OpenStack Cloud Application Developmentindex-of.co.uk/Cloud-Technology/Openstack Cloud Application...
Transcript of OpenStack Cloud Application Developmentindex-of.co.uk/Cloud-Technology/Openstack Cloud Application...
CONTENTSINTRODUCTION
WHOTHISBOOKISFOR
WHATTHISBOOKCOVERS
HOWTHISBOOKISSTRUCTURED
WHATYOUNEEDTOUSETHISBOOK
CONVENTIONS
SOURCECODE
ERRATA
P2P.WROX.COM
PARTIOPENSTACKOVERVIEW
1INTRODUCINGOPENSTACK
WHATISCLOUDCOMPUTING?
WHYSHOULDICARE?
UNDERSTANDINGTHEARCHITECTURE
SUMMARY
2UNDERSTANDINGTHEOPENSTACKECOSYSTEM:COREPROJECTS
IDENTITY
COMPUTE
STORAGE
IMAGING
DASHBOARD
NETWORKING
BRINGINGITALLTOGETHER
SUMMARY
3UNDERSTANDINGTHEOPENSTACKECOSYSTEM:ADDITIONALPROJECTS
OPENSTACKHEAT
OPENSTACKDATABASEASASERVICE:TROVE
DESIGNATE:DNSASASERVICE
MAGNUM
MURANO:APPLICATIONASASERVICE
CEILOMETER:TELEMETRYASASERVICE
SUMMARY
PARTIIDEVELOPINGANDDEPLOYINGAPPLICATIONSWITH
OPENSTACK
4APPLICATIONDEVELOPMENT
CONVERTINGALEGACYAPPTOANOPENSTACKAPP
BUILDINGAPPSFROMSCRATCH
OPENSTACKAPPDESCRIPTIONANDDEPLOYMENTSTRATEGIES
SUMMARY
5IMPROVINGONTHEAPPLICATION
FAILURESCENARIOS
HOSTNAMEANDIPADDRESSING
SCALING
IMPROVINGOURAPPLICATION
SUMMARY
6DEPLOYINGTHEAPPLICATION
BAREMETAL,VIRTUALMACHINES,ANDCONTAINERS
ORCHESTRATIONANDCONFIGURATIONMANAGEMENT
MONITORINGANDMETERING
ELASTICITY
UPDATINGANDPATCHING
SUMMARY
BOOKWRAPUP
TITLEPAGE
COPYRIGHT
ABOUTTHEAUTHOR
ABOUTTHETECHNICALEDITORS
CREDITS
ACKNOWLEDGMENTS
EULA
ListofIllustrationsChapter1
Figure1.1
Figure1.2
Figure1.3
Figure1.4
Figure1.5
Figure1.6
Chapter2
Figure2.1
Figure2.2
Figure2.3
Figure2.4
Figure2.5
Figure2.6
Figure2.7
Figure2.8
Figure2.9
Figure2.10
Figure2.11
Figure2.12
Figure2.13
Chapter3
Figure3.1
Figure3.2
Figure3.3
Figure3.4
Figure3.5
Figure3.6
Figure3.7
Figure3.8
Figure3.9
Figure3.10
Figure3.11
Figure3.12
Figure3.13
Chapter4
Figure4.1
Figure4.2
Figure4.3
Figure4.4
Figure4.5
Figure4.6
Chapter5
Figure5.1
Figure5.2
Figure5.3
Figure5.4
Figure5.5
Figure5.6
Figure5.7
Figure5.8
Figure5.9
Figure5.10
Chapter6
Figure6.1
Figure6.2
Figure6.3
Figure6.4
Figure6.5
INTRODUCTIONOpenStackisasetofsoftwarepackagesthatmanagevirtualizedresources,includingcomputing,networking,andstorage.Itenablesyoutocreateanddestroyvirtualmachines,connectthemtogetherwithprivatenetworks,providenetwork-basedstorage,andmakethemavailabletotherestofyournetworkandtheworld.OpenStackprovidesconsistent,uniformAPIservicesforallofthis,hidinghypervisorandvendorspecificdetailsfromtheapplicationsthatareusingtheAPIs.Italsoprovidesauserinterface,builtontopofthesameAPIs,thatallowsuserstoseeandmanagetheirvirtualresources.
WHOTHISBOOKISFORThisbookisforapplicationdevelopersthatareinterestedinlearningmoreaboutOpenStackandhowitwilltransformtheapplicationdesignanddevelopmentprocess.Itisforsomeonewhoisnewtothecloudenvironment,whowantsabroadunderstandingofthatenvironment,aswellasadeepenoughknowledgetomakepracticaluseofOpenStack.
WHATTHISBOOKCOVERSThisbookwillprovideabroadunderstandingofcloudconceptsandhowtheyfitintothelifeofanapplicationdeveloper.ItwilldrillindeeplytotheOpenStackservicesthataremostimportanttoanapplicationdeveloper,andshowyouhowtheseserviceswillchangenotonlyhowyoudeployapplications,butalsohowyoudesignthem.Itwillprovidedetailedinformationoneachservice,andprovideexamplesofhoweachservicemaybeusedbyanapplicationdeveloper.
HOWTHISBOOKISSTRUCTUREDThisbookwaswrittenintwoparts.Part1providesanoverviewofOpenStack.Thepurposeofthispartistolaythegroundwork,coveringalloftheOpenStacktechnologiesandwhatismostimportant.
Part2takesthereaderthroughdevelopinganddeployingapplicationswithOpenStack.InthispartyouwillbuildanexampleontopofOpenStackthatdrillsdownmuchdeeperonthetechnologies,providestips,andhelpsyoulearnaboutOpenStackthroughthelensofthesesametechnologies.
Hereisalistofthechapters:
PartI:OpenStackOverview
Chapter1:IntroductiontoOpenStack
Chapter2:UnderstandingtheOpenStackEcosystem:CoreProjects
Chapter3:UnderstandingtheOpenStackEcosystem:AdditionalProjects
PartII:DevelopingandDeployingApplicationswithOpenStack
Chapter4:ApplicationDevelopment
Chapter5:ImprovingontheApplication
Chapter6:DeployingtheApplication
WHATYOUNEEDTOUSETHISBOOKYoushouldunderstandthebasicsofapplicationdevelopment-howapplicationsarecomposedofmultipleserverslikewebservers,applicationservers,anddatabaseservers.Youdonotneedanycloud-specificknowledge,thoughyoushouldbeawareofwhatvirtualizationandvirtualmachinesare,andhaveabasicunderstandingofnetworks.
CONVENTIONSTohelpyougetthemostfromthetextandkeeptrackofwhat’shappening,we’veusedanumberofconventionsthroughoutthebook.
Examplesthatyoucandownloadandtryoutforyourselfgenerallyappearinaboxlikethis:
EXAMPLETITLEThissectiongivesabriefoverviewoftheexample.
Source
Thissectionincludesthesourcecode.
Sourcecode
Sourcecode
Sourcecode
Output
Thissectionliststheoutput:
Exampleoutput
Exampleoutput
Exampleoutput
NOTENotesindicatesnotes,tips,hints,tricks,orandasidestothecurrentdiscussion.
Asforstylesinthetext:
Wehighlightnewtermsandimportantwordswhenweintroducethem.
Weshowcodewithinthetextlikeso:persistence.properties.
SOURCECODEAsyouworkthroughtheexamplesinthisbook,youmaychooseeithertotypeinallthecodemanually,ortousethesourcecodefilesthataccompanythebook.Allthesourcecodeusedinthisbookisavailablefordownloadatwww.wrox.com.Specificallyforthisbook,thecodedownloadisontheDownloadCodetabat:
www.wrox.com/go/openstackcloudappdev
andat:
https://github.com/johnbelamaric/openstack-appdev-book
Youcanalsosearchforthebookatwww.wrox.combyISBN(theISBNforthisbookis978-1-119-19431-6)tofindthecode.AndacompletelistofcodedownloadsforallcurrentWroxbooksisavailableatwww.wrox.com/dynamic/books/download.aspx.
NoteBecausemanybookshavesimilartitles,youmayfinditeasiesttosearchbyISBN;thisbook’sISBNis978-1-119-19431-6.
Onceyoudownloadthecode,justdecompressitwithyourfavoritecompressiontool.Alternately,youcangotothemainWroxcodedownloadpageatwww.wrox.com/dynamic/books/download.aspxtoseethecodeavailableforthisbookandallotherWroxbooks.
ERRATAWemakeeveryefforttoensurethattherearenoerrorsinthetextorinthecode.However,nooneisperfect,andmistakesdooccur.Ifyoufindanerrorinoneofourbooks,likeaspellingmistakeorfaultypieceofcode,wewouldbeverygratefulforyourfeedback.Bysendinginerrata,youmaysaveanotherreaderhoursoffrustration,andatthesametime,youwillbehelpingusprovideevenhigherqualityinformation.
Tofindtheerratapageforthisbook,goto
www.wrox.com/go/openstackcloudappdev
AndclicktheErratalink.OnthispageyoucanviewallerratathathasbeensubmittedforthisbookandpostedbyWroxeditors.
Ifyoudon’tspot“your”errorontheBookErratapage,gotowww.wrox.com/contact/techsupport.shtmlandcompletetheformtheretosendustheerroryouhavefound.We’llchecktheinformationand,ifappropriate,postamessagetothebook’serratapageandfixtheprobleminsubsequenteditionsofthebook.
P2P.WROX.COMForauthorandpeerdiscussion,jointheP2Pforumsathttp://p2p.wrox.com.TheforumsareaWeb-basedsystemforyoutopostmessagesrelatingtoWroxbooksandrelatedtechnologiesandinteractwithotherreadersandtechnologyusers.Theforumsofferasubscriptionfeaturetoe-mailyoutopicsofinterestofyourchoosingwhennewpostsaremadetotheforums.Wroxauthors,editors,otherindustryexperts,andyourfellowreadersarepresentontheseforums.
Athttp://p2p.wrox.com,youwillfindanumberofdifferentforumsthatwillhelpyou,notonlyasyoureadthisbook,butalsoasyoudevelopyourownapplications.Tojointheforums,justfollowthesesteps:
1. Gotohttp://p2p.wrox.comandclicktheRegisterlink.
2. ReadthetermsofuseandclickAgree.
3. Completetherequiredinformationtojoin,aswellasanyoptionalinformationyouwishtoprovide,andclickSubmit.
4. Youwillreceiveane-mailwithinformationdescribinghowtoverifyyouraccountandcompletethejoiningprocess.
NOTEYoucanreadmessagesintheforumswithoutjoiningP2P,butinordertopostyourownmessages,youmustjoin.
Onceyoujoin,youcanpostnewmessagesandrespondtomessagesotheruserspost.YoucanreadmessagesatanytimeontheWeb.Ifyouwouldliketohavenewmessagesfromaparticularforume-mailedtoyou,clicktheSubscribetothisForumiconbytheforumnameintheforumlisting.
FormoreinformationabouthowtousetheWroxP2P,besuretoreadtheP2PFAQsforanswerstoquestionsabouthowtheforumsoftwareworks,aswellasmanycommonquestionsspecifictoP2PandWroxbooks.ToreadtheFAQs,clicktheFAQlinkonanyP2Ppage.
PARTIOpenStackOverview
CHAPTER1:INTRODUCINGOPENSTACK
CHAPTER2:UNDERSTANDINGTHEOPENSTACKECOSYSTEM:COREPROJECTS
CHAPTER3:UNDERSTANDINGTHEOPENSTACKECOSYSTEM:ADDITIONALPROJECTS
1IntroducingOpenStackWHAT’SINTHISCHAPTER?
