a bootable USB stick on OS X Create a bootable USB stick on Ubuntu Create a bootable USB stick on Windows Install the Controller Node Before you begin, ensure that you have prepared your network information. When you are ready, follow this procedure to install the controller node. Note You must install the controller node before you install any compute nodes. 1. Boot the ISO on the controller node. 2. After the ISO has launched and loaded, accept the EULA statement. 3. Select Controller. 4. Enter the NIC address. If you have more than one, you must designate one as public and one as private. 5. When prompted, enter the node IP address, subnet mask, gateway, name server, and host name. If you do not enter a fully-qualified domain name for the hostname, you will be prompted to enter a domain name as well. 6. Enter the address for the nova fixed network. 7. If you want to configure a DMZ network, enter the DMZ address and the DMZ gateway address. Be sure that you have at least two NICs on the server. 8. Enter a password for the admin user. You will use this admin username and password to access the API and the dashboard. 9. For the additional non-admin user, accept the default demo or enter your own and provide a password at the prompt. This user will not have admin privileges, but will be able to perform basic OpenStack functions, such as creating instances from images. 10

15 Creating the user will also automatically create a project (also known as a tenant) for this user. 10.Enter the real name, user name, and password for the operating system user account. For example, the user Jane Doe would enter the following information: Full name for the new user: Jane Doe Username for your account: jdoe Password: mysecurepassword At this point, it will take approximately 5-10 minutes for the Ubuntu operating system installation to complete. 11.If you have a proxy, enter the proxy URL at the prompt in the format If you do not have a proxy, press enter to skip this step and leave the proxy information blank. At this point, the installation process will run for approximately 30 minutes without the need for user intervention. The device will reboot during the installation process. You will see a screen with the Rackspace Private Cloud logo, followed by a screen that displays a progress bar; you can use Ctrl+Alt+F2 to toggle between the progress bar screen and a Linux TTY screen (Ctrl+Alt+Fn+F2 on a Mac). You can follow the log during installation by switching to the correct TTY screen and viewing the log in /var/log/ post-install.log. After the installation is complete, you can view the install log by logging into the operating system with the username and password that you configured in Step 9. The log is stored in /var/log/post-install.log. Caution There is no password recovery system. Please do not forget your admin password. Install the Compute Node After the controller node installation is complete, follow this procedure to install the compute node. 1. Boot the ISO on the compute node. 2. After the ISO has launched and loaded, accept the EULA statement. 3. Select Compute. 4. Enter the NIC address. If you have more than one NIC, designate one as public and one as private. Be sure that the ordering of the NICs matches the order that you specified for the controller node. 5. When prompted, enter the node IP address, subnet mask, gateway, name server, and host name. If you do not enter a fully-qualified domain name for the hostname, you will be prompted to enter a domain name as well. 6. Enter the real name, user name, and password for the operating system user account. For example, the user Jane Doe would enter the following information: 11

16 Full name for the new user: Jane Doe Username for your account: jdoe Password: mysecurepassword At this point, it will take approximately 5-10 minutes for the Ubuntu operating system installation to complete. 7. If you have a proxy, enter the proxy URL at the prompt in the format If you do not have a proxy, press enter to skip this step and leave the proxy information blank. 8. Enter the IP address for the controller node. This will add the new compute node to the cluster. At this point, the installation process will run for approximately 20 minutes without the need for user intervention. As with the controller node installation, the device will reboot during the installation process. You will see a screen with the Rackspace Private Cloud logo, followed by a screen that displays a progress bar; you can use Ctrl+Alt+F2 to toggle between the progress bar screen and a Linux TTY screen (Ctrl+Alt+Fn+F2 on a Mac). You can follow the log during installation by switching to the correct TTY screen and viewing the log in /var/log/post-install.log. After the installation is complete, you can view the install log by logging into the operating system with the username and password that you configured during the Controller installation. The log is stored in /var/log/post-install.log. Operating System Updates After you complete the installation, you may get a message notifying you that operating system updates and patches are available. These updates may be safely applied. However, as a best practice in a production environment, Rackspace strongly recommends that you configure a mirror of your production environment in which you apply and test new patches and updates before applying them in production. Troubleshooting the Installation If the installation is unsuccessful, it may be due to one of the following issues. The node does not have access to the Internet. The installation process requires Internet access to download installation files, so ensure that the address for the nodes provides that access and that the proxy information that you entered is correct. You should also ensure that the nodes have access to a DNS server. Your network firewall is preventing Internet access. Ensure the IP address that you assign to the controller is available through the network firewall. Virtualization technology may not be enabled in your server's BIOS. Ensure that virtualization is enabled and restart the installation process. For more troubleshooting information and user discussion, you can also inquire at the Rackspace Private Cloud Support Forum at the following URL: 12

