What is OpenStack?

 OpenStack is a cloud operating system

that controls large pools of compute,
storage, and networking resources
throughout a datacenter, all managed
through a dashboard that gives
administrators control while empowering
their users to provision resources
through a web interface.
OPENSTACK CAPABILITY

Softwareas Service (SaaS)

Browser or Thin Client access

Platformas Service (PaaS)

On top of IaaS e.g. Cloud Foundry

Infrastructure
as Service (IaaS)
Provision Compute, Network, Storage
OpenStack Capability

 Virtual Machine (VMs) on demand

 Provisioning
 Snapshotting
 Network
 Storage for VMs and arbitrary files
 Multi-tenancy
 Quotas for different project, users
 User can be associated with multiple
projects
OpenStack Major Components
High-level overview of the
OpenStack core services
Service - Compute

 Project - Nova
 Manages the lifecycle of compute
instances in an OpenStack environment.
Responsibilities include spawning,
scheduling and decommissioning of virtual
machines on demand.
Compute
 OpenStack Compute serves as the core of the OpenStack
cloud by providing virtual machines on demand. Compute
schedules virtual machines to run on a set of nodes by
defining drivers that interact with underlying virtualization
mechanisms, and by exposing the functionality to the other
OpenStack components.
 Compute supports the libvirt driver libvirtd that uses KVM
as the hypervisor. The hypervisor creates virtual machines
and enables live migration from node to node. To provision
bare metal machines, youcan also use OpenStack Bare Metal
Provisioning .
 Compute interacts with the Identity service to authenticate
instance and database access, with the Image service to
access images and launch instances, and with the dashboard
service to provide user and administrative interface.
Red Hat OpenStack Platform cloud,
categories
Regions
 Each service cataloged in the Identity service
is identified by the service region, which
typically represents a geographical location,
and the service endpoint. In a cloud with
multiple compute nodes, regions enable
discrete separation of services.
 You can also use regions to share
infrastructure between Compute
installations while maintaining a high degree
of failure tolerance.
Red Hat OpenStack Platform cloud,
categories
Host Aggregates & Availability Zones
 A single Compute deployment can be partitioned into logical
groups. You can create multiple groupsof hosts that share
common resources such as storage and network, or groups
that share a special property such as trusted computing
hardware.
 To administrators, the group is presented as a Host
Aggregate with assigned compute nodes and associated
metadata. The Host Aggregate metadata is commonly used to
provide information for openstack-nova-scheduler actions,
such as limiting specific flavors or images to a subset of
hosts.
 To users, the group is presented as an Availability Zone. The
user cannot view the group metadata or see the list of hosts
in the zone.
OpenStack Bare Metal
Provisioning (ironic)
 OpenStack Bare Metal Provisioning enables
the user to provision physical, or bare metal
machines, for a variety of hardware vendors
with hardware-specific drivers.
 Bare Metal Provisioning integrates with the
Compute service to provision the bare
metal machines in the same way that virtual
machines are provisioned, and provides a
solution for the bare-metal-to-trusted-
tenant use case.
OpenStack Baremetal Provisioning
advantages
 Hadoop clusters can be deployed on bare
metal machines.
 Hyperscale and high-performance
computing (HPC) clusters can be
deployed.
 Database hosting for applications that are
sensitive to virtual machines can be used.
Interaction of Ironic and other OpenStack services when a physical
server is being provisioned
Service - Networking