Modelsofcloudcomputing
Relevanceofcloudcomputingtoapplicationdevelopers
WhyOpenStackisagoodcloudplatformchoice
HowOpenStackisputtogether
WHATISCLOUDCOMPUTING?Thereissomuchhypearoundcloudcomputingthatitisoftendifficulttogetaclearsenseofwhatanyonemeansbythosewords.Isitjustvirtualization?IsitSoftware-as-a-Service(SaaS),suchasMicrosoft’sOffice365andSalesforce.com?OrisittheabilitytogetavirtualmachineinstantlyfromAmazonWebServices(AWS)orAzure?AndwhataboutonlinestoragesuchasDropbox?
TypesofCloudComputingTherealityisthatcloudcomputingreferstoallofthesethingsjustdescribedandmore.TheNationalInstituteofStandardsandTechnology(NIST)hascomeupwithan“official”definitionbaseduponfivekeycomponents:on-demandself-service,broadnetworkaccess,pooledresources,elasticity,andmeteredservice.Ingeneral,thesecharacteristicsmaybeprovidedinseveraldifferentmodels.Thesemodelshelpsortouttheconfusionandhype.Infact,thesecanbethoughtofaslayersinastack,witheachlayerbeingbuiltontopofthepreviousone(seeFigure1.1).
Figure1.1
InFigure1.1,“ManuallyProvisionedInfrastructure”representsthetraditionalmethodofbuildingyourinformationtechnologyinfrastructure—thisisnotcloudcomputing.Inthisenvironment,physicalmachinesareracked,connected,andconfiguredonaone-by-onebasis.Thisprovidescompletecontrol,butrequiressubstantialtimeandefforttobuildout,ortochangewhennecessary.Ofcourse,allcloudsneedtorunonphysicalgearatsomepoint,sothisprovidesthebasicfoundationforeverythingelse.Oneofthekeystomakingcloudcomputingsuccessful,however,istomovethecomplexityoutofthislayeranduphigherinthestack.
Infrastructure-as-a-Service(IaaS)isthemostbasiclayerinthecloudcomputing
stack.ThisisOpenStack’sprimaryfocus,aswellastheprimaryfocusforAWS.Itenablesautomatedorself-serviceprovisioningofcompute,networking,andstorage.Typically,theseresourcesareprovidedasVirtualMachines(VMs),butyoucouldalsouseittospinupbaremetalservers(i.e.physicalhosts).Thisisknownas“Metal-as-a-Service,”andOpenStackprovidesaprojectformanagingthisserviceaswell.Alternatively,youcanalsospinupcontainersratherthanVMsorbaremetalservers.Theessentialpointisthatitenablestheprovisioningofcomputeinstances,with(optionally)attachednetworkingandstorage.
Platform-as-a-Service(PaaS)buildsontopofIaaStoenabletheprovisioningofapplications,ratherthansimplytheinfrastructurethatmightbeusedtoruntheapplication.So,aPaaSprovidescorecommonservicesneededbyapplications,alongwiththemachinerytoconfigureanddeployapplicationstousethoseservices.APaaStypicallywillprovideacompleteapplicationstack(webserver,applicationserver,databaseserver,etc.)intowhichyoucaneasilydeployyourapplication.Heroku(https://www.heroku.com)isanexampleofapopularPaaSforapplicationsbuiltwithavarietyofstandardframeworks,suchasRuby-on-Rails.WithHerokuyoucandeployyourapplicationtotheInternetwithasimplegitpush.Astheapplicationauthoranddeployer,youdon’tneedtoworryaboutconfiguringanddeployingthedifferenttiers,orevenworryabouthowtoscalethem.IfyoufollowtheHerokuconventions,everythingishandledbythePaaS.
Software-as-a-Service(SaaS)isthelayerfarthestfromtheunderlyingphysicalinfrastructure.ItmaybebuiltonIaaSoraPaaS,butneednotbe—thepointistheuserneverreallyknows.Thisisthesimplestformofcloudcomputingfromthepointofviewoftheuserbecausetheyhavenoinsightintotheactualmechanicsorsystemsbehindtheservice.It’sjustaservicetheyuse.Oftenthisisprovidedintheformofawebsite,suchasSalesforce.com.Butyoucanalsogetlower-levelservicessuchasDatabase-as-a-Service,whereyousimplyrequestviaanAPI(orwebsite)foradatabasewithcertainparameters,andaregivenanIPandporttoconnectto.Asauseroftheservice,youdon’tneedtoworryabouthowtoscalethatservice—thoughyouwillneedtopaymoreasyouruseoftheserviceincreases.
Putsuccinctly,IaaSprovidesthetoolsto“build”yoursystemsfromthegroundup.PaaSallowsyouto“deploy”yourapplications,withoutneedingtoworryabouttheunderlyinginfrastructure.SaaSallowsyouto“buy”yourapplications—youdonotevenneedtodeployormanagethematall.Thisisasteadyprogressionofdecreasingcontrolandcomplexity,whileincreasingdirectbusinessvalue.
Whilethesearegeneralmodelsforcloudcomputing,inrealitythedistinctionsbetweenthemarenotalwayscrystalclear.TherelationshipofSaaStoPaaSinparticularcanbecomplicated.Aspecific,complexSoftware-as-a-ServicemayusePaaSorevenothermoregranularSoftware-as-a-Service.EvenaPaaSmayassemblelower-levelpiecesasacollectionofsoftwareservices.Forexample,mostserviceswillrequireanidentitymanagement(authentication,authorization,andaccounting)service.ThisidentityserviceisoneofthekeyfeaturesaPaaSprovides
toapplications.However,thereisnoreasonthatservicecannotbe,inturn,providedbysomeexternalSaaS!Inthiscase,akeyfunctionofthePaaSisprovidedviaalow-levelSaaS.
CloudInfrastructureDeploymentModelsInadditiontothefunctionalityprovidedbyacloud,thereareseveraldifferentdeploymentmodelsforclouds.Publiccloudsaretheonesfamiliartomostdevelopers.Thesecloudservicesaremadeavailabletothegeneralpublicforafee.Thefeeisgenerallyonausagebasis,enablingorganizationstoutilizetheiroperatingbudgetsratherthantheircapitalbudgets.Thecustomershavenoneedtomaintainoroperatethehardwareorcloudinfrastructure,leavingthatresponsibilitycompletelytothecloudoperator.
AmazonWebServices(AWS)iscurrentlythelargestpubliccloudanddominatestheindustry.MicrosoftandVMwarealsooperatepublicclouds,andanumberofserviceprovidersdoaswell.Rackspace,inparticular,providesanOpenStack-basedpubliccloud,andisoneoftheprimarycontributorstotheOpenStackproject.
Privateclouds,ontheotherhand,areinternaltoanorganization.Theyrepresenttheevolutionofthetraditionalcorporatedatacenter.Onlyinternalcustomerswithintheenterprise,andperhapsclosepartners,useprivateclouds.ThecorporateITdepartmentoracontractorwillpurchase,setup,andmaintainthehardwareandsoftwareforthecloud.Thecloudinfrastructuremayusechargebacktodistributecostsamongthebusinessunits,buttheclouditselfisstilldedicatedtothesingleenterprise.
Organizationsmayoperateprivatecloudsforanumberofreasons.Thecostofaprivatecloud,ifwellrun,maybelessthanutilizingthepublicclouds.Additionally,manyindustrieshavesecurityorregulatoryreasonsthatdisallowtheuseofapubliccloudformanyworkloads.Theseorganizationsarerequiredtorunthoseworkloadsinaprivatecloud.SeeFigure1.2foralookatthestructureofpublic,private,andhybridclouds.
Figure1.2
Hybridcloudscombinebothprivateandpublicclouds.Thegoalwithhybridcloudsistokeepgeneraloperatingcostslowbyusingtheprivatecloudformostoftheworkloads,buttoenablespilloverintothepubliccloudwhennecessary.Thespillovercouldhappenduetocapacityreasons—perhapsduringtheholidayseasonyourprivateclouddoesn’thaveenoughcapacity—orfordisasterrecovery.Thismodelavoidsthecapacityconstraintsofaprivatecloudwhilestillkeepingcostsundercontrol.
WHYSHOULDICARE?Asanapplicationdeveloperorarchitect,youmaywonder—whydoesallofthismattertome?Allofthisdiscussioncoveredsofarfocusesonthereasonabusinessmaywanttomovetothecloud.Butwhyshouldthataffecttheapplicationdeveloper?Theanswerliesinacoupleofdifferentareas:theeffectonthedevelopmentprocess,andtheeffectonyourapplicationarchitecture.
Cloudservicesenablemuchmoreefficientprocessesformanagingdevelopment,test,andproductionenvironments.Theseupdatedprocessesandmethodsrepresentthe“DevOps”mentality—applyingstandardsoftwaredevelopmentpractices,suchassourcecodeversioncontrol,totheoperationalaspectsoftheapplication.Thismeanscapturingalloftheconfigurationanddeploymentinformationinscriptsandtemplates,andcontrollingtheirchangesjustasyouwouldapplicationcode.
Scriptsandtemplatescanbebuiltthatproduceacompleteapplicationenvironment.Thesecanbeusedtoautomaticallydeploynotonlytheapplication,butalsoinfrastructurerequiredfortheapplication,includingvirtualmachines,networking,firewalls,loadbalancers,domainnameservices—younameit,andsomeoneisworkingonmakingitavailable“as-a-Service.”Byautomatingthecreationanddestructionoftheseenvironments,youcanensureconsistencybetweendevelopment,test,andproductionenvironments.Forcomplexapplicationswithmanydifferentservicesrunningondifferentmachines,thiscanbeadramatictimesaver.
OpenStack,and“as-a-Service”thinkinginparticular,willalsoendupchangingthesoftwareanddeploymentarchitecturesofyourapplication.Byrelegatingthecommonandroutinefunctionstothecloudinfrastructure,youfreeyourtimeandthoughttofocusonthemostimportantthing—yourapplication’sfunctionality.Forexample,atraditionalapplicationthatallowslargefileuploadswillneedtodesignatetemporaryandpermanentstoragelocationsforthosefiles,andmanagethestorageresourcestoensurethatthediskdoesn’tfill.Thesystemadministratorordeployerwillneedtodeviseastrategytobackupthatdataorreplicateittootherdatacenters.Butwiththerightcloudplatform,youcansimplydelegatethatfunctiontotheinfrastructure,andgetallofthebenefitswithoutdevotingspecialeffort.
Designingyourapplicationtoworkwiththecloudservicesalsodramaticallysimplifiesscalingtheapplication.Thescalabilityoftheindividualservicesbecomestheresponsibilityofthecloudoperator,nottheapplicationdeveloperoradministrator.Aslongastheapplicationmakeseffectiveuseofthoseservices,itwillscaleasneededwithlittletonoworkfromthedevelopersthemselves.
Beingabletoutilize“as-a-Service”functionsisonewayyourdesignwillshift.Anotheristoplanforhorizontalscalingratherthanverticalscaling.Thatis,scalingbyaddingmoremachines(horizontally)ratherthancreatingbigger
machines(vertically).Withmostapplicationstoday,itiseasiesttoscalebygettingabigger,fastermachine.Thislocksyouintoplanningforpeakcapacityofeachapplicationindividually.Foreachapplicationyouneedtoprovisionthelargestmachineyoumayneedatpeakload.Butwithapplicationsbuiltforthecloud,youinsteadscalebyaddingmoremachines.Thesemachinescanbesmaller,andwithcloudautomation,canbeadded,removed,orresizedasneeded.Thisabilitytoscaleupanddownasneedediscalledelasticscaling,andisoneofthekeyfeaturesofcloudcomputing.
Afrequentlyusedanalogyisthattraditionalserversarelike“pets,”whilecloud-basedserversare“cattle.”Thisdescribesanecessaryshiftinmentalityforatraditionalapplicationarchitect.Theideaisthatapetisuniqueandspecial,withitsownuniquename.Alotofresourcesarespenttoraiseandnurtureone,andifitissick,itwillbenursedbacktohealth.Cattle,ontheotherhand,arenottreatedspeciallyorcarefullyraised.Theyaretreatedenmasse—theyaregivennumbers,notnames—andasickoneisculledtopreventanyspreadofdiseasethroughtheherd.