17 Adjusting Rate Limits By default, Rackspace Private Cloud Software sets low values for rate limits, which limit activities such as the number of posts in a minute or the number of servers created in a minute. Depending on your environment, you may need to increase the rate limits. Use the following procedure to adjust the rate limits. 1. Log into the controller node and switch to root access with sudo -i. 2. Issue the following command to edit the environment file. $ knife environment edit rpcs 3. Edit the nova section of the environment file as follows (adjusting the rate limit values as is appropriate to your environment). "nova": { "ratelimit": { "settings": { "changes-since-limit": { "interval": "MINUTE", "limit": "3", "regex": ".*changes-since.*", "uri": "*changes-since*", "verb": "GET" }, "create-servers-limit": { "interval": "DAY", "limit": "50", "regex": "^/servers", "uri": "*/servers", "verb": "POST" }, "generic-delete-limit": { "interval": "MINUTE", "limit": "100", "regex": ".*", "uri": "*", "verb": "DELETE" }, "generic-post-limit": { "interval": "MINUTE", "limit": "10", "regex": ".*", "uri": "*", "verb": "POST" }, "generic-put-limit": { "interval": "MINUTE", "limit": "10", "regex": ".*", "uri": "*", "verb": "PUT" } } 13

18 }, },, 4. Run chef-client to commit the change. $ chef-client 14

19 5. Accessing the Cloud This chapter describes the methods you will use to access your cloud. You should be familiar with the contents of this section before attempting to create an instance or perform other configuration and maintenance tasks. Accessing the Controller Node Rackspace Private Cloud Software also installs the OpenStack client utilities necessary to use the cloud. You can access these features through the command line interface on the controller node. To use them, log in to the controller node via SSH with the OS username and password that you set up during controller node installation. At the shell, switch to root user access. $ sudo -i You can now run the following commands. $ source.novarc $ nova flavor-list You should see output similar to the following: ID Name Memory_MB Disk Ephemeral Swap VCPUs RXTX_Factor m1.tiny m1.small m1.medium m1.large m1.xlarge This is a list of "flavors", different disk sizes that you can assign to images, and is an example of the information that you can access through the python-novaclient command line client. You can also view the status of the controller and compute nodes and the nova components active on each while logged in as the root user. $ nova-manage service list 15

20 You should see output similar to the following: Binary Host Zone Status State Updated_At nova-scheduler ctrl nova enabled :-) :51:34 nova-consoleauth ctrl nova enabled :-) :51:41 nova-network compute1 nova enabled :-) :51:39 nova-compute compute1 nova enabled :-) :51:35 You can also view logs with the tail command. For example, to view nova.log, execute the following command: $ tail /var/log/nova/nova.log All logs are available in the /var/log/ directory and its subdirectories. Accessing the Dashboard In addition to the command line, you can use your web browser to access the controller host. You can use the hostname or the IP address that you provided during installation. You should see the OpenStack dashboard (Horizon) login page. If not, the installation may not be complete. Log in with the admin username and the password that you created during the controller node installation. When the login is successful, you can configure additional users, create and manage images, and launch instances. Restoring the Default OpenStack Dashboard Clusters installed with Rackspace Private Cloud Software v 2.0 will have a Rackspacecustomized dashboard with a similar look and feel to the Rackspace Public Cloud dashboard. If you need to restore the default OpenStack dashboard, follow this procedure. 1. Log into the controller node and switch to root access with sudo -i. 2. Issue the following command to edit the environment file. $ knife environment edit rpcs 3. In the Horizon section of the file, change theme:"rackspace" to "theme: "default". 4. Run chef-client to commit the change. $ chef-client When you reload the dashboard in your web browser, it will now use the default OpenStack style. To revert to the Rackspace theme, follow the same procedure and change the theme: value to "Rackspace". 16

21 You can also use a single knife command to execute the change. $ knife exec -E '@e=chef::environment.load("rpcs"); \ [email protected]_attributes; To revert the theme, execute the same knife command, substituting "Rackspace" for "default". Using Your Logo In the OpenStack Dashboard After you have switched to the OpenStack default dashboard, you can customize it by adding your own logo. 1. Create a transparent PNG of your logo, sized to fit within a 200-pixel wide by 160-pixel tall space. 2. Name the file logo.png. 3. Save logo.png in the following location: /usr/share/openstack-dashboard/openstack_dashboard/static/ dashboard/img/logo.png 4. If you have not already done so, switch to root access with sudo -i. 5. Open style.css for editing with nano. $ nano /usr/share/openstack-dashboard/openstack_dashboard/static/dashboard/ css/style.css 6. Press Ctrl+w and search for: h1.brand. 7. Replace the entire h1.brand rule with the following: h1.brand a { background: url(../img/logo.png) center center no-repeat; display: block; height: 160px; text-indent: -9999px; margin: 25px auto; } 8. Press Ctrl+X; then press Y to commit the change. 9. Press Return to save style.css and exit the editor. Accessing the Graphite Monitoring Tool The cluster can be monitored via the Graphite monitoring tool. This is automatically enabled in clusters installed with Alamo v