 Project - Neutron

 Enables Network-Connectivity-as-a-Service for

other OpenStack services, such as OpenStack
Compute.
 Provides an API for users to define networks
and the attachments into them.
 Has a pluggable architecture that supports
many popular networking vendors and
technologies.
Service - Networking
 OpenStack Networking handles creation and management of
a virtual networking infrastructure in the OpenStack cloud
(networks, subnets, and routers). You can also deploy
advanced services such as firewalls or virtual private
networks (VPN).
 OpenStack Networking provides cloud administrators with
flexibility to decide which individual services to run on which
physical systems. All service daemons can be run on a single
physical host for evaluation purposes. Alternatively, each
service can have a unique physical host or replicated across
multiple hosts to provide redundancy.
 Because OpenStack Networking is software-defined, it can
react in real-time to changing network needs, such as
creation and assignment of new IP addresses.
OpenStack Networking advantages
 Users can create networks, control traffic, and connect
servers and devices to one or more networks.
 Flexible networking models can adapt to the network
volume and tenancy.
 IP addresses can be dedicated or floating, where floating IPs
can be used for dynamic traffic rerouting.
 If using VLAN networking, you can use a maximum of 4094
VLANs (4094 networks), where 4094 = 2^12 (minus 2
unusable) network addresses, which is imposed by the 12-bit
header limitation.
 If using VXLAN tunnel-based networks, the VNI (Virtual
Network Identifier) can use a 24-bit header, which will
essentially allow around 16 million unique
addresses/networks.
Service - Object storage

 Project - Swift

 Stores and retrieves arbitrary unstructured data

objects via a RESTFul, HTTP based API.
 It is highly fault tolerant with its data replication
and scale-out architecture. Its implementation is
not like a file server with mountable directories.
 In this case, it writes objects and files to multiple
drives, ensuring the data is replicated across a
server cluster.
Object storage
 Object Storage provides an HTTP-accessible
storage system for large amounts of data,
including static entities such as videos, images,
email messages, files, or VM images.
 Objects are stored as binaries on the underlying
file system along with metadata stored in the
extended attributes of each file.
 The Object Storage distributed architecture
supports horizontal scaling as well as failover
redundancy with software-based data replication.
Because the service supports asynchronous and
eventual consistency replication, you can use it in
a multiple data-center deployment.
OpenStack Object Storage
advantages
 Storage replicas maintain the state of objects in case
of outage. A minimum of three replicas
isrecommended.
 Storage zones host replicas. Zones ensure that each
replica of a given object can be stored separately. A
zone might represent an individual disk drive, an array,
a server, a server rack, or even an entire data center.
 Storage regions can group zones by location. Regions
can include servers or server farms that are usually
located in the same geographical area. Regions have a
separate API endpoint for each Object Storage
service installation, which allows for a discrete
separation of services.
Service- Block storage
 Project- Cinder

 Provides persistent block storage to

running instances.
 Its pluggable driver architecture facilitates
the creation and management of block
storage devices.
Block storage
 OpenStack Block Storage provides persistent block storage
management for virtual hard drives. Block Storage enables
the user to create and delete block devices, and to manage
attachment of block devices to servers.
 The actual attachment and detachment of devices is handled
through integration with the Compute service. You can use
regions and zones to handle distributed block storage hosts.
 You can use Block Storage in performance-sensitive
scenarios, such as database storage or expandable file
systems. You can also use it as a server with access to raw
block-level storage.
 Additionally, you can take volume snapshots to restore data
or to create new block storage volumes. Snapshots are
dependent on driver support.
OpenStack Block Storage
advantages
 Creating, listing and deleting volumes and
snapshots.
 Attaching and detaching volumes to
running virtual machines.
Service - Identity

 Project - Keystone
 Provides an authentication and
authorization service for other
OpenStack services.
 Provides a catalog of endpoints for all
OpenStack services.
Identity
 OpenStack Identity provides user authentication and
authorization to all OpenStack components. Identity
supports multiple authentication mechanisms, including user
name and password credentials, token based systems, and
AWS-style log-ins.
 By default, the Identity service uses a MariaDB back end for
token, catalog, policy, and identity information. This back end
is recommended for development environments or to
authenticate smaller user sets.
 You can also use multiple identity back ends concurrently,
such as LDAP and [Link] can also use memcache or Redis
for token persistence.
 Identity supports Federation with SAML. Federated Identity
establishes trust between Identity Providers (IdP) and the
services that Identity provides to the end user.
OpenStack Identity advantages
 User account management: including associated information
such as a name and password. In addition to custom users, a
user must be defined for each cataloged service.
 Tenant, or project, management : Tenants can be the user
group, project, or organization.
 Role management: Roles determine the user permissions. For
example, a role might differentiate between permissions for a
sales rep and permissions for a manager.
 Domain management: Domains determine the administrative
boundaries of Identity service entities, and support multi-
tenancy, where a domain represents a grouping of users,
groups, and tenants. A domain can have more than one
tenant, and if you use multiple concurrent Identityproviders,
each provider has one domain.
Service - Image service