Theimplicationhereisthatcloud-basedserversshouldbedisposableandeasilyre-deployed,andnotrequirecarefulhandconfiguration.Thatway,ifthereisaproblemwithone,youdonotspendtimetryingtofigureitoutandfixit—yousimplyreplaceitwithanewone.Thisisthelogicalextensionoftheabilitytoscaleelastically.Whytakethetimetofigureoutwhat’swrongwithamachinewhenit’sbehavingbadly?Justpullitoutoftheapplicationandreplaceitwithanewonewhileyoudebugtheproblem(nottofixthatmachine,buttopreventtheissueinthefuture).
WhatIsOpenStack?OpenStackbillsitselfasa“cloudoperatingsystem.”Fundamentally,itsolvestheIaaSproblem.Itprovidestheabilitytoabstractthephysicalcompute,storage,andnetworkingresourcesintopools.Thoseresourcescanthenbedivviedupamongusersinasecureway.Usersonlyneedtopayforwhattheyareusing,ratherthanhavingtoprovisiontheirapplicationsforpeakload.
OpenStackisacollectionofopensourcesoftwareprojects,backedbyanon-profitorganization,theOpenStackFoundation.TheseprojectsworktogethertoprovideaconsistentAPIlayer,whileenablingtheactualservicestobeprovidedbyavarietyofdifferentvendororopensourceimplementations.Atthecore,theseservicesincludethefunctionalityyouneedtorunacloud,thatis,theabilitytospinupvirtualmachines,theabilitytoallocate,manage,andsharestorageamongthosemachines,andtheabilityenablethesemachinestocommunicatewithoneanothersecurelyoverthenetwork.
KEEPINGTRACKOFRELEASESOpenStackhasofficialreleaseseverysixmonths.Inordertomakeiteasiertokeeptrackofallthesereleases,theyaregivennamesinalphabeticalorder.Belowisthenameofeachrelease,anditsreleasedate,throughtheLibertyrelease.
Austin:October2010
Bexar:February2011
Cactus:April2011
Diablo:September2011
Essex:April2012
Folsom:September2012
Grizzly:April2013
Havana:October2013
Icehouse:April2014
Juno:October2014
Kilo:April2015
Liberty:October2015
Inadditiontothereleasename,eachreleaseisidentifiedbytheyearandreleaseduringthatyear—<year>.<release>.<patch>.Forexample,Kiloisalsoknownas2015.1,asthefirstreleasein2015.PatchreleasesforKiloare2015.1.1,2015.1.2,etc.Thesecondmajorreleaseof2015isLiberty,whichisalsoknownas2015.2.
AlloftheseservicesareaccessibleviaRESTfulAPIs,aswellascommand-lineinterfacesandaweb-baseduserinterfacecalledHorizon.Horizonisconvenientforsettingupthingsonanad-hocbasis,butdoesn’tofferthefullcapabilitiesoftheAPIs—andofcoursetheAPIsandCLItoolscanbeeasilyscripted(seeFigure1.3).
Figure1.3
ThenexttableshowsthemajorservicesprovidedbyOpenStack,alongwiththeirnames.OpenStackcommunitymemberswillusuallyrefertoeachservicebyitsname,soit’shelpfultoseethemallinoneplaceandgetahandleonwhateachonedoes.Infact,therearemanymoreservices,butthesearethemostcommononesyouwillfind.
Name Service Description
Horizon Dashboard Agraphicaluserinterfaceformanagingyourcloud
Keystone Identity Authentication,authorization,andOpenStackserviceinformation
Nova Compute Spinup,manage,andterminatevirtualmachines
Cinder BlockStorage Diskvolumes(thatoutliveaninstance)andsnapshotsofinstances
Swift ObjectStorage
Shared,replicated,redundantstorageforimages,files,andothermediaaccessibleviaHypertextTransferProtocol(HTTP)
Neutron Network Providesecuretenantnetworking
Glance Image ProvidestorageandaccesstoVMimagesandsnapshots
Heat Orchestration Spinupgroupsofmachines,networks,andotherresourcesviatemplates
Designate DNS CreatedomainsandrecordsintheDNSinfrastructure
Ceilometer Telemetry Monitorresourcesusageacrossthecloud
Trove Database Provideaccesstoprivatetenantdatabases
Ironic BareMetal Spinupinstancesonphysicalhardware
Magnum Containers Managecontainerswithininstances
Murano Application Deploypackagedapplicationsacrossmultipleinstances
Sahara DataProcessingCluster
ProvidesaHadooporSparkclusterasaservice
AdefaultinstallationofOpenStackwillinclude“reference”versionsofeachservice.Forexample,bydefaultanOpenStackcloudwillusetheKernel-basedVirtualMachine(KVM)hypervisortomanagevirtualmachines.OneofthemostimportantaspectsoftheOpenStackarchitecture,however,isthedriverorplugin-basednatureofeachservice.Withthisdesign,youcanuseanimplementationotherthanthereferenceone.Inyourcloud,youcanswapoutKVMwithESXi,Xen,orotherhypervisors.TheAPIsusedtolaunchandmanageVMsremainthesame,regardlessoftheunderlyinghypervisor.ThissameconceptextendsacrossOpenStackservices,enablingthesameAPIswithdifferentserviceimplementations.
Thislevelofflexibilitybehindthescenes,whileprovidingaconsistentAPI,isoneofthekeystothesuccessofOpenStack.UserscanbuildtheirapplicationsandautomationontopofOpenStack,withouthavingtoworrythattheyarelocking
themselvesintoasinglebackendproviderofcomputer,networking,orstorage.TheAPIswon’tchangeeveniftheyswapoutthebackend.
OpenStackisfrequentlyusedinenterprisesforprivateclouds,thoughtherearesomepubliccloudservicesthatarebasedonit.TherearealsocompaniesthatwillcreateandoperateaprivateOpenStackcloudforyouwithintheirdatacenters.Inthiscase,thehardwareisnotsharedwithothercustomers,soyouhavethepredictabilityandsecurityoftheprivatecloudbutdonothavetofindandhiretheexpertstomaintainit.
Eveninprivatecloudenvironments,OpenStackisamulti-tenantcloudplatform.Thismeansthatmultipleusersorgroupsofusers—tenants—canutilizethephysicalresourcesofthecloud,whilekeepingalloftheirvirtualizedresourcesprivate.Foratenant,theOpenStackenvironmentappears,forthemostpart,tobetheirsandtheirsalone.Butfortheoperator,theunderlyingphysicalresourcesandsoftwaresystemsareshared.InOpenStack,tenantsarealsosometimesreferredtoasprojects.
Inamulti-tenantOpenStackcloud,eachtenantisallocatedaquotaforthevarioustypesofresourcesthatmaybeused.Thequotaprovidesamaximumlimitforthattenantforthatparticularresource.YouwillhaveaquotaforCPUs,memory,storage,networks,subnets,andfloatingIPs,amongotherresources.Thispreventsanysingletenantfromconsumingalloftheresources.
WhyOpenStack?Thereareanumberofcloudmanagementplatformoptionsoutthere.ThemostobviousanddominantplayerisVMwarewiththeirvRealizesuiteofsoftware.So,whyshouldyoutakeyourtimetolearnaboutOpenStackratherthanvRealize,AWS,Azure,CloudStack,oranyoftheothersolutions?
About15yearsago,ITprofessionalsfacedaverysimilarsetofquestionsaboutLinuxandproprietaryUNIXsystems.Solaris,HP-UX,AIXandtheircompetitorsweresolid,wellknown,andwidelydeployedproducts,whereasLinuxwasagraduatestudent’sprojectthatwasdifficulttoinstallandoperateandwasfairlyimmature,withdriverandothercompatibilityissues.ItwasnotclearatallatthetimethatspendingeffortlearningandunderstandingLinuxwasworthit.Historythough,hasproventhatsuchachoicewouldhavebeentherightone.Allofthoseexpensive,proprietaryUNIXimplementationshavelosttheirvalueproposition—theyreallydon’thavemuchthatisuniquetoofferanymore.Linuxhascontinuedtogrowandhastakenovermostoftheenvironmentswherethosesystemsoncethrived.
Thisisn’tjustasimpleanalogy.Thereisarelentlesspressureinthisindustrytoreducecosts,andtoincreasethevelocityoffeaturedelivery—delivermore,faster,andcheaper.Thewaytoachieve“more,faster”isstandardization.Thisisthesamebasicprincipleasbuildinglibrariesandframeworksinprogramming.Astandardarchitecturebehavesinapredicablemanner,providingcoreservicesonwhichyou
canrelyandbuild.Thereisnoneedtorepeattheprocessofdevelopingthatarchitectureoverandover,allowingyoutofocusonthenewfunctionality.
Thewayyouachieve“cheaper”istomakethosestandardsopenandfree.Thiscombinationofopenandstandardleadstocommoditization—essentiallythedevelopmentofinterchangeablecomponentsthatarethesameregardlessofthemanufacturerorvendor.Commoditiesimplyalotofcompetition,andthereislittleornoproductdifferentiationforwhichtochargeextra.Thisdrivesdownthecostsdramatically.
Linuxhasbothofthesecharacteristics—openandstandard—inUNIX-likeoperatingsystems,andthatiswhyitwon.Notbecauseitwasbetter,butbecauseitwascheaperandfastertouseasabaseforbuildingnewfunctionality.Linuxisjustoneexample,ofcourse.Thisstoryhasrepeatedoverandoverinthetechnologyindustry.Withmachinearchitectureswehavethex86platform,andstandardarchitecturesformemory,disks,andserialbus-basedperipherals.
Infact,ifyoutakethebroaderview,youcanseethatthecommoditizationhascontinuouslymovedupthevaluechain.Itstartedwithhardware,movedtooperatingsystems,andthesedaysevensophisticateddatabasesanddistributedsystemcomponentsarebeingcommoditized.Indatabases,weusedtohaveInformix,DB2,Oracle,Sybase,andothers.ButMySQLandPostgresSQLareopenandstandard,andtheyhavecompletelydominatedthelow-endofthedatabasemarket.Oraclestillleadsinthehigh-end,andisabletoprovidevalueinthosemorespecializedenvironments,butastheopensourceproductsimprove,thespacefortheproprietaryvendorsconstricts.
Insomeway,cloudcomputingistheculminationofthiscommoditizationprocessintheindustry.Broadly,youcanthinkoftherevolutionhappeninginthecomputingindustryasarefocusingoftheindustryonthecorefunctionsofcomputing.Theabstractionofthecomputinginfrastructureintosimplycompute,storage,andnetworkingcomponents,andbreakingoftheseoutfrombeingverticallyintegrated,tohorizontallyintegrated,istrulytransformative.Itbringsfullcommoditizationtotheseelements,whicharethebasicfoundationoftheindustry.
Cloudplatformmanagementwillfollowthesamepattern.TheproprietaryplatformslikevRealizewillthriveforatime,butinthelongruntheopenandstandardsystemswillwin.Whiletheremayalwaysbeaplacefortheproprietarysolutionsinmorespecializedenvironments,themostcommonplatformswillbeopensource.Youcanseethisalreadyhappening:theZenoss2014StateoftheOpenSourceCloudSurvey(http://www.zenoss.com/resource-center/white-papers)foundthat30percentofrespondentswerealreadyusinganopensourcecloud,up72percentfrom17.2percentin2012.Another34percentoftherespondentsplannedtoimplementanopensourcecloudinthefuture.Understandingthisgivesyouanadvantagetofocusontheeventualwinner,insteadofchasingwhatwillultimatelybeasettingstar.
