OpenStack
Introduction to OpenStack
Presenter: Chung Thuy Linh
Objective
● Understand OpenStack architecture and core components.
● Plan and design an OpenStack private cloud infrastructure.
● Install and configure OpenStack using all-in-one distribution
practices.
● Manage compute, storage, and networking resources in OpenStack.
● Automate OpenStack operations using command-line tools and
scripting.
05/2025 fit@hcmus 2
Objective
● Troubleshoot common OpenStack issues and ensure system stability.
● Implement security best practices in OpenStack deployments.
● Monitor OpenStack health and performance.
● Multi Node Design & Scaling OpenStack
05/2025 fit@hcmus 3
Open-source cloud platforms
05/2025 fit@hcmus 4
Introduction
• A software package that provides a cloud platform for Public and
Private cloud covering various use cases including Enterprise and
Telecom
• Built from a set of microservices which can be combined into different
setups based on the actual need.
• It controls large pools of compute, storage, and networking resources
throughout a datacenter, all managed through APIs or a dashboard
05/2025 fit@hcmus 5
Key benefits
• Cost saving
• Flecibility
• Scalability
• Security
• Community support
05/2025 fit@hcmus 6
OpenStack Use Cases
• Virtualizing research environments
• Delivering online learning courses
• Managing IT infrastructure
• Providing cloud computing services to students and faculty
• Hosting research applications
05/2025 fit@hcmus 7
Companies involved in OpenStack
05/2025 fit@hcmus 8
OpenStack Architecture Overview
05/2025 fit@hcmus 9
Key Components of OpenStack
Component Project Name Function
Compute Nova Manages virtual machines (VMs)
Networking Neutron Provides networking-as-a-service
Provides block storage (like volumes for
Storage (Block) Cinder
VMs)
Storage (Object) Swift Provides object storage (for large data)
Image Service Glance Stores and manages VM images
Centralized authentication and
Identity Keystone
authorization
Dashboard Horizon Web-based GUI for OpenStack
Telemetry Ceilometer / Gnocchi Collects metering and monitoring data
Automates deployment of infrastructure
Orchestration Heat
stacks
Manages physical servers like cloud
Bare Metal Provisioning Ironic
resources
Components
Interaction
Flow
05/2025 fit@hcmus 11
Horizone - Dashboard
• Horizon is the framework that provides a web-based interface
(Dashboard) for managing OpenStack services.
• Users can perform actions like launching instances or managing networks
via the Dashboard.
• Behind the scenes, Horizon sends API requests to OpenStack services using
RESTful APIs.
• Horizon supports all official OpenStack components, like Heat, and
automatically integrates them into the dashboard if properly installed.
• The Dashboard can be customized or branded by service providers.
• Supports both HTTP and HTTPS, though default installs use HTTP. SSL can
be enabled for secure access.
05/2025 fit@hcmus 13
Horizon - Workflow
Dashboard components:
• Openstack-dashboard
• Apache HTTP server
05/2025 fit@hcmus 14
Horizon - Example
05/2025 fit@hcmus 15
Compute service management - Nova
• The primary compute engine of OpenStack, responsible for instance
scheduling, creation and termination.
• In order to ensure widespread interoperability, Nova supports a wide
range of hypervisors, including QEMU/KVM, Hyper-V, VMware ESXi
and Xe
05/2025 fit@hcmus 16
The key components of a typical Nova
deployment
• DB: sql database, central storage for Nova metadata and state.
• API: handles external requests, communicates with other
components via the [Link] queue or HTTP.
• Scheduler: chooses the most suitable host for a VM based on policies
and resource availability.
• Compute: Manages VM lifecycle and interacts with the hypervisor on
each compute node.
• Conductor: Mediator for internal operations and DB access.
• Placement: tracks resource provider inventories and usages
05/2025 fit@hcmus 17
The key
components of a
typical Nova
deployment
05/2025 fit@hcmus 18
Networking service - Neutron
• Neutron is complex and powerful. Manages virtual and physical
networking for OpenStack environments. (Networking-as-a-Service)
• It allows to define internal networks, assign floating IPs for external
access, and set up firewalls or VPNs.