22 To access the Graphite dashboard, use the IP address for your controller node and port 8080, as in the following example: Graphite allows you to access a wide range of cluster data, and allows you to create custom charts according to your environment's needs. Threshold monitoring is provided by the monit tool, which provides basic threshold monitoring and alerts. For more information about Graphite, refer to the Graphite wiki. For more information about monit, refer to the monit web site. OpenStack Client Utilities The OpenStack client utilities are a convenient way to interact with OpenStack from the command line from your own workstation, without being directly logged in to the controller node. The client utilities for python are available via pypy and can be installed on most Linux systems with python available via pip install python-novaclient and pip install python-glanceclient. For more information, refer to the following links. python-novaclient Setting up python-novaclient python-glanceclient Using the Glance CLI client Note The clients are maintained by the community and should be considered software in development. When in doubt, refer to the internal client help for more information. A command line client is also available for OpenStack Block Storage (Cinder). For more information about Cinder, refer to Configuring OpenStack Block Storage. Viewing and Setting Environment Variables The environment variables set in the.novarc file are used by the OpenStack clients to provide the information necessary to authenticate to your cloud. When you are logged into the controller node as root, you can view the.novarc file. Caution Be careful with the information contained in.novarc. This file contains administrative credentials by default. This file should not be edited, since it is automatically maintained by chef. If you want to connect to the OpenStack installation via python-novaclient or other command line clients, you must add environment variables to your local environment. The easiest way to capture environment variables is to download them from the dashboard. 1. Log into the dashboard. 18

23 2. In the upper right corner, clicksettings. 3. In the navigation panel, select OpenStack Credentials. 4. Select the project for which you want to download the environment variables and click Download RC file. 5. After you have saved the file, open a local terminal and execute the command source openrc to add the environment variables to your local environment. The contents of the openrc.sh file are as follows: #!/bin/bash # With the addition of Keystone, to use an openstack cloud you should # authenticate against keystone, which returns a **Token** and **Service # Catalog**. The catalog contains the endpoint for all services the # user/tenant has access to - including nova, glance, keystone, swift. # # *NOTE*: Using the 2.0 *auth api* does not mean that compute api is 2.0. We # will use the 1.1 *compute api* export OS_AUTH_URL= # With the addition of Keystone we have standardized on the term **tenant** # as the entity that owns the resources. export OS_TENANT_ID=tenant_id export OS_TENANT_NAME=tenant_name # In addition to the owning entity (tenant), openstack stores the entity # performing the action as the **user**. export OS_USERNAME=username # With Keystone you pass the keystone password. echo "Please enter your OpenStack Password: " read -s OS_PASSWORD_INPUT export OS_PASSWORD=$OS_PASSWORD_INPUT 19

24 6. Creating an Instance in the Cloud OpenStack administration is documented in detail in the OpenStack Compute Administration Manual. In this section, we discuss key tasks you should perform that will allow you to launch instances. Refer to the official OpenStack documentation for more information. For these tasks, you must be logged in to the Dashboard as the admin user. These tasks can also be performed on the command line; some tasks require you to be logged into the controller via SSH, and some can be performed via python-novaclient on the controller or on a workstation. You should also be familiar with the material documented in "Accessing the Cloud". Note Image Management Nova volumes are not supported in Rackspace Private Cloud Software. For block storage, refer to the instructions for configuring OpenStack Block Storage. The ISO includes a CIRROS image and an Ubuntu (Precise) image. For more information about downloading and creating additional images, refer to the following OpenStack documentation. Getting virtual machine images Creating a Linux Image - Ubuntu & Fedora Using the Glance CLI Tool Images can only be added on the command line with the glance add command; the Dashboard does not have any image functionality. You can use glance add when logged into the controller node, or if you have Glance client installed on your local workstation and have configured your environment with administrative user access to the controller. The following command is an example in which the user has a virtual disk image in qcow2 format stored on the local file system at /tmp/images/test-image.img. When the image is imported, it will be named "Test Image" and will be public to any Glance user with access to the controller. $ glance add name="test Image" is_public_true \ container_format=bare disk_format=qcow2 < /tmp/images/test-image/img If the image is successfully added, Glance will return a confirmation similar to the following: Added new image with ID: 85a0a926-d3e5-4a22-a062-f9c78ed7a2c0 More information is available via the command glance help add. 20

25 Create a Project You must create a project before you can launch an instance. A demo project is available by default, but if you want to create your own project, follow this procedure. 1. Ensure that the Admin tab in the navigation panel is in view, and select Projects. 2. Click Create New Project. 3. On the Project Info tab on the Add Project dialog, enter the name and a brief description, and ensure that the Enabled option is selected. 4. On the Project Members tab, add users to the project to grant them access to the project. Click the user name in the All Users column to add them to the Project Members column. Typically, when configuring your first project, these will be the admin user and the demo user that you created during the installation process (not to be confused with the operating system user). When prompted for a role for the user, you may wish to assign the admin role to the admin user and the member role the demo user.. Refer to the OpenStack Keystone documentation for information about customizing roles. 5. You may also need to modify quotas, which create limits for the number of VCPUs that the project can contain, the number of instances that can be created, and more. On the Quotas tab, modify the quotas as needed and click Update Quota to save your changes. 6. The new project will appear in the Projects table. Your project is now ready for additional configuration. Log out as the administrator and log in as the demo user before proceeding. When logged in, ensure that the project is selected in the navigation bar. Adding a project with the command line On the command line, projects are managed when logged in as root with nova-manage. For example, to create a project named Marketing that would be administered by user jdoe, you would use sudo -i to switch to root and execute the following command: $ nova-manage project add Marketing jdoe Generate an SSH Keypair Keypairs provide secure authentication to an instance, and will enable you to create instances securely and to log into the instance afterward. Keypairs are generated separately for each project and assigned to instances at time of creation. You can create as many keypairs in a project as you like. 1. With your project selected in the navigation panel, select Access and Security. 2. Under Keypairs, click Create Keypair. 3. In the Create Keypair dialog, enter the name for the keypair. 21