Thereareseveralopen,standardcloudmanagementplatforms.Soevenifyoubelievethatthebetonopenandstandardisthewaytogo,whyshouldyoubetonOpenStack?Theanswerhereissimple—momentum.OpenStackisbyfarthemostwidelyusedandsupportedopensourcecloudmanagementplatform,andithasthelargestcommunityofdevelopersandvendorspushitforward.Thesamesurveymentionedabovefoundthat69percentofrespondentswithanopensourcecloudwereusingOpenStackin2014,upfrom51percentin2012.Anamazing86percentofthoseconsideringanopensourceclouddeploymentarelookingatOpenStack.
TheOpenStackdeveloperandusercommunitieshavegrowndramaticallyaswell.TheOpenStackFoundation2014AnnualReport(https://www.openstack.org/assets/reports/osf-annual-report-2014.pdf)providesdetailedinsightintothisgrowth.In2013,thebestquarterformeanmonthlyactivedevelopershad391developers—in2014thismeasurewasup45percentto569developers.LargeinvestmentsfromHP,Cisco,RedHat,IBM,Dell,Mirantis,Rackspace,andmanyothervendorshavedriventhissurge.Theincrediblegrowthinthenumberofusers,developers,andotherinterestedpartiescanbeseenfromtheattendanceatthetwiceannualOpenStackSummits,seeninFigure1.4(source:openstack.org).
Figure1.4
ClearlyOpenStackhasthemomentumtosucceed.
UNDERSTANDINGTHEARCHITECTUREOpenStackisbuiltonalooselycoupledarchitecture.Eachcomponentisbuiltindependentlyandrunsitsownservices.Theseservicesmaybedistributedamonganumberofdifferentmachineswithdifferentresponsibilities.Thisenablesscalingofparticularfunctions,byaddingmachineswithparticularroles.Italsoenablesredundancy;ahighlyavailabledeploymentwillcontainseveralofeachtypeofmachine.
SoftwareArchitectureIndividualcomponentsinteractwithoneanotherviawell-definedapplicationprogramminginterfaces(APIs)—typicallybasedonrepresentationalstatetransfer(REST)conventions,thoughinsomecasesusingremoteprocedurecalls(RPC)ornotificationsoveramessagebus.Typically,theseserviceswillmaintaindatainarelationaldatabase—usuallyMySQLorPostgreSQL.Themessagebusanddatabasearesharedacrossservices,buttheinteractionsbetweenthoseservicesremainclearlydelineated.Thisenablesdifferentservicestogrowandchangeindependentlyfromtheothers,solongastheyprovidebackward-compatibilityintheAPIs.
Eachofthemajorservices—compute(Nova),networking(Neutron),blockstorage(Cinder),etc.—haveseveralinternalprocessesandcomponents.Generally,theywilleachhaveanAPIservicethatprovidesanHTTP-basedRESTfulAPI.ThisAPIservicewillcommunicatewiththeothercomponentsviathemessagebus.
TheHorizonserviceisaweb-basedUIthatinteractswiththevariousservices.Similarly,therearecommand-linetoolstointeractwitheachservice.Thesetoolsareoptional;youcanbuildyourowninterfacedirectlytotheserviceAPIsifyouwish.HorizonandtheofficialCLIclientsdonothaveanyspecialaccess;everyoneusesthesameAPIs.EachclientreallyonlyneedstobeinformedofthelocationofKeystone,theidentityservice.ThisservicecontainsacatalogofallservicesandAPIendpointsavailableintheOpenStackplatform(seeFigure1.5).
Figure1.5
InFigure1.5,whatyouseeisasimplifieddepictionofhowtheservicesinteract.EachservicehasanAPIcomponent,whichcommunicateswithKeystone’sAPIviaHTTPStoprovideauthenticationandauthorizationinformation.EachAPIserviceusesthemessagebustocommunicatewithseveralotherprocessesforthatservice(justcalled“Services”inthediagram).Asneeded,thesedownstreamserviceprocesseswillcalltheAPIsofotherservices.Forexample,NovawillcalltheNeutronAPItoacquireaportonaparticularnetwork.
DeploymentArchitectureHowareallofthesedifferentpiecesofsoftwaredeployedonthehardware?Thisisactuallyprettyflexible.Fordevelopmentorjustexperimentation,youcanevenruneverythingonasinglemachine.However,amoretypicaldeploymentwillhaveseveralcontrollernodes(forhighavailabilitypurposes),alongwithadditionalnetwork,compute,andcontrollernodes.
Eachhigh-levelservice(compute,networking,storage,andothers)consistsofmultipledaemons(backgroundprocesses).Thesedaemonsarespreadoutacrossthevarioustypesofnodes.Thatis,youdonotrunindividualservicesonindividualnodes,butratherspreadeachserviceoutacrossdifferenttypesofnodes.
Forexample,alloftheservicessharethedatabaseandmessagingcomponents(typicallyMySQLandRabbitMQ,respectively).Youmayruntheseeachon
separateclusters,witheachclusterspreadoverdifferentfailuredomains.Additionally,youmayhaveseveralphysicalnodesthatprovidetheAPIendpoints,behindaphysicalloadbalancer.DifferentdaemonsforNovaandNeutronwillbespreadacrossthenetworkandcomputenodes.Figure1.6showsasimplifieddiagramofthislayout.
Figure1.6
NoticethedifferenttypesofnodesinFigure1.6.ComputenodesrunthehypervisorandthereforetheactualVMinstances,aswellasprovidetheephemeralstorageforinstances.TheywillalsorunNeutronnetworkingagentstomanagetheconnectivitybetweenVMs(calledeast-westtraffic).
ThenetworknodesusuallyprovidetheconnectivitybetweenVMsandoutsidethecloud(callednorth-southtraffic),aswellastheadvancednetworkserviceslikeloadbalancingandVPNaccess.Dependingonthechoicesmadebytheadministratorsandusers,theremaybeagentsprovidingnetworkroutingservicesonthenetworknodes,directlyonthecomputenodes,orboth.
Theblockstoragenodesprovidevolumeservicestotheinstances—thatis,theyprovideaccesstopersistentstoragefordiskvolumesthatcanbeattachedand
detachedtoinstances.Cloudsthatofferobjectstoragewillalsohaveseparateclustersforthat.Objectstorageprovidesshared,replicated,redundantstorageforimages,files,andothermediaaccessibleviaHTTP.
Varioussegregatednetworksconnectallofthesenodes.Everynodeisaccessibleviathemanagementnetwork,whichisusedfordifferentpartsofOpenStacktocommunicatewithoneanother.Allofthemessagebus,database,andcross-projectAPItrafficgooverthemanagementnetwork.Thedatanetworkconnectsallofthecomputenodes,networknodes,andblockstoragenodes.Theinternalcloudtenanttrafficiscarriedonthisnetwork,whereastheexternalnetworkprovidesaccesstotheoutsideworld.Sincethecomputenodesdonotcommunicatewiththeoutsideworld,butonlywithothernodesinthecloudinfrastructure,theyneednothaveconnectivitytotheexternalnetwork,butonlyneedaccesstothedatanetwork.Onlythenetworknodesneedtoconnecttotheexternalnetwork.Finally,someinstallationswilluseanAPInetwork,whichprovidesaccessbetweentheoutsideworldandtheOpenStackendpoints(APIandHorizon),separatefromtheexternalnetworkusedbytenants.
ProsandConsThisarchitectureprovidesagreatdealofflexibility.Thisenablesthescalabilitybylettingthecloudoperatordeployadditionalnodestoscaletheinfrastructure.Italsoallowstheabilitytocreatehighlyavailableservices,sinceyoucanspliteachserviceoutandmakethemredundantacrossfailuredomains.However,itisverycomplex,andcanbequitedifficulttosetupandmaintain.
Asauserofthecloud,thiswillbetransparenttoyou.Butaproperlyruncloudwillhaveenoughredundancybuiltinthatyoucanexpectahigh-levelofreliabilityfromtheOpenStackinfrastructure.
Anothersubstantialbenefittothisarchitectureisavoidingvendorlock-in.Eachserviceprovidesapluginordriver-basedarchitecture.Thisenableseachservicetoworkwithanynumberofvendorplatformstoprovidetheactualservice.Forcompute,youcanusethedefaultKVMhypervisor,ESXi,Xen,oroneofmanyotherhypervisorchoices.ThenetworkingservicedefaultstousingOpenvSwitchtoprovideLayer2(thedatalinkorMACaddresslayer)connectivity,andtheLinuxnetworkingstack(iptables,routing,andnamespaces)toimplementLayer3(IPlayer)functionality.However,therearemorethan20differentvendorpluginstoswapallorpartofthatdefaultimplementation.Infact,thesevendorimplementationscanbeusedatthesametime,inthesamecloud.
Byavoidingvendorlock-in,OpenStackenablesmorecompetitionbetweenthevendors,pushingdownpricesinthemarket.Theabilitytousemultiplevendorsatoncemakestransitioningfromonevendortoanothermorefeasible,andalsoallowsthechoiceofvendorforsolvingspecificusecases.
AninterestingfeatureintroducedwiththeKiloreleaseofOpenStackisfederatedidentity.ThistakesthedistributednatureofOpenStackandallowsittospan
acrossmultipleclouds,evenfromdifferentproviders.Twocloudproviderscansetupatrustrelationship,enablingusersofoneprovidertousethesamecredentialswithanother,trustedprovider.Thusthesameworkloadmanagementtoolsyouuseforasinglecloudcantheoreticallybeusedtomanageworkloadsacrossmultipleclouds.Forcapacityburstusecases,thisisapowerfulfeature.
OpenStackDistributionsWiththecomplexityofthearchitecture,anumberofcompanieshavesteppedintohelpwithinstallationandmanagementofanOpenStackplatforminaprivatecloud.TheseincludenamesfamiliarfromtheLinuxdistributionworld,suchasRedHat,SUSE,andCanonical(Ubuntu),aswellasnewplayersthatarefocusedonlyonOpenStack,suchasMirantis.
INDUSTRYCONSOLIDATIONInfacttheOpenStackindustryhasseenagreatdealofconsolidationin2014and2015.Severalpure-playOpenStackcompanieshavebeengobbledupbythebiggerplayers.
ManylargeintegratorsandenterprisesoftwarevendorsarealsojumpingintotheOpenStackdistributiongame,withthelikesofIBM,HP,andOraclejoiningthefray.
Ifyoudon’thaveanOpenStackcloudavailablealready,oryouwanttolearnmoreaboutthearchitectureandhowallofthepiecesfittogether,youcansetupyourownOpenStackplayground.Youcanuseoneofthesedistributionstosetupyourownsmallcloud.EachofthedistributionvendorsprovidestheirowntoolsforsetupofOpenStack.Theyareprimarilytargetedatproductionenvironments,andassuchcanbeprettyhardtogetstartedwithonyourown.Forexample,Canonical’sofferingrequiresaminimumofsevenphysicalnodesjusttobringuptheenvironment.
Ifyouaresettingsomethingupsmall,yourbestoptionsareprobablyRedHat’sopensourcedistribution(asopposedtotheirsupportedversionrunningonRedHatEnterpriseLinux),calledRDO(www.rdoproject.org).Thenicethingaboutthisdistributionisthatitoffersasimple“allinone”optiontodeploytheentireenvironmentonasinglenode.
IfyouwouldliketotinkerwiththeactualcodeofthevariousOpenStackservices,youcouldalsosetupadevstackenvironment.Devstack(www.devstack.org)isapowerfulsetofscriptstocreateandconfigureanOpenStackdevelopmentenvironment.
Whilethedetailedinstructionsonlinearequitegood,hereareafewhintstomakeyourdevstacksetupgosmoothly.You’llwantafreshUbuntu(http://www.ubuntu.com)orFedora(www.fedoraproject.org)installation.Don’t
trytorundevstackonyourregularmachine—you’llwantadedicatedmachine(virtualorphysical).IfyouhaveavirtualizationproductlikeVMwareWorkstationorFusion,orthefreeVirtualBoxforyourlaptopordesktop,thebestthingtodoiscreateabaseserverinstallationofyourOSofchoice(enablingalloftheextrarepositories),andthensnapshotit.Thiswillmakeiteasytostartoverifyoutrashyourenvironment.