• Plugins can be implemented to accommodate different networking
equipment and software, providing flexibility to OpenStack
architecture and deployment
05/2025 fit@hcmus 19
Neutron concepts
Virtual Networking: can create networks, subnets, and routers like
physical devices
Network Types:
• External Network
• Internal Network
Routing: Routers connect internal and external networks
Floating Ips: Enables access from the Internet to internal VMs
Security Groups: Define allowed/blocked traffic per VM
Plug-ins: can be implemented to accommodate different networking
equipment and software
05/2025 fit@hcmus 20
Neutron: core resource concepts
Network: can create networks, subnets, and routers like physical
devices
Subnet: An IP address range (IPv4 or IPv6) and associated
configuration.
Port: Connection point to a network — for example, where a VM’s vNIC
plugs in. It includes MAC address, IP, and associated settings
05/2025 fit@hcmus 21
Core Components of OpenStack Networking
(Neutron)
05/2025 fit@hcmus 22
Network types:
Provider vs
Project
Provider Network: Direct L2
networks mapped to physical
infrastructure (often VLANs);
configured only by admins.
Routed provider networks: L3-
routed networks where routing is
done by physical infrastructure, not
Neutron.
Self-service (Project) networks: L3-
routed networks where routing is
done by physical infrastructure, not
Neutron.
05/2025 fit@hcmus 23
Advanced Networking Services
• DHCP Services via qdhcp agents using dnsmasq.
• Metadata Service for instances to retrieve instance-specific config
(e.g., SSH keys).
• Neutron Extensions support QoS (bandwidth control), Firewall-as-a-
Service (FWaaS), port security, and more.
05/2025 fit@hcmus 24
Image service - Glance
• Glance is the image service in OpenStack used to store and manage
virtual machine images
• Stable and simple: Glance is a mature and low-complexity service
with minimal recent development.
• Client-server architecture with a REST API interface
05/2025 fit@hcmus 25
Glance
Architecture
05/2025 fit@hcmus 26
Glance - Image Types
Some of supported image types:
• Raw
• Machine (kernel/ramdisk outside of image, also known as AMI)
• VHD (Hyper-V)
• VDI (VirtualBox)
• Qcow2 (Qemu/KVM)
• VMDK (VMWare)
• OVF (VMWare, others)
05/2025 fit@hcmus 27
Object Storage - Swift
• Swift is OpenStack’s object storage service, designed for high
availability and scalability.
• Stores files as immutable objects within containers (similar to AWS
S3 buckets).
• Swift doesn’t attach volumes to VMs. Instead, it provides a simple
HTTP API to upload (PUT) and download (GET) content by object
name.
• Renaming or modifying objects requires re-upload due to replication
architecture.
• No row-level locking or atomic updates—modifications overwrite
entire objects
05/2025 fit@hcmus 28
Object Storage characteristics
Feature Benefit
URL-based access Easy, direct access and addressability
Customizable durability via replication or erasure
Storage policies
coding
Zone-aware replication Fault tolerance—even across data centers
Self-describing objects Rich metadata without external tracking
REST API / S3 support Wide integration; universal client compatibility
Distributed architecture No central bottlenecks; failure isolation
Elastic scale-out Add/remove nodes on-demand; minimal disruption
Runs on commodity hardware with flexible deployment
Cost efficiency
options
05/2025 fit@hcmus 29
Swift – system
components
• Proxy Service
• Account Service
• Container Service
• Object Service
• Replication & consistency
checks
B. Mallikarjuna, "Open stack object storage (swift) architecture," ResearchGate, May 2018. [Online].
05/2025 fit@hcmus 30
Object Storage
building blocks
05/2025 fit@hcmus 31
Block storage - Cinder
• Cinder is OpenStack's block storage service, offering persistent
storage that can be attached to instances. Providing volumes to Nova
virtual machines, Ironic bare metal hosts, containers and more
• It provides lifecycle management of block storage (volumes): create,
resize, migrate, delete, snapshot, and backup.
• Exposes a self-service API for users to request storage resources
without needing to know backend details.
05/2025 fit@hcmus 32
Block storage - concepts
• Volumes: Block devices (like USB drives) attached to a VM, typically 1-
to-1. Not shared storage.
• Persistence: Volumes persist beyond the life of an instance and can
be re-attached to new VMs.
