Open stack is set of software tools for building and managing cloud computing platform for public and
private clouds
Open stack is free and opensource platform for cloud computing mostly deployed as infrastructure as
service where by virtual servers and other resources are made available to customers.
Linux bridge: A network device that connects more that one LAN segment at layer 2.
Its can be created in network configuration files or using brctl cli.
#brctl addbr br1
#brctl addif br1 eth0
Use a single Linux bridge per physical host
Attached to single physical nic
Vm’s share same layer network
Multihost Networking:
Nova network daemon was added to nova compute host
Routing moved to central server to each compute node which prevents single point of failure at Layer 3
Features of Multihost Networking:
Nova network can manage IP address assignments to Linux bridges, instances in nova database
Removed single point of failure for L3 services
Instances on both compute node access external network independently using Linux bridge as default
gateway
Kernel routing tables are created to decide if packet should be nated to eth1 or sent via eth0
Limitations:
Add complexity & additional load on each compute node
Requires 2 physical Nics on compute host
Fixed IP’s:
They are used for communication between instances and to external networks
Cannot be used to access instance from external network
Assigned to each instance at boot time
Uses private IP ranges such as [Link] & [Link]
Floating IP’s:
They are allocated and associated to instances by users
Are publicly routable IP address configured by admin
Accessible from external network
Address pools can be from one or more internet providers
Floating IP is added as secondary IP to compute node’s public interface
Dnat rule redirects floating IP to fixed IP
This is created and managed by Nova-network
[Link]: set auto-assign floating-ip=true – To allocate floating IP automatically
Accessing Internet with out floating IP:
IP for eth1 is compute host’s default gateway
Routing table is consulted to route traffic from instance to eth1
Source Nat is applied to public IP for compute host in iptables
Neutron:
Tenants now able to have their own individual networks which can be created and managed by users
Users create tenant network for connectivity with in projects
They are fully isolated by default and are not shared with other projects
Networking support a range of types:
1) Flat: All instances reside on same network, which can be also shared with the hosts
No vlan tagging or other network segregation takes place
What does Network manager do ?
1) Creates Linux bridges
2) Plug instances to Linux bridge
3) Allocate IP to instances
4) Provides Dhcp services for instances
5) Place IP network configuration on instances
6) Configure Vlan interfaces on compute host
7) Filter traffic provides external connectivity to instances
Why do we move away from nova network:
Functionality requirement and release were tightly integrated with nova
Network were reliant on admins for management
Tenant were restricted due to single network per VM
Lack of plugins available in architechture means modifying network management code
What does Neutron add:
Introduces network component that allows network topologies to be created with in tenant
Tenants now able to have there own individual network which can be created and managed by users
Allows API extension and addition to new agents including L2, L3 and dhcp
Tenant noew have an api to build n/w topologies and configure advance n/w policies
Support for local, flan,vlan and multiple tunneling protocols sucha s GRE and VLXAN
Users create tenant network for connectivity with in projects that are fully isolated by default and are
not share with other projects
VXLAN and GRE:
It uses network overlay to support private communication between instances
A network router is required to enable traffic to traverse outside of gre or vlan tenant network
A router is also required to directly connect tenant network with external network including internet,
the router provides ability to connect to instance directly from external network using floating IP
address
Provider Network: By default only admins can create or update provide networks because they are
required for configuration of physical network
Openstack networking handles creation and management of virtual networking infrastructure including
networks, switches, subnets, routers and advanced services like firewall and vpn can be used
Neutron consists of neutron server and as database for persistent storage and any number of plugin
agent.
Neutron can be deployed on dedicated host or controller
Neutron server service accepts and routes request through message Queue to database and openstack
networking plugins
Networking integrates with openstack components in number of ways:
Networking relies on identity service(keystone) for authentication and authorization of all api requests
Nova interacts with networking through calls to standard api
As part of creating a vm, nova-compute service communicates with networking api to plug each virtual
nic on VM into particular network
Horizon integrated with networking api enabling admins and tenant users to create and manage
network services through a web based GUI
ML2 plugin mechanism Manage:
1) Hyper-V
2) Linux Bridge
3) Opendaylight
4) Open vswitch
Neutron provides api that allows users to setup and define network connectivity. Neutron allows
management and creation of virtual networking infrastructure including networks, switches, routers,
subnets. Advance services like firewall and vpn can be used
Neutron can be directly deployed on host on controller host
Neutron service accepts and routes the request
Neutron Linux bridge agent receives commands from neutron server and sends to Linux bridge for
execution
Neutron openswitch agent receives commands from neutron and sends them to openvswitch or ovs for
execution.
Neutron Dhcp agent manages dnsmasq service
Openstack Networking:
1) Provider networks: offers layer 2 connectivity to instances with optional support for dhcp &
metadata services
2) Router Provided networks: Provides Layer 3 connectivity to instances. Two hosts that are
connected to same switch but on different vlans don’t see each other traffic
3) Self service network
1) Flat: All instances reside on same network which can be also share with the hosts
No vlan tagging or other network seggration takes places
Its also provides dhcp service and metadata to instances
Networking service implements routers using layer 3 agent
Typically resides on one network node
Users create project networks for connectivity between projects. By default they are fully
isolated and not shared to other project
2) Vlan: Networking allows users to create multiple provider or project network using vlan
ID(802.1Q tagged) that corresponds to vlan present in physical network
Vlan allows instances to communicate with each other in the environment
They can also be communicated with dedicated servers, firewall, Load balancer and other
network devices
3) Local: Instances reside on local compute host and are effectively isolated from any external
networks
4) VLans & GRE: They are encapsulating protocols that creates overlay network to activate and
control communication between compute instances
Subnets: A block of IP address and associated configuration states
Subnets are sued to allocate IP addresses when endpoints are created on network
Subnet Pools: end users normally can create subnets with only valid IP address without
other restrictions
In some cases, they are predefined pool of IP address from which need to create subnets
with automatic allocation
5) Routers: Router provider virtual layer 3 services such as routing and NAT between self
service and provider network or among self-service networks belonging to a project
6) Security-group: provides a container for virtual firewall rules that control ingress(Inbound to
instances), egress(outbound from instances), network traffic at port level
Uses a default deny policy and only contain rules that allow specific traffic
Security groups are firewall for instance, each project contains default security groups that
allows all ingress traffic and denies all egress traffic
Security groups are stable thus enabling ingress tcp port 22 automatically
Creates roles
DHCP: Hosts connected to a network use dhcp to automatically obtain IP address
Dhcp server hands out the IP address to network hosts which are dhcp clients
Openstack uses 3rd party program called dnsmasq to implement dhcp server
Dnsmasq writes to the syslog
Keystone:
Openstack identity service provides single point of integrating authentication, authorization and service
catalog.