Theinstructionswillhaveyoucreatealocal.conffile,whichthedevstackscriptsusetocaptureallofthespecificsofyourinstallation.Thereareonlyafewitemsyouneedtosetinyourlocal.conf.
[[local|localrc]]
ADMIN_PASSWORD=stack
DATABASE_PASSWORD=$ADMIN_PASSWORD
RABBIT_PASSWORD=$ADMIN_PASSWORD
SERVICE_PASSWORD=$ADMIN_PASSWORD
SERVICE_TOKEN=some-random-string
FIXED_RANGE=10.0.0.0/24
FLOATING_RANGE=192.168.20.0/25
PUBLIC_NETWORK_GATEWAY=192.168.20.1
LOGFILE=/opt/stack/logs/stack.log
disable_servicen-net
enable_serviceneutronq-svcq-agtq-dhcpq-l3q-meta
Thefirstsectionheresetsupthenetworking.YoushouldpickaFIXED_RANGEthatdoesnotoverlapyourexistingnetwork.YourFLOATING_RANGEcancorrespondtoanexistingunusedsubnetonyournetwork,withthePUBLIC_NETWORK_GATEWAYbeingthelocaldefaultgatewayonyoursubnet.
TheLOGFILEsettingsimplyhelpsyoudebugifyourdevstackdoesnotcomeupproperly,whereastheremainderofthefiledisablesNovanetworkingandenablesNeutronnetworking.
YouwillneedaccesstoeitherdevstackoranotherOpenStackinstancetofollowtheexamplesthroughoutthisbook.
GETTINGTHEOPENSTACKCLICLIENTSTofollowalongwiththeexamples,you’llneedaccesstoamachinewiththeOpenStackclientsinstalled.Youcanlearnhowtoinstalltheclientsathttp://docs.openstack.org/cli-reference/content/,whichwillincludeinstructionsforavarietyofoperatingsystems.TheexamplesinthisbookwilluseLinux.
Theeasiestwaytousetheseclientsistosetthenecessaryauthenticationinformationinenvironmentvariables:
$exportOS_USERNAME=usernameOS_PASSWORD=password
OS_TENANT_NAME=tenant-name
$exportOS_AUTH_URL=http://keystone-ip:keystone-port/v2.0
Thisallowsyoutocalltheclientswithoutpassingthoseparameters:
$openstackflavorlist
+----+-----------+-------+------+-----------+-------+-----------+
|ID|Name|RAM|Disk|Ephemeral|VCPUs|IsPublic|
+----+-----------+-------+------+-----------+-------+-----------+
|1|m1.tiny|512|1|0|1|True|
|2|m1.small|2048|20|0|1|True|
|3|m1.medium|4096|40|0|2|True|
|4|m1.large|8192|80|0|4|True|
|42|m1.nano|64|0|0|1|True|
|5|m1.xlarge|16384|160|0|8|True|
|84|m1.micro|128|0|0|1|True|
+----+-----------+-------+------+-----------+-------+-----------+
IfyourservicesendpointsareusingHTTPS,you’llneedtochangetheOS_AUTH_URLtoreflectthat.Ifyouareusingself-signedcertificates,youalsoneedtopassinthe–insecureoption.
SUMMARYInthischapter,youhavelearnedaboutthevarioustypesofcloudcomputing—IaaS,PaaS,andSaaS—andhowtheyrelatedtooneanother.OpenStackfillstheIaaS,andperhapsinthefuturethePaaSfunctions,intheclouds.Moreimportantlyyoulearnedthatdrivingcostslowerwhiledeliveringmorefeatures,morequicklyisthedrivingforcebehindthecloudcomputingrevolution.Finally,youlearnedaboutthemajorcomponentsofOpenStack—Nova,Neutron,Glance,andKeystone,andhowtosetupaplaygroundforexperimentingwithOpenStack.
2UnderstandingtheOpenStackEcosystem:CoreProjectsWHAT’SINTHISCHAPTER?
HowthedifferentOpenStackcomponentsworktogetherandhowauthenticationworkswithintheinfrastructure
AlookathowacomputeinstanceiscomposedandthedifferenthypervisorssupportedinOpenStack
HowdataisstoredintheinfrastructureandunderstandingthedifferencesbetweenBlockStorageandObjectStorage
Howinstancetemplatesandsnapshotsarecreatedandwheretheyarestored
ThedifferentwaystomanageyourOpenStackresources:GUIversusCLIversusAPIs
HowthenetworkisdesignedinOpenStackandthedifferentnetworkcomponentsavailableandexposedthroughtheAPIs
Atthispoint,youhaveanunderstandingofwhycloudcomputingisimportanttoapplicationdevelopers,andageneraloverviewofOpenStack.Inthischapter,youwilllearnthecoreservicesinmoredetail.Thesearetheservicesmostcriticaltorunninganapplication—compute,network,andstorage.Youwillalsolearnaboutthemanagementservicestomakethosepossible,suchastheidentityservice,whichallowsyoutoauthenticateinordertocreateyourapplications.
Sometimes,itmayseemthatthedescriptionsinthischaptergointomoredetailthanyouneedtorunanapplication.However,youcanthinkofthesefeaturesastoolsandbuildingblocks.Youneedtohaveasolidunderstandingofwhatispossible,soyoucanseenewwaystobuildflexible,scalable,androbustapplications(seeFigure2.1).
Figure2.1
IDENTITYTheidentityservicewithinOpenStack,namedKeystone,isresponsibleforauthentication,authorizationandaccounting(AAA)andcurrentlyimplementsandprovidestheOpenStackIdentityAPI.
Themaingoalofthisidentityserviceistoprocessandvalidateauthenticationandauthorizationrequests,thenreturnan“authenticationtoken,”whichisusedtoauthenticatetheuseragainsttheAPIsandcanbeusedtocontacttheotherservicesofanOpenStackinfrastructure.Theseservicescanbediscoveredusingthecatalogreturnedintheauthenticationresponse(detailedlaterinthischapter).
KeystonecurrentlyimplementstwoversionsoftheIdentityAPI(v2,v3).ThesecondversionhasbeenusedforyearsandisstillmainlyusedtodayinthedifferentlibrariesandclientssupportingOpenStack.Thethirdversionisquiterecentandprovidesamorepluggableandflexibledesign,allowingusingmultipleauthenticationmechanisms(theoriginal“password”method,butmoreoverwell-knownandusedmechanisms,suchasOAuthorSAML2),andtheabilitytocombinethesemethodsinasinglerequest.
ThislastIdentityAPIhasamulti-tenantdesignandhassimpleresources:
Region:anOpenStackinfrastructurethatoptionallymayhavesub-regions
ServicewithEndpoints:anOpenStackregisteredserviceinKeystonethatcanhavezero,one,ormultipleendpointstoreachthisone(e.g.public,internal,admin)
Domain:acontainerfortheusers,groups,andprojects
Project(knownas“Tenant”inthesecondversionoftheAPI):owningasetofOpenStackresources
User:asingleAPIconsumer,whichshouldhavereallyrestrictedauthorizationsinyourapplication
Group:acollectionofdifferentusersofthesamedomain
Role:anauthorizationthatauseroragroupofuserscanobtainonaprojectoradomain
AlloftheseresourcescanbemanagedusingtheIdentityAdminAPI,whichisavailableasacreate,read,update,anddelete(CRUD)RESTfulAPI.
UsingTokensandRe-AuthenticationTheauthenticationagainstthedifferentOpenStackservicesisbasedontokensprovidedbytheidentityservice(Keystone)orconfiguredintheserviceitself(e.g.admintokens).
AtokenprovidedbyanidentityserviceisanarbitrarystringthatcontainstheUseridentityandoptionallyanauthorizationcalledscope.Theauthorization
attachedtothistokengrantsaccesstoaProjectoraDomain,allowingyoutoaccessProjectorDomain-relatedresources.
YoucaneasilycreateatokenusingtheIdentityAPIwiththemethodPOST/auth/tokenswithauseridentityandthewantedscope:
{
"auth":{
"identity":{...},
"scope":{...}
}
}
TokenIdentitiesWhenrequestinganewtoken,theidentityparameterwillcontaintheusedauthenticationmechanisms.Hereisanexampleusingpassword.Theuniqueidentifieroftheuserisusedhere,howeveritispossibletousetheusernameifthedomainisexplicitlyspecified.
{
"auth":{
"identity":{
"methods":[
"password"
],
"password":{
"user":{
"id":"042042",
"password":"secret-password"
}
}
}
}
}
ScopedandNon-ScopedTokensIfspecifiedintherequest,theauthorizationscopemustcontaintheprojectidentifierorthedomainidentifier.
{
"auth":{
"scope":{
"project":{
"id":"123456"
}
}
}
}
Ifascopehasbeenprovidedinthetokencreationrequest,theIdentityAPIwillreturnacatalogcontainingthedifferentOpenStackservicesthatcanbeusedbytheuserwiththetokenandtherolesgrantedtothisuser.
X-Subject-Token:ff00ff84
{
"token":{
"catalog":[
{
"endpoints":[
{
"id":"c3ac301342a381b895743659d0956de1",
"interface":"public",
"region":"RegionOne",
"url":"http://my.identity.service:5000"
}
],
"id":"9192d6fb0f120a188133cb569b8db832",
"type":"identity",
"name":"keystone"
}
],
"expires_at":"2015-07-14T13:37:00.000000Z",
"issued_at":"2015-07-15T13:37:00.000000Z",
"methods":[
"password"
],
"user":{
"id":"042042"
}
}
}
Ifnoscopeisspecifiedinthetokencreationrequest,theIdentityAPIwillreturnanon-scopedtokenthatcanbeusedtoidentifytheuserinanextIdentityAPIrequest.Oneexamplewouldbetocreateascopedtokenusingthetokenauthenticationmechanism.
Ascopedtokencanbere-scopedusingthetokenauthenticationmechanismwithasmallerscope,forexamplethisisextremelyusefultoprovidealimitedauthorizedtokentoanapplicationsub-componentoranotherAPIclientthatdoesn’tneedthefullauthorizationoftheoriginaltokentooperate.
UsinganAuthenticationTokenTheobtainedauthenticationtokenscanbepassedinalloftheHTTPrequestsagainstthedifferentRESTAPIsasaX-Auth-TokenHTTPheader.ThesetokenswillbecheckedbytherequestedOpenStackservicetoensuretheirvalidity(i.e.expiration,revocation,etc.)andiftheauthorizationofthistokenallowsaccesstotherequestedresourcewiththepolicyoftheserviceappliedtotheuserrole.
HowVariousPiecesofOpenStackCommunicatewithEachOtherOpenStackhasamodulararchitecturewhereallofthedifferentcomponentsareseparateservicesthatcommunicatetogetherusingstandardizedRESTAPIs(seeFigure2.2).ThisprincipleisfundamentalandrequiredintheOpenStackproject
lifebecausedifferentteamsledbydifferentpeoplearedevelopingeachcomponent.AlloftheOpenStackcomponents’featuresandupdatesstartbyanAPIdesigndiscussion.AlloftheseAPIsshouldbesimple,standard,re-usableandre-implementablebyanydeveloperwhowouldwanttousethemandhavecustomservicesthatwouldimplementtheAPIopen-specifications.Moreover,thesestandardRESTAPIshavefeaturesthatuseamessagingqueuetointernallyprocessthedifferentactionsandevents.
Figure2.2
TherequestsprocessedbetweenthedifferentOpenStackservicesareauthenticatedwiththetokensoftheoriginalrequest(seetheearliersectionaboutauthenticationtokengeneration)andtheauthorizationoftheserequestsbetweentheOpenStackservicesarecheckedasadirectrequesttotheend-service.