• Snapshots: Read-only point-in-time copies of volumes or instances;
can be used to restore or boot VMs.
• Backups: Archived volume copies stored in Swift (object storage);
used for restore operations.
05/2025 fit@hcmus 33
Cinder – Storage & Quota management
• Volume Types: Define storage backend characteristics (e.g., SSD vs
HDD); used to match performance or cost requirements.
• Supports backends like LVM, Ceph, GlusterFS, and hardware
appliances via plugins.
• Volumes are typically attached to compute nodes via iSCSI.
• Admins can enforce quotas per project:
• Number of volumes
• Total allocated storage (in GB)
• Number of snapshots
05/2025 fit@hcmus 34
Cinder -
Architecture
05/2025 fit@hcmus 35
Identity Service - Keystone
• In a multi-service cloud like OpenStack, each component (e.g., Nova,
Glance, Neutron) needs to trust a central identity source to:
• Avoid managing separate user databases.
• Allow a single user identity to work across all services.
• Keystone is the central identity service in OpenStack. It handles:
Authentication, Authorization and maintains a service catalog (where
services are located)
05/2025 fit@hcmus 36
Keystones
architecture
Keystone is
organized as a
group of internal
services exposed
on one or many
endpoints
Shrivastwa, A., Sarat, S., Jackson, K., Bunch, C., Sigler, E., & Campbell, T. (2016). OpenStack: Building a Cloud Environment
05/2025 fit@hcmus 37
Keystone: How to identity?
05/2025 fit@hcmus 38
Orchestration with Heat
• Heat is used to automate the deployment and management of cloud
infrastructure using templates (Heat Orchestration Templates - HOTs).
• These templates describe how to provision resources such as
compute, storage, and networking in a repeatable and controlled way
05/2025 fit@hcmus 39
• Templates are written in YAML format (HOT) and specify:
Heat Orchestration • Parameters (customizable inputs)
Templates - HOTs • Resources (instances, volumes, etc.)
• Resource relationships (e.g., attach volume to VM)
05/2025 fit@hcmus 40
05/2025 fit@hcmus 41
Monitoring & Logging tools
• Telemetry (mainly using Ceilometer) collects usage data across
OpenStack services.
• This data supports billing, resource monitoring, and event-based
alerting
05/2025 fit@hcmus 42
Monitoring &
Logging tools
Telemetry components
• Compute agent
• Central agent
• Notification agent
05/2025 fit@hcmus 43
Monitoring & Logging tools
05/2025 fit@hcmus 44
Shared network (OpenStack Manila)
• A share network encapsulates the network configurations (network,
subnet, security services if any) that Manila's share servers use when
hosting file shares
• It is required when using share types that have
driver_handles_share_servers=True, enabling hard multi-tenancy in file
services
• Key Attributes of a Share Network
• neutron_net_id and neutron_subnet_id—identifiers of the Neutron network and its
subnet.
• Network type (vlan, vxlan, gre, or flat), segmentation_id, CIDR, and IP version—
automatically inherited from the Neutron network/subnet provider
05/2025 fit@hcmus 45
Security in OpenStack
• Identity and Access Control
• Network Isolation and Protection
• Securing the Message Queue
• Data Encryption
• Operating System and Container Security
• Monitoring and Security Logging
05/2025 fit@hcmus 46
OpenStack deployment options
• Manual deployment (very complex, not recommended for beginners)
• DevStack (developer environment)
• Packstack (easy all-in-one deployment)
• Kolla-Ansible (Docker-based production-ready)
• OpenStack-Ansible (for complex deployments)
05/2025 fit@hcmus 47
Multi Node design – Scaling OpenStack
OpenStack can run on:
• A single-node (all-in-one) setup for development/testing.
• Massive multi-node environments
• All-in-one is suitable for testing or upstream development but does
not scale for production.
Scaling method
• Horizon Scaling (Scale out)
• Vertical Scaling (Scale up)
05/2025 fit@hcmus 48
Multi Node
design -
Example
05/2025 fit@hcmus 49
Architecture Example
• General Purpose
• Compute Focused
• Storage Focused
• Data Analytics
• High-performance
• Network Focused
• Large-Scale Web-Application
• Cloud Storage & Backup
05/2025 fit@hcmus 50