Once the user is authenticated they have user identity to access other open stack services and other
services can verify users and check the status of other services with in deployment.
Users and services can verify other services by catalog managed by identity service.
Service catalog is collection of available services in openstack deployment, each service has one or many
endpoint and one endpoint can be one of 3 types, admin, internal and public.
For instance the public api network might be visible from internet so customer can manage the clouds.
The admin api network might be restricted to operate with in organization that manage cloud
infrastructure.
The internal API network might be restricted to host that contain openstack services also openstack
supports multiple regions for scalability
Each open stack service in deployment enters corresponding entry in identity service .
Roles: are the permission given by users to interact within project
A first class piece of metadata associated with the user for a project. It is assigned directly to users or
groups or projects or inherit from domain.
Users:
Used by services and administrator to manage the openstack cloud.
A digital representation of person, system, or service who uses openstack services.
Keystone validates the incoming requests are made by users who claim to be making the call
Have a login and may be assigned a token to access resources
Must be assigned to project and be assigned a role
Credentials:
Data that is known only by the user that proves who they are, such as username and password, a
username and API key, or an auth token
Identifying credentials associated with a user, an arbitrary bit of text that is used to access resources.
A token may be revoked at any time and is valid for a finite duration.
While openstack identity supports token based authentication, the intention is to support additional
protocols in future.
Group: Group is collection of users
Services:
Refers to service running in openstack such as compute, etc
Provided by one or more endpoints in which users can access resources and perform operations
Endpoints:
Network accessible address where you can access a given service via URL and port
Can be configured to service request on three URL’s, A public facing URL, an administrator URL, and
internal URL.
Public facing URL – used by endusers
Admin url: users with admin can use, they might have different URL
Internal URL: is used between openstack services
Domain: Collection of projects, groups, and users that define the administrative boundaries for
managing openstack identity entities.
Region:
Separates the openstack environments that have dedicated API endpoints but utilize common keystone
service
Catalog: listing of different endpoints that have been created for openstack services
User want to launch the instance and sends credentials to keystone and a temporary token is created
and authenticated catalog is sent back, the user then requests all the tenants, a temporary token is sent
back along with the request, user send the credentials along with desired tenant and keystone sends
back the list of available services and keystone token.
User then makes the request which goes to services endpoint, the service verifies user token, keystone
stone provides the extra information and token and user is authorized to access the service, keystone
check the token matches the request and token belongs to user
The service then validates the request again its policies to make sure user is allowed
The service then executes the request which is to create a new instance and service reports status back
to user.
Now instance has been created and instance is reachable
#openstack service-list
#openstack service create –name test –decription “test” image(type)
#Openstack service delete name
#openstack service show test
Endpoint:
#openstack endpoint create –region Regionone image admin [Link]
#openstack endpoint list –service image
#openstack endpoint show ID
Project:
#openstack user list
#keystone user-list
#openstack project create –description “project” records
Nova/Quotas/Security groups
To display the services in openstack
#nova service list
To list the all the endpoints:
# nova endpoints
To display keypairs
# nova keypair-list
To view flavors:
# nova flavor-list
To add flavor to project:
#nova flavor-access-add flavor name tenant id
To delete a flavor
#nova flavor-delete flavor id
To check for default Quotas for all tenants
#nova quota-defaults
To update nova quota key values for defaults:
#nova quota-class-update --instances 20 default
To check the key values Quota for project:
#nova quota-show --tenant tenant id
To update the key value quota for tenant
#nova quota-update --instances 15 tenant id
# nova quota-update --floating_ips 15 tenant id
To check user quota values for tenant
#nova quota-show --user userid --tenant tenant id
To update key value quota for user for particular tenant
#nova quota-update --user userid --cores 10 tenant id
To check the maximum key value quota can be used for tenant
#nova absolute-limits --tenant tenant name
To list security groups:
#nova secgroup-list
To view any of security group rules
#nova secgroup-list-rules security group name
To create new security group
#nova secgroup-create name "comments"
To add rules to security group
#nova secgroup-add-rule security group name protocol from port to port IP Range
Ex: #nova secugroup-add-rule webserver tcp 80 80 [Link]/0
To see all security group rules for security group
#nova secgroup-list-rules security group name
Ex: #nova secgroup-list-rules webserver
To delete security group
#nova secgroup-delete secgroup name
To create a instance:
#nova boot --flavor [Link] --image image name instance name
To list the VM's
#nova list
To Assign security group to instance:
#nova add-secgroup instance name security group name
EX: #nova add-secgroup instance1 webserver
To remove security group for instance:
#nova remove-secgroup instance name security group name
EX: nova remove-secgroup instance1 webserver