Forexample,whenausercreatesasnapshotofacomputeinstance,thecomputeserviceprocessesarequestagainsttheimageservicetostorethissnapshot.Whencreatingthisrequest,theoriginalauthenticationtokenispassedintheRESTAPIrequestbetweenthetwoservices.Ifthisimageserviceusestheobjectstorageserviceasastoragebackend,anauthenticatedrequestisgeneratedbetweenthese
twoservicesusingtheoriginalauthenticationtoken(seeFigure2.2).
CanApplicationsUseKeystone?WhencreatinganapplicationthatusesOpenStack,theusageofKeystoneisrequiredtoensureappropriateauthorizationsandstructureofthedifferentservicesorpartsoftheapplication.
Let’staketheexampleofanapplicationthatwouldhavedocuments(e.g.pictures)uploadedbyaguestuser.So,weneedaservicetoconvertorresizethesepictures.Wealsoneedtostorethepictures(thatwecallobjects)usinganOpenStackobjectstorageservice.Wethenneedtoautomaticallyprovisionandmanagetheinstancesusingthecomputeinstances.We’llhavetwodifferentrolesorprojectsandtwodifferentusersbecausewedon’twantthepublicaccessibleapplicationtomanageourinstancesforsecurityreasons.
DEMOAPPLICATIONSOURCECODEYoucanaccessthesourcecodefromourdemoapplicationviaGitHub:https://github.com/johnbelamaric/openstack-appdev-book.
COMPUTETheComputeprojectinOpenStack,namedNova,includesalloftheAPIsandtoolstoprovisionandmanagetheinstances(thevirtualmachinesprovisionedonphysicalcomputenodes)acrossmultiplephysicalhostsatscale.Thisprojectprovidesanabstractionoftheconfigurationofthemainusedhypervisorsintheworld,allowingyoutoeasilyprovisionvirtualmachineswithastandardAPI,independentofaspecifichypervisortechnology.
Inthispart,you’lldiscoverthedifferentpiecesthatcomposeaninstanceonOpenStack,howtheinstancesmodelsaremanaged(calledflavors),howtheinstancesarescheduledinacomputeinfrastructureandthemainhypervisorssupportedbytheproject(SeeFigure2.3).
Figure2.3
PiecesofanInstanceInOpenStack,aninstancehasthetraditionalcomponentsofavirtualizedserverprovidedbyahypervisor.Thesecharacteristicsaredefinedbytheflavorsinthecomputeservice:
OneormultipleallocateddedicatedorvirtualCPUs(vCPUs)
Someallocatedmemory(RAM)
Arootdiskthatcanbeanydeviceattachedtothehostserver(virtualornotvirtual,local,remote,ordistributed)
Theinstanceshaveusuallyoneormultiplenetworksconfigured.Thesenetworkscanbeconfiguredusingthenetworkservice(Neutron),andthenetworkdevices
canbeprovisionedbytheNovaserviceinthehostusingtheNetworkAPIandconfiguredintheinstancebythehypervisor.
Theinstancescanhavepersistentblockstoragesattachedtothem(i.e.avirtualharddriveintheinstance),whichcanbeprovisionedandmanagedusingthevolumeserviceandattachedbythehypervisortotheinstance.
Theconsole(screen)ofaninstancecanbeviewedusingtheVNCserviceinNova,whichcanbecomparedtoaphysicalkeyboard,videoandmouse(KVM)foraphysicalserver.KVMwastraditionallyusedtosharethesedeviceswithmultiplecomputers(https://en.wikipedia.org/wiki/KVM_switch).Todaythesametermisusedtodescribethevirtualaccesstotheseinput/outputsofanOpenStackinstance.ThisNovaserviceispresentedasagoodwaytoabstractthewaytoaccessallofthegraphicalinterfacesandconsolesofalltheinstances,regardlessoftheusedvirtualizationtechnologyandtheinstances’operativesystems.Therearedifferentprotocolstoaccessaninstance’sinterfaceandNovaprovidesaunifiedandtransparentwaytoaccessthem.Forexample,thisservicecanalsoproxyaRDP(RemoteDesktopProtocol)fortheinstancesthatrunMicrosoftWindows.
UnderstandingFlavorsAflavorinOpenStackrepresentsamodelofaninstance:asetofallocatedresourcesforavirtualmachineanditsspecificities.Inpubliccloudserviceswherehostserversaresharedacrossmultipleprojectsortenants(customers),theflavorscanbecomparedtocommercialoffers,wherethebilledresourcesarecalculatedusingthetotaltimetheinstancesofaspecificflavorrunduringamonth.ThisinformationiscalculatedusingtheOpenStackTelemetryService(Ceilometer,seesection3.6).
Acomputeflavorcontainssomeofthefollowingresourcedetails:
Thenameofauniqueidentifier
Theamountofcores(vCPUs)andtheweightiftheyaresharedwithmultipleinstances
Thememory(RAM)andtheswapsize
Therootdiskandephemeraldiskspace
Aflavormaycontainextraspecificationsthatareusefultomakedecisionsduringtheschedulingofaninstanceinacomputeinfrastructure,andtoallocatetherequiredresourcetoruntheinstance(e.g.processorarchitecture,over-provisioning,PCIdevicesrequiredetc.).TheflavorsmaybepublicorlinkedtosomespecificOpenStackprojects.Sincewecanassociatethistoacommercialofferoracomputeinstancemodel,aspecificmodel(orcomputeinstance)canbelimitedtoasimpleprojectorcanbepublicandusedbyanyprojectinanOpenStackinfrastructure.Forexample,whenyoulaunchanewprocessormodelforcustomersinapubliccloud,youcouldcreatededicatedflavorstoallowthem
tousethesenewphysicalservermodelstocreatenewinstances.
SchedulingFiltersWhenaninstanceisprovisionedonanOpenStackcomputeinfrastructure,onetaskofNova,andespeciallyofitsscheduler,istochoosethecomputenode(physicalhost)wheretheinstancewillbecreatedormoved.Youcanfindanoverviewofthescheduleroperations(FilteringandWeighting)inFigure2.4.
Figure2.4
FilteringThistaskisprocessedusingasimpleconcept:thecomputeschedulertakesasetofnodesavailabletouseandappliesasetoffilterstothislisttoeliminatetheonesthatdon’tmatchthedifferentcriteriaoftherequiredconfiguration(refertoFigure2.4).
Herearesomeexamplesofschedulingfilters:
Skipthehoststhatarefull(noCPU,Memoryordiskavailable)
Matchonlyahostthathastheexactamountofresourcesavailable
Usethesamehostofanotherinstance
UseaphysicalhostwheresomespecificPCIdevicesareavailable
Thephysicalhostscanbeaddedinaggregationgroupsthatareusuallyusedtomatchoneormultiplespecificflavorsorprojectsusingaschedulingfilter.Herearetwocommonusecasesofthisfeature:
Anaggregationgroupcanbecreatedforacustomerwithsomededicatedhostsandhardware.Usingextraspecificationsinadedicatedflavor(privateforadomain,aproject,ormultipleprojects),whentheuserwillcreateaninstanceusingthisspecificflavortheschedulerwillfilteronlythehostscontainedinthisspecificaggregationgroup.
Somehostswithspecifichardware(e.g.SSDharddrives,specificCPUarchitecture,etc.)orallocationrules(e.g.dedicatedresources,over-provisionedresources)canbesetinanaggregationgroupandthematchingflavorscreated.Herethehostsmaybesharedwithalloftheprojects(customers)ofthecomputeinfrastructureandtheflavorwillactasapubliccommercialofferwherethehostsaresharedwithsomespecifies.
WeightsOncethehostsarefiltered,theschedulerappliessomeweightsoneachresourceofthehostorinstancetodeterminethebesthosttochoosetoallocateandinstalltheinstance.Forexample,wecouldaddahigherweighttofillanalmostfullphysicalserverwithaninstancethatexactlymatchestheremainingamountofreservedandallocableresources,orconverselytosethigherweighttotheless-usedserversandgettheonethatiscurrentlythelessloaded.
TypesofHypervisorsThecompaniesorcontributorsofhypervisorproductsorprojectsareusuallythemaincontributorofcomputevirtualizationdrivers.Itiseasytoaddacustomdriverthatimplementsonepartorallofthefeaturesabstractedbythecomputeservice,whichisavailableviathecomputeAPI.
LibvirtThelibvirtinLinuxisanabstractionlibrarytoaccessandmanagethevirtualmachinesandcontainersinaLinuxserverandtheirnetworkandstorageconfiguration.Itsupportsmultipletechnologies:KVM/QEMU,Xen,VirtualBox,VMwareESX,Hyper-V,OpenVZ,LXC,etc.
ThisisthedefaultdriverusedbyOpenStackandthemostpopularoneforthekernel-basedvirtualmachine/quickemulator(KVM/QEMU)virtualization.Oneoftheproargumentsismanagingthevirtualmachinesregardlessofthevirtualizationtechnology.ButusingthelibvirtanditsOpenStackdriverhassome
weaknesses,especiallygivenhowitismainlydesignedforKVM/QEMU,andsomefeaturesprovidedbyothervirtualizationtechnologiesmightbehiddenbythisabstractionlayer.HopefullyothervirtualizationtechnologiesaredirectlysupportedusingtheirownNovadrivers.
VMwareUsingVMwareinOpenStackallowsyoutoenjoytheadvantagesofbothtechnologies:virtualizationfeaturesforVMwareandmanagement/standardAPIsforOpenStack.
VMwareprovidesagreatvirtualizationtechnologythatprovidesthefollowing:
HighAvailability(HA);theabilitytoautomaticallyrebootaninstanceonafullworkinghardwarewhenanissueisdetectedbythehypervisor.InthemarketedworldofVMware,the“HA”ismorebrandedas“faulttolerance.”
Faulttolerance(thelivemigrationwithoutrestartofaninstanceonaworkinghostwhenahostisdown).
DistributedResourceScheduler(DRS),thesmartdispatchingoftherunninginstancesdependingoftheresourcesusageinrealtime.
ForstorageyoucandirectlyusetheVMwaredatastoretechnologyinCinderandGlance,allowingyoutomanageallofyourblocksusingthestandardblockstorageAPIs.
STORAGETheconceptofobjectstorage(namedSwiftinOpenStack)canbequitecomplicatedtounderstandforanapplicationdeveloperwhenyouareusingalocalfilesystemtostoreallofthestaticmedias(e.g.images,videos,music,etc.)anddocumentscreatedandusedbyyourapplication.Butthisisoftenoneofthemainstepstohorizontallyscaleanapplicationthatusesthesemedias.
Goodexamplesarethetraditionalcontentmanagementsystems(CMS)andblogenginesthatbydefaultstorelocallyallofthemediasuploadedusingthewebapplication.Thistransitiontoanobjectstorageinfrastructureforanyapplicationisnotalwayseasytorealizesincethecodeoftenneedstobepartiallyrewrittentosupportthisnewstoragesystem.Itneedstobere-writtenbecauseanapplicationneedstochangethewayitaccessesfiles(objects),forinstanceaccessinglocalfilesinaharddriveisnotthesameasaccessingobjectsusingaRESTAPI.
Thereareadvantagesforswitchingtoobjectstorage:
Youdon’thavetoworryaboutthetotalspacesize;thisisthejoboftheinfrastructureprovider,andanobjectstorageservicelikeSwifteasilyscaleshorizontally.
Youcansplitobjectsintomultiplesmallblocksandthesizeofanobjectcanalmostbeunlimited.
Youcanstoreanunlimitednumberofobjectsinasinglecontainerorbucketofobjects.
Thereplicationoftheobjectsisdoneattheinfrastructurelevel;itcanevenbedoneacrossmultipleinfrastructureregions.
Herearesomepotentialblockingdesignandimplementationpointswhenyouwanttoswitchanapplicationusingalocalfilesystemtoanobjectstorageservice:
YoucanaccessyourobjectsonlyusingHTTP(s),butthiscanbegreatwhentheclientsofyourapplicationarealreadyusingtheHTTPprotocol:youcanprovideaccesstoanobjectwithouthavingtodownloaditinyourapplicationserver.