 Project - Glance

 Stores and retrieves virtual machine disk

images.
 OpenStack Compute makes use of this
during instance provisioning.
Image service
 OpenStack Image acts as a registry for
virtual disk images. Users can add new
images or take a snapshot of an existing
server for immediate storage.
 The snapshots can be used for backup or as
templates for new servers.
 Registered images can be stored in the
Object Storage service or in other locations,
such as simple file systems or external Web
servers.
Service - Telemetry

 Project - Ceilometer

 Monitors and meters the OpenStack

cloud for billing, benchmarking, scalability,
and statistical purposes.
Telemetry
 OpenStack Telemetry provides user-level usage data
for OpenStack-based clouds. The data can be used for
customer billing, system monitoring, or alerts.
 Telemetry can collect data from notifications sentby
existing OpenStack components such as Compute
usage events, or by polling OpenStack infrastructure
resources such as libvirt.
 Telemetry includes a storage daemon that
communicates with authenticated agents through a
trusted messaging system to collect and aggregate
data. Additionally, the service uses a plug-in system
that you can use to add new monitors.
 The service uses a MongoDB database to store
collected data.
Service - Dashboard

 Project - Horizon
 Provides a web-based self-service portal
to interact with underlying OpenStack
services, such as launching an instance,
assigning IP addresses and configuring
access controls.
Dashboard
 OpenStack Dashboard provides a graphical
user interface for users and administrators
to perform operations such as creating and
launching instances, managing networking,
and setting access control.
 The Dashboard service provides the Project,
Admin, and Settings default dashboards. The
modular design enables the dashboard to
interface with other products such as billing,
monitoring, and additional management
tools.
Architecture of Openstack
Auth Token Usage
Provisioning Flow
 Nova API makes [Link] to Scheduler. It publishes a short message to
scheduler queue with VM info.
 Scheduler picks up the message from MQ.
 Scheduler fetches information about the whole cluster from database,
filters, selects compute node and updates DB with its ID
 Scheduler publishes message to the compute queue (based on host ID) to
trigger VM provisioning
 Nova Compute gets message from MQ
 Nova Compute makes [Link] to Nova Conductor for information on VM
from DB
 Nova Compute makes a call to Neutron API to provision network for the
instance
 Neutron configures IP, gateway, DNS name, L2 connectivity etc.
 It is assumed a volume is already created. Nova Compute contacts Cinder
to get volume data. Can also attach volumes after VM is built.
Nova Compute Driver
Nova scheduler filtering
Neutron Architecture
Glance Architecture
Cinder Architecture
Keystone Architecture
OpenStack Storage Concepts
Ephemeral storage:
 Persists until VM is terminated
 Accessible from within VM as local file system
 Used to run operating system and/or scratch space
 Managed by Nova

Block storage:
 Persists until specifically deleted by user
 Accessible from within VM as a block device (e.g. /dev/vdc)
 Used to add additional persistent storage to VM and/or run operating system
 Managed by Cinder

Object storage:
 Persists until specifically deleted by user
 Accessible from anywhere
 Used to add store files, including VM images
 Managed by Swift
Summary

 Users log into Horizon and initiates VM creation

 Keystone authorizes
 Nova initiates provisioning and saves state to DB
 Nova Scheduler finds appropriate host
 Neutron configures networking
 Cinder provides block device
 Image URI is looked up through Glance
 Image is retrieved via Swift
 VM is rendered by Hypervisor