26 4. You will be prompted to save the keypair.pem file. Generating a keypair with the command line On the command line, keypairs are managed with nova keypair-* commands in pythonnovaclient. When generating a keypair, you must have your OS_USERNAME and OS_TENANT_NAME configured in your environment to ensure that you have access to the correct project. Our user jdoe, after configuring their environment, would then issue the following command to generate a keypair: $ nova keypair-add jdoe-keypair The client will generate a block of RSA Private Key text, which the user copies and saves to a file called jdoe-keypair.pem. Update the Default Security Group A Security Group is a named set of rules that get applied to the incoming packets for the instances. Packets that match the parameters of the rules are given access to the instance; all other packets are blocked. At minimum, you should ensure that the default security group permits ping and SSH access. You may edit the default security group or add additional security groups as your security settings require. 1. With your project selected in the navigation panel, open the Access & Security page. 2. In the Security Groups table, click Edit Rules in the default security group row. 3. In the Edit Security Group Rules dialog box, enable SSH access by entering the following values: IP Protocol: TCP From Port: 22 To Port: 22 Source Group: CIDR CIDR: you may leave it as /0 if you want to enable access from all networks, or you may enter a specific network, such as / Click Add Rule. You will receive a confirmation message at the top of the Dashboard window that the new rule was added to the default security group. To enable ping, repeat the procedure with a protocol of ICMP, type of -1, and code of -1. Managing security groups with the command line On the command line, security groups are managed with nova secgroup-* commands in python-novaclient. To add the ping and SSH rules to the default security group, issue the following commands: $ nova secgroup-add-rule default tcp /0 $ nova secgroup-add-rule default icmp /0 22

27 Use nova secgroup-list-rules to view the updated default security group rules: $ nova secgroup-list-rules default IP Protocol From Port To Port IP Range Source Group icmp /0 tcp / Create an Instance Before you can create an instance, you must have already generated a keypair and updated the default security group. The project in which you want to create the instance should be in focus on the dashboard. 1. With your project selected in the navigation panel, open the Images & Snapshots page. 2. Locate the image from which you want to create the instance in the Images table and click Launch. For example, to create an Ubuntu image, select a precise image. 3. On the Details tab of the Launch Instances dialog, enter the following information: Instance Source: Specify whether the instance will be based on an image or a snapshot. Your first instance will not have any snapshots available yet. Image: The image that the instance will be based on. This option will be labeled as Snapshot when Snapshot is selected as the Instance Source. Instance Name: The name of the instance. You might choose a name like my-instance. Flavor: The VCPU configuration. Note that instances with larger flavors can take a long time to create. If you are creating an instance for the first time and want something small with which to test, select m1.small. Instance Count: Accept the default value of 1. If you wanted to create multiple instances with this configuration, you could enter an integer up to the number permitted by your quota, which is 10 by default. 4. On the Access and Security tab, select the keypair that you created earlier. You must assign a keypair when generating an Ubuntu image. Accept the default security group. 5. On the Volume Options tab, you can choose to launch the instance with a storage volume attached. This should only be done when you have a Block Storage volume created; for your first instance, select Don't boot from a volume. 6. On the Post-Creation tab, you can add customization scripts. Some instances support user data, such as root passwords or admin users. If you have the information available, you may enter it here. 7. Click Launch. The Instances and Volumes page will open, with the new instance creation in process. The process should take less than a minute to complete, after which the instance status will be listed as Active. You may need to refresh the page. 23

28 Launching an instance with the command line On the command line, image creation is managed with the nova boot command. Before you can launch an image, you need to determine what images and flavors are available on the instance. $ nova image-list ID Name Status Server c0027-[ID truncated] cirros-image ACTIVE 0ccfc8c4-[ID truncated] My Image 2 ACTIVE 85a0a926-[ID truncated] precise-image ACTIVE $ nova flavor-list ID Name Memory_MB Disk Ephemeral Swap VCPUs RXTX_Factor m1.tiny m1.small m1.medium m1.large m1.xlarge

29 In the following example, an instance is launched with an image called precise-image. It uses the m1.small flavor with an ID of 2, and is named markets-test. $ nova boot --image precise-image --flavor="2" markets-test Property Value OS-DCF:diskConfig MANUAL OS-EXT-SRV-ATTR:host None OS-EXT-SRV-ATTR:hypervisor_hostname None OS-EXT-SRV-ATTR:instance_name instance d OS-EXT-STS:power_state 0 OS-EXT-STS:task_state scheduling OS-EXT-STS:vm_state building accessipv4 accessipv6 adminpass ATSEfRY9fZPx config_drive created T15:43:46Z flavor m1.small hostid id 5bf46a3b-084c-4ce1-b06f-e460e875075b image precise-image key_name metadata {} name markets-test progress 0 status BUILD tenant_id b e2a9279c842b09be6a updated T15:43:46Z user_id 5f2f2c28bdc844f b524e You can also view the newly-created instance at the command line with nova list. $ nova list ID Name Status Networks [ID truncated] markets-test ACTIVE public= Accessing the Instance All instances exist on a nova network that is not accessible by other hosts by default. There are various ways to access an instance. In all cases, be sure that you have updated the default security group. If you added a DMZ range during installation, you can access the instance via SSH from other hosts within the DMZ. Log in through the VNC console on the dashboard. On the Instances & Volumes page, select VNC from the drop-down menu in the Instances table. If the console does not 25