Objectstorageisnotafilesystemandshouldnotbeusedlikeone.Oneoftheworstexamplesistotrytomatchanexistingfilesystemhierarchywhendevelopinganapplicationusinganapplication.Inmanyusecases,thehierarchylogicshouldbeontheapplication-sideandtheobjectstorageshouldonlycontaintheobjectdata(blobs).Thebestexampleofthisbadusageisrenaming(moving)objectsinOpenStackSwift.Sincethedispatchingoftheobjectsacrossthestorageinfrastructureisbasedonahashoftheobjectname,theobjectwillbecopiedbetweentwoserversanddeletedfromthesourceserver.Moreoverrenamingavirtualdirectory(infactanobjectwithamime-typespecifictoadirectory)meansrenamingeachobjectofthedirectory.
IntroducingOpenStackSwiftTheSwiftservice(OpenStack’sobjectstorage)providesalloftheOpenStackprojectswithaHTTPRESTAPI,allowingtheprocessingofallthecommonoperationsonastoredobjectusingthestandardHTTPdesignandfeaturestomanagetheresources(seeFigure2.5).
Figure2.5
Thisprojectishorizontallyscalable,distributedandhighlyavailablebydesignwithdifferentmaincomponents:
Swiftproxyserver:thisservicedispatchestheHTTPrequestsaccessingthedifferentobjectstoallthebackendnodes.Thiscomponentcanbeeasilyscaledsincethepositionsofanobjectinaninfrastructurearedeterminedbyhashingitsnameandfindingitspositionusingaringalgorithm.
Swiftaccountserver:thisserviceisresponsibleforstoringthelistingofthecontainersinthedifferentexistingaccounts.
Swiftcontainerserver:thisissimilartotheaccountserver,butresponsibleforlistingtheobjectsinacontainer.
Swiftobjectserver:thisisastoragebackendinstallableonaphysicalhostthatprovidesaninternalobjectstorageAPItomanagetheobjectsstoredonthelocalserver.
Allofthesecomponentsmustbereplicatedandcanbehorizontallyreplicatedtoinfinity(seeFigure2.6).
Figure2.6
EventualConsistencyOpenStackSwiftiseventuallyconsistent.Forexample,ifacontainerserverisunderaheavyloadandanobjectisPUT,theobjectwillbeavailabletoGETassoonastheobjectisstoredindifferentobjectservers,andassoonastheSwiftproxyserverhandlingtheHTTPrequestrespondstotheclientwithsuccess.Inotherwords,theproxystorestheobjectinseveralobjects’servers,andthenrespondstothePUTwithasuccessfulHTTPresponse.However,theadditionoftheobjectinthelistingbythecontainerservermaybequeuedanddelayed,andaGETrequestonthecontainermaynotlistthisnewobject.Anotherexampleisthatbydeletinganobject(DELETE),anemptyobjectiscreatedwithamorerecentmodificationtimestamptoensurethatthefilecan’tbesynchronizedagainifobjectserverreplica,wheretheobjectisstored,isdown.Dependinguponthesynchronizationdelaybetweenthedifferentobjectserversstoringtheobject,thismightbeavailableforamomentaftertheDELETEoperation.
StoringYourFirstObjectInSwiftThefirststeptostoreanobjectinyourSwiftaccountistocreateacontainerforit.Containersregroupmultipleobjectswiththesamepurposeusingaspecificsetofsettings.Thegranttopubliclyreaditorlistitisanexample.YoucaneasilycreateitusingtheAPIwithcurlastheHTTPclient:
$curl–I-XPUT$swift/my-container-H"X-Auth-Token:$token"
HTTP/1.1202Accepted
Content-Length:76
Content-Type:text/html;charset=UTF-8
X-Trans-Id:5B44C388:EB0D_05C4F7D0:01BB_55AEDF79_18A38C8:4451
Date:Mon,27Jul201522:25:40GMT
Connection:close
Asmentionedearlier,theauthenticationisdoneusingatokencreatedusingtheidentityserviceandspecifiedasaX-Auth-TokenHTTPheader.
Oncethecontaineriscreated,itisnowpossibletostoretheobjectsinsideofit.Torealizethisaction,anotherPUTrequestcanbeprocessedagainstthenewstoredresourcepath:
$curl-I-XPUT-T$object$swift/my-container/my-object
HTTP/1.1201Created
Last-Modified:Mon,27Jul201522:25:43GMT
Content-Length:0
Etag:168e1afe97b471eb8948a1b612283d04
Content-Type:text/html;charset=UTF-8
X-Trans-Id:5B44C388:35C8_05C4F7D0:01BB_55B6AFE5_2125569:444C
Date:Mon,27Jul201522:25:42GMT
Connection:close
That’sall!YourfirstobjectisstoredinyourOpenStackobjectstorageserviceandisnowprivatelyaccessibleusingtheHTTPAPI:
$curl-XGET-i$swift/my-container/my-object.json\
-H"X-Auth-Token:$ktoken"
HTTP/1.1200OK
Content-Length:42
Accept-Ranges:bytes
Last-Modified:Mon,27Jul201522:25:43GMT
Etag:168e1afe97b471eb8948a1b612283d04
X-Timestamp:1438035942-04822
Content-Type:application/json
X-Trans-Id:5B44C388:CCFA_05C4F7C0:01BB_55B6B352_1039A1B:637A
Date:Mon,27Jul201522:40:18GMT
Connection:close
[…]
AlloftheserequestscanbeexecutedusingthecommandlinefromthePythonSwiftClient(https://github.com/openstack/python-swiftclient).Thisprovidesasimplewaytobrowseyouraccounts,containers,andobjects:
#Uploadanobject
$swiftupload<container><file_or_directory>
#Downloadanobject
$swiftdownload<container><object>
TemporarySwiftURLsAnyrequestprocessedagainsttheOpenStackSwiftAPIcanbepre-authenticatedwithacryptographicsignature.ThismechanismallowsthesharingofanauthorizationtoaccessasingleresourcewithasingleHTTPmethod(e.g.POSTswift/my-container/my-object)thatcanbeusedbythird-partysoftware,orabrowser.Thismechanismisreallyconvenientifyourapplicationismulti-tenant
andsharesasingleSwiftAccountformultipleusers.
Let’staketheexampleofanapplicationthatwillstoresomePDFbillsinanobjectcontainerandwillreturntoacustomerofthisapplicationatemporarylinktodownloadoneofthem.TheapplicationwillbeabletoreturntothebrowserasignedURLtoonlyGETtheobjectforalimitedtime.
Thesignaturewillbeverifiedusingasecretkeysetinyouraccount.
#Setthekeyasaaccountmetadata"X-Account-Meta-Temp-Url-Key"
$swiftpost-m"Temp-URL-Key:92cfceb39d57d914ed8b14d0e37643de0797ae56"
#Displaytheaccountinformation(returnedasHTTPheaderswhen
#processinga'GET/v1/AUTH_account'request)
$swiftstat
Account:AUTH_account
Containers:1
Objects:42
Bytes:4200
MetaTemp-Url-Key:92cfceb39d57d914ed8b14d0e37643de0797ae56
Connection:close
X-Timestamp:1365615113.11739
X-Trans-Id:5B44C388:D669_5CDEF184:01BB_55C72581_2160:50A3
Content-Type:text/plain;charset=utf-8
Accept-Ranges:bytes
HereisanexampleofatemporaryURLthatcontainstwoadditionalquerystrings:thetimestamprepresentingthelinkexpirationdate(temp_url_expires)andthecryptographicsignatureitself(temp_url_sign):
/v1/AUTH_acount/c/o?temp_url_sig=9da40a8a7e288027809129d03ea2e5b09be70
d57&temp_url_expires=1439116248
Fortestingpurposesandwhenusingaterminal,youcaneasilycreatetemporarylinksbyusingtheswift-temp-url(https://github.com/openstack/swift/blob/master/bin/swift-temp-url)toolfromtheOpenStackSwiftproject.Here,though,isaprogrammaticexampleinPythonthatcouldbeusedinyourapplication:
#!/usr/bin/envpython
importhmac
fromhashlibimportsha1
fromtimeimporttime
#Expirationtimestampforthelink,herethisoneisin1h
expires=int(time()+60*60)
#MethodauthorizedbythesignedURL
method='GET'
#Relativepathoftheobjectfromtheserverorigin
path='/v1/AUTH_account/c/o'
#The'X-Account-Meta-Temp-URL-Key'metaofyourSwiftaccount
key='92cfceb39d57d914ed8b14d0e37643de0797ae56'
#Signaturecalculation
hmac_body='%s\n%s\n%s'%(method,expires,path)
signature=hmac.new(key,hmac_body,sha1).hexdigest()
#FormattemporaryURL
u='https://{host}/{path}?temp_url_sig={sig}&temp_url_expires={expires}'
url=u.format(
host='swift.example.com',path=path,
sig=signature,expires=expires
)
PublicContainersandAccessControlList(ACLs)Ifyourapplicationwillonlystorepublicdocumentsinacontainer,youcanmarkthisoneaspublicbyusingOpenStackSwiftACLs.
InasimilarfashionthetemporaryURLkeycanbestoredasanaccountmetadata.TheseACLsarestoredatthecontainerlevelascontainermetadataX-Container-Readtoallowpublicaccessorlistingofthecontainer,orattheaccountlevelX-Account-Access-Controltoallowotheraccountsoftheinfrastructuretoaccesstotheaccount.
Let’sfocusonthecontainer-levelACLs.Theyhavethefollowingformat:[item[,item…]]andthuscanbecombined.Twoconceptsareusable:thereferraltogrant(.referrer:example.com,or.r:example.comtoreducethelengthofthelist)andtheabilitytolistthecontainerobject(.rlistings).
Hereishowyoucanallowanyonetoaccessyourpublicdocumentsinyourcontainerandlistthem.
#SetthenewACL
$swiftpost-r'.r:*,.rlistings'os-book
#Listthecontainer"os-book"metadatas
$swiftstatos-book
Account:AUTH_account
Container:os-book
Objects:42
Bytes:0
ReadACL:.r:*,.rlistings
WriteACL:
SyncTo:
SyncKey:
Accept-Ranges:bytes
X-Trans-Id:5B44C388:D847_5CDEF18E:01BB_55C72C0D_155E:1586
X-Storage-Policy:Policy-0
Connection:close
X-Timestamp:1439116292-30845
Content-Type:text/plain;charset=utf-8
UnderstandingBlockStorageSometimeswhenyouuseanOpenStackcomputeinstance,youmayneedadditionalstoragethatcanbemountedasvolumeintheinstance.Thistypeof
storageiscalled“block”or“blockstorage.”
Eachblockactsandisavailableinasingleinstanceasanindividualvolume.AblockisprovisionedbytheOpenStackblockstorageservice(Cinder),whichprovidesatargettoaccessandmountthevolumeinthehostandmakeitaccessibleinaninstance.
Multiplestoragebackenddriversareavailablethatallowyoutohavealmostanystorageinfrastructurebehindastandardabstractionlayer.HerearethemainstoragebackendtechnologiesthatcanbeusedwithCinder.
CephCephisadistributedascalablestoragesolutionthatreplicatesitsdataacrossmultiplestorageservers.Cephcanbeusedasobjectstorage(RADOS),blockstorage(RBD,RADOSblockdevice),andasharedfilesystem(CephFS).Cephblockdevices(RBD)areresizable,thin-provisioned,storethedatainRADOS,andarestripedacrossmultiplestoragedaemons(OSD).
GlusterGlusterisadistributedandsharedfilesystemthatcanbeusedbothasablockstoragebackendandobjectstoragebackend.InOpenStack,Glusterisexposedinasimilarwayasnetworkfilestorage(NFS).