30 respond to keyboard input, click the grey bar at the top of the console window. For best results, you should be running the dashboard on a Firefox browser with Flash installed. Connect by SSH to the address that you assigned to the compute node, and connect to the instance by SSH while logged in to the compute node. Refer to "Accessing the Image By SSH on the Compute Node". Assign a floating IP address to the instance and connect to that IP address by SSH. Refer to "Managing Floating IP Addresses". Logging In to the Instance The login for each instance is determined by the configuration of the image from which it was created. Rackspace Private Cloud Software comes with a CIRROS image and an Ubuntu (Precise) image. CIRROS: log in with the username cirros and the password cubswin:). Ubuntu Precise: You must use the SSH key that you specified for the instance during the instance creation process. The key must be present on the host from which you are connecting to the instance, and you must log in with the key name and the -i flag. In the following example, the keypair file is named jdoe-keypair.pem. $ ssh -i jdoe-keypair.pem For instances launched from other images, log in with the credentials defined in the image. Accessing the Instance By SSH on the Compute Node Before you begin, you should know the IP addresses of your compute node or nodes. 1. If you have one compute node, go on to Step 2. If you have more than one compute node, log into the controller node, use sudo -i to switch to root, and execute the following command to identify the compute node on which the instance is stored. $ nova-manage vm list grep instance_name The output generated will include the following information, where N is the number of the compute node. Compute nodes will be numbered in the order in which you added them. instance_name computen m1.small active :42:53 2. Connect to the compute node via SSH and use the OS login credentials that you created during install. In this example, the compute node's IP address is and the OS login is jdoe. You will be prompted for the password. 26

31 $ ssh l jdoe 3. Once you are logged in, verify that you can ping the instance. In this example, the instance's IP address is $ ping PING ( ) 56(84) bytes of data. 64 bytes from : icmp_req=1 ttl=64 time=0.394 ms 64 bytes from : icmp_req=2 ttl=64 time=0.266 ms 64 bytes from : icmp_req=3 ttl=64 time=0.285 ms 4. Copy the *.pem keypair file associated with the instance to the compute node. 5. Connect to the instance via SSH. $ ssh If the login requires an SSH key, log in with the key name and the -i flag. In this example, the keypair file is named jdoe-keypair.pem. $ ssh -i jdoe-keypair.pem Managing Floating IP Addresses Before you assign a floating IP address to an instance, you must have a pool of addresses to choose from. Your network security team must provision an address range and assign it to your environment. These addresses need to be publicly accessible. Note If your cloud is hosted in a Rackspace data center and you require more floating IP addresses, contact your Rackspace support representative for assistance. Follow this procedure to create a pool of floating IP addresses, allocate an address to a project, and assign it to an instance. 1. Log into the controller node and use sudo -i to switch to root. Execute the following command, substituting in the CIDR for the address range in --ip_range that was provisioned by your network security team: $ nova-manage floating create --ip_range=xxx.xxx.xxx.xxx/xx This creates the pool of floating IP addresses, which will be available to all projects on the host. You can now allocate a floating IP address and assign it to an instance in the dashboard. 2. Open the Access & Security Page. 27

32 3. Click Allocate IP to Project above the Floating IPs table. 4. In the Allocate Floating IP dialog box, accept the default (typically Floating) in the Pool drop-down menu and click Allocate IP. You will receive a confirmation message that a floating IP address has been allocated to the project and the IP address will appear in the Floating IPs table. This reserves the addresses for the project, but does not immediately associate that address with an instance. 5. In the row for the IP address, click Associate IP. 6. In the Manage Floating IP Associations dialog, ensure that the allocated IP address is selected and select the instance from the Instance menu. Click Associate. You will receive a confirmation message that the IP has been associated with the instance. The instance ID will now appear in the Floating IPs table, associated with the IP address. It may be a few minutes before the IP address is included on the Instances table on the Instances & Volumes page. Once the IP address assignment is completed, you can access the instance from any Internet-enabled host by using SSH to access the newly-assigned floating IP. See Logging In to the Instance for more information. Managing floating IP addresses with the command line Allocation and assignment of floating IP addresses is managed with the nova floating-ip* commands. In this example, the IP address is first allocated to the Marketing project with nova floatingip-create command. $ nova floating-ip-create marketing The floating IP address has been reserved for the Marketing project, and can now be associated with an instance with the nova add-floating-ip command. For this example, we'll associate this IP address with the image markets-test. $ nova add-floating-ip markets-test

33 After the command is complete, you can confirm that the IP address has been associated with the nova floating-ip-list and nova-list commands. $ nova floating-ip-list Ip Instance Id Fixed Ip Pool df-8ba4-4d08-90c9-b79f5a77c04f nova $ nova list ID Name Status Networks [ID truncated] markets-test ACTIVE public= , The first table shows that the is now associated with the markets-test instance ID, and the second table shows the IP address included under markets-test's public IP addresses. What's next? Congratulations! You have created a project and launched your first instance in your Rackspace Private Cloud Software-created cluster. You can now use your OpenStack environment for any purpose you like. If you're a more advanced user and are comfortable with APIs, OpenStack API documentation is available in the OpenStack API Documentation library. The following documents are a good place to start: OpenStack API Quick Start Programming OpenStack Compute API OpenStack Compute Developer Guide You may want to purchase Escalation Support or Core Software Support for your cloud or take advantage of our training offerings. Contact us at <[email protected]> for more information. And please come join your fellow Rackspace Private Cloud users on our customer forums. Welcome aboard! 29

34 7. Configuring OpenStack Block Storage Rackspace has developed a set of OpenStack Block Storage (Cinder) chef recipes, combined into a cookbook, that can be used to configure a Cinder node or group of nodes. This section discusses the concepts and architecture behind Cinder and describes the procedures for configuring Cinder nodes. Block Storage Overview The Cinder project provides "block storage as a service" functionality in OpenStack. Beginning in the Folsom release and going forward, it is designed to replace the novavolumes service. The Cinder architecture includes the following components: API service: Responsible for receiving and handling requests and placing them in the message queue. OpenStack clusters deployed with Rackspace Private Cloud Software will use rabbitmq. Scheduler service: Assigns tasks in the queue and determines the volume server to which provisioning requests are sent. Volume service: Runs on the storage node and manages the storage space. The volume service can run on multiple nodes, each constituting part of the block storage "pool"; the scheduler service will distribute requests across all nodes that are running the volume service. With the Rackspace Private Cloud Cinder recipes, you can install the services across multiple nodes or all together on a single node. The Rackspace Private Cloud cookbooks provide convenient chef roles to assist in installing services on nodes. The cinder-api, cinder-scheduler, and cinder-volume roles, when applied to a node, will install the respective services by running the relevant recipes. The cinder-all meta-role includes all three cinder roles. Adding Volume Storage Nodes Rackspace Private Cloud Software installs cinder-api and cinder-scheduler on the controller node by default. You will need to add additional cinder-volume nodes to use OpenStack Block Storage on your cluster. Node Prerequisites Rackspace recommends that the physical server that will become a Cinder volume node or a Cinder all-in-one node meet the following criteria. 1 core per 3TB capacity At least 6 SATA or SAS drives of at least 1TB capacity each. At least 2GB RAM, plus an additional 250MB RAM per TB of drive. 30

35 RAID Controller with battery backup in RAID5 or RAID10 configuration. Your environment must meet the following criteria. An OpenStack controller node is running Nova controller components and APIs, Glance, Horizon, Keystone, rabbitmq, and MySQL, installed with Rackspace Private Cloud Software. At least one node is running nova-compute, and was installed with Rackspace Private Cloud Software. A Chef server is available on the cluster. Rackspace Private Cloud Software installs the Chef server on the controller node by default. You have the means to install Ubuntu on the server where the Cinder node will exist. You DO NOT already have a node running nova-volumes in the OpenStack cluster. Volume Storage Installation 1. Install Ubuntu on the server that will become the Cinder volume node. 2. Install and configure chef-client on the new server. The following commands will ensure that the chef-client points to the Chef server on the controller node. $ curl -L bash $ mkdir -p /etc/chef $ export chef=your_controller_ip $ cat > /etc/chef/client.rb <<EOF chef_server_url " environment "rpcs" EOF 3. On the controller node, locate /etc/chef/validation.pem. 4. Copy this file to /etc/chef/ on the new server. 5. Run chef-client on the new server to register the new server. $ rm -fr /etc/chef/client.pem ; chef-client 6. Log into the controller node and switch to root access with sudo -i. Update the cookbooks and roles with the procedure documented in "Update the Cookbooks". 7. Create an LVM volume group on the new server. In this example, the server has a disk that appears as /dev/sdb, and a volume group called cinder-volumes will be created on this disk. $ ssh server_ip_address $ sudo pvcreate /dev/sdb $ sudo vgcreate cinder-volumes /dev/sdb 31

36 8. On the controller node, execute the following knife command to add the cindervolume role to the server. For server_name, substitute the fully qualified domain name of the server, such as cindervolume1.mydomain.com. $ knife node run_list add server_name 'role[cinder-volume]' 9. Run chef-client on the server to complete the process. $ ssh my.new.server $ sudo chef-client When the procedure is complete, you should receive output similar to the following: [ T10:32:02+00:00] INFO: *** Chef *** [ T10:32:04+00:00] INFO: Run List is [role[cinder-volume]] --output truncated-- [ T16:23:34+00:00] INFO: Running report handlers [ T16:23:34+00:00] INFO: Report handlers complete When the process is complete, the new Cinder volume node will be ready to use. Create a Volume Volumes can be created through the Dashboard or with python-cinderclient. The client is installed by default on the cinder node, but you can install it on your local workstation with the following command: $ sudo apt-get install python-cinderclient You should also ensure that your workstation's environment variables have been set correctly, as described in Viewing and Setting Environment Variables. In this example, a volume called myvolume with a size of 1 is created and attached to an instance with python-cinderclient. $ cinder create --display-name myvolume Property Value attachments [] availability_zone nova created_at T17:16: display_description None display_name myvolume id f9-8fff-44bb-b82a-27d4e32b9939 metadata {} size 1 snapshot_id None 32

37 status creating volume_type None $ cinder list ID Status Display Size Volume Attached Name Type to f9[id truncated] available myvolume 1 None This volume is now available to be attached to a nova instance. For this example, myvolume will be attached to an instance called myserver with the nova volume-attach command. The auto argument allows the Block Storage API to determine how the disk will appear when its information is viewed from within the virtual machine. In this case, Cinder assigns a block device named /dev/vdb to the volume. $ nova list ID Name Status Networks f947896e[id truncated] myserver ACTIVE public= $ cinder list ID Status Display Size Volume Attached Name Type to f9[id truncated] available myvolume 1 None $ nova volume-attach f947896e-600a-4600-a27a-3f372146b6e9 \ f9-8fff-44bb-b82a-27d4e32b9939 auto Property Value device /dev/vdb id 0501bc27-5ebd-44f2-8a4a-bb1595ee7e42 serverid f947896e-600a-4600-a27a-3f372146b6e9 volumeid 0501bc27-5ebd-44f2-8a4a-bb1595ee7e The Cinder volume is now attached to myserver. $ cinder list ID Status Display Size Volume Attached Name Type to f9[id truncated] available myvolume 1 None f947896e When you ssh to the instance to which the volume was attached and look up the disk information, you will see the disk information for the block device. In this example, the instance has an IP address of

38 $ ssh $ sudo fdisk -l /dev/vdb Disk /dev/vdb: 1073 MB, bytes 16 heads, 63 sectors/track, 2080 cylinders, total sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x Disk /dev/vdb doesn't contain a valid partition table Building a Block Storage All-In-One Node If you did not use the Rackspace Private Cloud Software installer to create your cluster, and if you did not use the Rackspace single-controller role in a manual configuration, you will need to create a Block Storage node with the cinder-all role. This will create a node with the cinder-api, cinder-scheduler, and cinder-volume roles. You can also create a block storage all-in-one node following the steps outlined in Adding Volume Storage Nodes, with one change. In step 8, you will specify the cinder-all role instead of cinder-volume. For server_name, substitute the fully qualified domain name of the server, such as cinder1.mydomain.com. $ knife node run_list add server_name 'role[cinder-volume]' When the procedure is complete, you should receive output similar to the following: [ T10:32:02+00:00] INFO: *** Chef *** [ T10:32:04+00:00] INFO: Run List is [role[cinder-all]] [ T10:32:04+00:00] INFO: Run List expands to [osops-utils::packages, openssh, ntp, sosreport, rsyslog::default, hardware, osops-utils::default, cinder::cinder-api, cinder::cinder-scheduler, cinder::cinder-volume] --output truncated-- [ T16:23:34+00:00] INFO: Running report handlers [ T16:23:34+00:00] INFO: Report handlers complete When the process is complete, the new Cinder all-in-one node will be ready to use. 34

39 8. Configuring OpenStack Image Storage The Glance cookbook used for Rackspace Private Cloud supports OpenStack Image storage in the local file system, in OpenStack Object Storage (Swift), and in Rackspace Cloud Files. Note Local File Storage If you change the image storage location from Swift to Cloud Files (or vice versa), you must manually export and import the images. By default, OpenStack Image stores the image files locally on the controller node, and as long as you're using local file storage, you will not have to make any changes to your configuration. In the event that you need to switch from a different storage method to the local file system, follow these steps. 1. Log into the controller node and use sudo -i to switch to root access. 2. Define your text editor: $ export EDITOR=vi 3. Use knife to open the environment file for editing. $ knife environment edit rpcs 4. Add the following attributes to the environment. "glance": { "api": { "default_store": "file" }, "images": [ "cirros" ], "image_upload": true } 5. Run chef-client to commit the change. $ chef-client 35

40 Rackspace Cloud Files To use Rackspace Cloud Files for image storage, you must have an account. To sign up, visit the Rackspace Cloud Files web site. 1. Log into the controller node and use sudo -i to switch to root access. 2. Use the following command to obtain your Cloud Files tenant ID. $ curl -s -X POST \ -d '{"auth": {"passwordcredentials": {"cloud_files_username": "", \ "password": "cloud_files_password"}}}' \ -H "Content-type: application/json" python -mjson.tool \ grep "tenantid.*mosso" head -1 The output of this command will display on the screen. Copy and save the tenant ID. 3. Define your text editor: $ export EDITOR=vi 4. Use knife to open the environment file for editing. $ knife environment edit rpcs 5. Add the following attributes to the environment, using the tenant ID that you obtained in Step 2 and your Cloud Files username and password. "glance": { "api": { "default_store": "swift", "swift_store_user": "cloud_files_tenant_id:cloud_files_username", "swift_store_key": "cloud_files_password", "swift_store_auth_version": "2", "swift_store_auth_address": " 0" }, "images": [ "cirros" ], "image_upload": true }, 6. Run chef-client to commit the change. $ chef-client 36

41 Swift Storage To use Swift storage, you must have a Swift cluster configured in your environment. Refer to Rackspace Private Cloud OpenStack Object Storage Installation for more the process of creating and configuring a Swift cluster. 1. Log into the controller node and use sudo -i to switch to root access. 2. Define your text editor: $ export EDITOR=vi 3. Use knife to open the environment file for editing. $ knife environment edit rpcs 4. Add the following attributes to the environment. "glance": { "api": { "default_store": "swift" }, "images": [ "cirros" ], "image_upload": true } 5. Run chef-client to commit the change. $ chef-client 37

42 9. Rackspace Private Cloud Cookbook Update Procedure This section documents the master procedure for updating your Rackspace Private Cloud cookbooks to the latest version. Refer to it any time you need to perform a cookbook update. Download Current Cookbooks The public, read-only URL for the cookbooks is git://github.com/rcbops/chef-cookbooks.git Rackspace recommends that you log into the controller node and use git rev-parse before performing an upgrade: $ git rev-parse HEAD cut -b -6 Preparing the Nodes In the following procedure, you will prepare the nodes for installation and document the instances and images that are currently active. You will refer to this information at the end of the process to verify that the cookbook update was performed successfully. 1. Log into each controller and compute node via SSH and stop the chef-client service. $ service chef-client stop 2. Log into the controller node via SSH and switch to root user access with sudo -i 3. Make a copy of /root/.novarc. $ cp /root/.novarc /root/.novarc.bak 4. Document the instances and images that are active with the nova image-list, nova list, and nova-manage service list commands, as in the following example: $ nova image-list ID Name Status Server c0027-[id truncated] cirros-image ACTIVE 85a0a926-[id truncated] precise-image ACTIVE e07bb350-[id truncated] test_snap ACTIVE e555ac90-[id truncated] My Image ACTIVE

43 $ nova list ID Name Status Networks c5508f15-[id truncated] test ACTIVE public= $ nova-manage service list :26:05 Binary Host Zone Status State Updated_At nova-scheduler ctrl nova enabled :-) :26:03 nova-consoleauth ctrl nova enabled :-) :26:04 nova-network compute1 nova enabled :-) :25:55 nova-compute compute1 nova enabled :-) :26:01 Update the Cookbooks In the following procedure, you will update the cookbooks on the chef server. You must perform this procedure as the root user on the controller and compute nodes. To do so, log in with the OS user ID that you created during installation and use sudo -i to switch to root user access. 1. Navigate to the cookbook directory: $ cd /opt/rpcs/chef-cookbooks 2. Run the following git commands to pull the cookbook files. $ git checkout iso $ git pull $ git submodule init $ git submodule update 3. Run the following knife commands to update the cookbooks on the chef server. $ knife role from file roles/*.rb $ knife cookbook upload -a Run chef-client In the following procedure, you will run chef-client on each node, which will implement the cookbooks on each node. You must perform this procedure as the root user on the controller and compute nodes. To do so, log in with the OS user ID that you created during installation and use sudo -i to switch to root user access. 39

44 1. On the controller, run chef-client and start the chef-client service: $ chef-client $ service chef-client start 2. Log onto each compute node via SSH and run chef-client and start the chef-client service on each node. $ chef-client $ service chef-client start 3. Open /root/.novarc and compare the contents to.novarc.bak, created in Step 3 of Preparing the Nodes. 4. Verify that all services are running with the nova image-list, nova list, and nova-manage service list commands. The results should match the results obtained in Step 4 of Preparing the Nodes. 40

45 10. Glossary of Terms Alamo Cinder Compute Flavor Floating IP address Glance Image Keypairs Keystone MySQL Nova Quantum Rackspace project name for the Rackspace Private Cloud Software ISO. Project name for OpenStack Block Storage, which supersedes nova-volume. OpenStack Compute is a compute service that provides server capacity in the cloud. Compute Servers come in different flavors of memory, disk space, and CPU, and can be provisioned in minutes. Interactions with Compute Servers can occur programmatically via the OpenStack Compute API or the Dashboard. Flavor is an available hardware configuration for a server. Each flavor has a unique combination of disk space, memory capacity and priority for CPU time. A floating IP address is an IP address (typically public) that can be dynamically assigned to an instance. This address enables network address translation (NAT) and allows an instance to be accessed from outside the nova fixed network. Project name for the Image Service software, which is the main image repository piece of OpenStack, it is the place where you will be uploading your images as well as the place from which they will be consumed by the rest of the OpenStack system. Images are your templates for creating new virtual machines. The project under OpenStack that stores the available images is called Glance. These are simple ssh keys and are your credentials for accessing any running instances. Keypairs are added and managed using the Keypairs section of the user dashboard. Project name for the Identity service software, which offers an integrated identity management system for OpenStack. Initially using token-based authentication, but eventually supporting plug-in modules for identity storage (LDAP, DB, file, PAM, Active Directory, etc...), protocols (SAML, OAUTH, OpenID, etc...) Datastore that stores build-time and run-time state for a cloud infrastructure. Project name for the Compute service that provisions and manages large networks of virtual machines, creating a redundant and scalable cloud computing platform. Project name for the Network service, which provudes a network connectivity abstraction layer to OpenStack Compute. 41

46 Rabbit MQ Security Groups Server Swift Provides robust messaging for applications. It is completely open source and based on open standard protocols. Security groups at this time exist mostly as tags for the servers and can be consumed via the meta-data API via a simple curl command. Security groups can be specified as part of the "personality" of an instance. A server is a virtual machine instance in the compute system. Flavor and image are requisite elements when creating a server. Project name for the Object Storage service software, which provides consistent and redundant storage and retrieval of fixed digital content. 42