ZFSZFS(orZettabyteFileSystem)isahugeevolutioncomparedtoalloftheexistingfilesystems.Asitsnamesuggests,thisonesupportsanalmostunlimitedstoragesizeandsimplifiestheadministrationandthesecurityofthefilessystems.
Toachievethisgoal,anextraabstractionlevelexistsbetweentheharddrivesandthefilesystemitself:thevolumemanagerthatallowsvirtualizingmultipleharddrivesasasinglevolume.
Onthetopofthisabstractionlayer,ZFSprovidesasystemofpools,whichisareallypowerfulsystemofsnapshotting(aread-onlyversionofafilesystemstoredonthesamevolume).ThespaceusedbytheZFSsnapshotsisthedeltabetweenthesnapshottedversionandthecurrentversionofthefilesystem(similartoanincrementalbackup),thatallowsreallysmallbackupsofthewholefilesystem.
Oneofthemethodsusedtoensuretheintegrityofthedataisthechecksumsinthefilesystem.Eachblockofdatahasachecksumthatisstoredinitsparentblockpointerthatisstoredintheblockitself.Anothermethodistousethecopyonwritemethodtolimitthepossibilityofcreatingerrorswhenwritingdata.
ZFSprovidesscrub,whichreplacesthetraditionalfsck(filesystemcheck)tochecktheintegrityofthedata.Ithasmultipleadvantages,forexample,theabilitytorunitwithouthavingtounmountthefilesystemandcheckthemetadataandthedata,unlikefsckthatonlychecksthemetadata.
LVMLVM(orLogicalVolumeManagement)allowsyoutomanagemultiplelocalharddrivesasasinglevolume,inasimilarwayasZFS,butonasingleserver.ThistechnologyissupportedasaNovadriver,allowingyoutoprovisionlocalharddrivesofNovahostsininstancesofthishost.
IMAGINGTheOpenStackcomputeservice(Nova)storesandaccessestwotypesofinstancesimages:thetemplatesusedtocreatetheinstancesandthesnapshotsyoucantakeofaninstance.
Thecomputeserviceactuallyusestheimagingservice(Glance)togetandstorethedataandthedetailsoftheseimages.Theimagedetailsincludethefollowinginformation:
Thedisplayablenameoftheimage(e.g.DebianJessie)
Thediskformat(e.g.QCOW2,RAW)
Thesizeoftheimageandtheminimumresourcesrequiredtorun
Thestatusoftheimageindicatingapotentialoperationanditsavailability(e.g.queued,saving,active)
Achecksumoftheimage
Theimagescanbeusedtocreatenewinstancesfromexistingdata,andthethreemainusecasesare:
Thebaseimagesofyourinfrastructureusedtocreateanewinstanceandconfigureitfromscratch,usingforexampleaprovisioningtooloraconfigurationmanagementtool(seesection6).
Thesnapshotyoutakefromanexistinginstanceyoucanreusetocreateaninstancewiththesameconfiguration,torestoreabackupofaninstance,ormoreoveritcanbeawaytoresizeaninstance(i.e.changingflavor).
Migrateyourinstancebetweeninfrastructures,regions,providers,andevenbetweenhypervisorsusingstandardimagesformats.
WhereIsItStored?Thedetailsoftheimagesarestoredinarelationaldatabase(bydefaultMySQL,whichisthedefaultforallOpenStackprojects).
Thedataoftheimagescanbestoredindifferentways:alocalfilesystem(thedefaultstoragesolution),blockstorage,andobjectsstorage,orVMwaredatastores.Infact,theimagesdatacanbestoredanywhere;theonlyrequirementistohaveabackendstoragedriverimplementedtosupporttheoperationsonthestoreddata.
Themostcommonwaytostorethedifferentimagesoftheinstancesistousetheinfrastructureitselftostorethem:byflatteningthemassinglefiles(QCOW2,RAW,etc.)andstoringthemintheobjectstorageservice(seeFigure2.7),ortokeepthemstoredasblocksbyusingtheblockstorageservice(Cinder).
Figure2.7
Storingimagesasblockscanbegreatifyouwanttousethesamestorageinfrastructureastheoneusedbytheblockstorageserviceandhavetheabilitytodirectlyattachanimagewithouthavingtodownloadit.Inthiscasetheblockdatawillbetheexactsameoneastheoriginalblockortheoriginaldevicedata.
IfyouareusingaCephinfrastructurebehindyourblockstorageserviceorbesideyourOpenStackinfrastructure,youmaywanttodirectlyusetheCephRBD(RADOSBlockDevice)driverinGlance.By“behind,”wemeanthattheCephinfrastructureisabstractedbytheCinderAPIandusedwiththeCinderdriver.By“beside,”wemeanthattheCephinfrastructureisnotusedinOpenStack,butasablockstorageservicebutcanstillbeusedtostoretheimageswithGlance.ThiswillavoidyouhavinganextraAPIbetweenyourimagingserviceandyourfinalstoragebackendoftheimages,andpotentiallyitcanaddtheabilitytoseparateyourproductionstoragebackendusedtorunyourblockstorageservicefromyourimagingservicethatwillcontainyourtemplateandsnapshot.Thiscouldbe,forexample,differentCephinfrastructures,differentCephOSD(objectstoragenodes),ordifferentCephstoragepoolswithdifferentresourcesallocatedinsideofthesameinfrastructure.
Conversely,youmaywanttostoreflattenversionsofyourimagesinanobjectstorageservice.Forexample,whenusingmainlytheimagingservicetostorealotofsnapshotsasbackups,theimagewillbesimplystoreasfiles,allowingyoutoeasilyuploadanddownloadthemwithouthavingtocreateablockdeviceorreadingallofthedatafromablockdevicetoreturnitovertheimageserviceHTTPAPI.Moreover,youcanstoreimagesinaformatthatusesanoptimizationstrategy,whichcanbegreatifyougeneratealotofdownloadrequestsontheImagingAPI.
IfyouwanttostoretheimagesinanexternalobjectstorageserviceofyourOpenStackinfrastructure,youcanusetheS3storagedriverinGlancetoputyourimages(templatesandsnapshots)intotheAWSS3(AmazonWebServicesSimpleStorageService).Thiscanbeaninterestingsolutiontostoresomebackupsofyourinfrastructureinanexternalsecureservice,allowingyoutopotentiallyhaveadisasterrecoveryplanonAWSEC2(ElasticCloudComputing,theComputeServicefromAWS)usingthedatafromyourOpenStackinfrastructure.
DifferentImageFormatsStoredimagesontheimagingservicecanhavedifferentformats,dependingupontheonesthataresupportedbyyourhypervisorandthefeaturesyouwanttouse.
Thenotionofimageformatincludestwodifferentnotions:thediskformat,whichcorrespondstotherealdataofthediskimageandthecontainerformatthatcontainsthemetadatainformationofadiskimage.
Herearethemostuseddiskformats:
Raw:themostsimpleformatpossible–anunstructuredandexactcopyofadevicedata.Thisoneisusuallyhugesinceitneedstoallocatethewholeimagespaceinasinglefile,sosomepartsareunusedandempty.
QCOW2:standsforQEMUCopyonWrite.Thisformatusesastrategytocompressthedatacontainedintheimage.Theallocationofthestoragesizeisdelayeduntilthespaceisactuallyrequiredtostorethedata.Thusthisformatisflexiblesincethisonecanbeexpandedifsomedataisadded,unliketherawimageofadevice.Moreover,itispossibletostoretheadditionalchangesinanotherfilethatwillcontainthedifferencefromtheoriginalbaseQCOW2image,usingtheCopyonWritefeatureprovidedbythisformat.
VHD:standsforVirtualHardDisk,whichisalmoststandardfortheMicrosofttechnologies(WindowsandHyper-V).Forexample,itispossibletoeasilyattachaVHDimagetoaWindowssystemwithouthavingavirtualizationenginebecausetheOperatingSystemnativelysupportsthisformat.AVHDimagecanbemodifieddirectly,thuschangingsomefiles,andmakingabackuporarecoveryinsidetheimage.
VMDK:thedefaultVMwareimageformat,whichissupportedbyothervirtualizationsolutionslikeQEMUorVirtualBox.Thissupportsmultipleprovisioningstrategiesincludingthethinprovisioning,andallowingprovisioningtheblockonlywhentheseonesarewrittenintheimage.
Theadditionalinformationoftheimages,suchasthemetadatainformation,canbestoredinexternalcontainersiftheyarenotintheimagefile.Inthesamewayastheimagesdataformat,themultiplecontainerformatexistsandaresupportedbyOpenStackandthevirtualizationdrivers.ThemostusedistheOVF(OpenVirtualizationFormat),anopenstandardbasedonanXMLdescriptorfiledetailingthepackagedvirtualmachine.
DASHBOARDOpenStackincludesadashboardprojectnamedHorizon,whichisawebinterfacebuiltwiththeDjangoframeworkandthedifferentOpenStackAPIsfromtheOpenStackservices.
TheGraphicalUserInterface(GUI)providedbytheHorizondashboardisagreatwaytogetstartedwithOpenStackanditsdifferentcomponents.Itallowsbootingyourfirstinstancewithasimplesetupassistant,andthencreatesyourfirstSwiftcontainer,thusmanagingafewresources(seeFigure2.8).
Figure2.8
UsingthisGUIcansimplifyyoureverydaylifeifyourOpenStackprojectsaresmalloruseonlythemainfeatures.Itdoesn’tscalewell,however,whenyoustarttohavehundredsorthousandsofinstancesandnetworks,andwanttousefeaturesthatarenotconsideredbasic.Forexample,creatinganewnetworkportwithaspecificconfigurationandattachingittoanexistinginstancewouldnotbebasic.
Thenextstepisthentousethecommandline(CLI)orthedifferentOpenStackAPIstoadministrateyouraccountorinfrastructureandstarttoautomatethedeployment,managementandtheuseofyourOpenStackresources.
BecausethecommandlineimplementsalloftheAPIs,thisisagoodwaytotestallofthefeatures,anddiscovertheAPImethods,theirrequests,andresponseformatsbeforestartingtodevelopanduseitinanapplication.Otherwisethisonecanbeeasilyscriptedtosimplyautomateandrepeatyoureverydayadministrative
tasksusingOpenStack.
NETWORKINGThenetworkingservicewithinOpenStackisresponsibleforprovidingnetworkconnectivitywithinthecloudaswellasbetweeninstancesinthecloudandtheoutsideworld.OpenStackprovidestwodifferentnetworkingservices.ThelegacysolutionispartoftheNovacomputemodule,andisreferredtoasnova-networkor“Novanetworking.”TheNeutronprojectprovidesthenewnetworkingsolution,andincludesmuchmorefunctionalityandflexibility.
BothsolutionsprovidetwodifferenttypesofIPaddresses:privateIPaddressesandfloatingIPaddresses.TheprivateaddressesaretheonesthattheVMsinstancesthemselvessee.Thatis,runningipaddronaLinuxVMinstancewillshowyoutheprivateaddress.Instancescommunicatewithinthecloudusingtheirprivateaddresses.InOpenStack,eachVMwillhaveatleastoneprivateIPaddress,butitdoesn’tneedafloatingIPaddress.
Thefloatingaddressesarethoseavailablefromoutsidethecloud(andoftenthepublicInternet),andaredirectedtoaspecificVMinstanceusingtheNetworkAddressTranslation(NAT).FloatingIPaddressesmaybeassociatedwithaVMatthetimeofitscreation,oranytimethereafter.TheymayalsobemovedtoadifferentVM–thisiswhatmakesthem“floating”IPaddresses.TheyarenotfixedtoaspecificVMoreventenant,andmaybefreelymovedfromonetoanother.
AnotherimportantconceptinOpenStacknetworkingisthedistinctionbetweenprovidernetworksandtenantnetworks.ProvidernetworksareobjectsdefinedinOpenStackthatprovideinformationaboutapartofthephysicalnetworkinfrastructure,andcanonlybecreatedbyadministrators.ThecloudadministratorcreatesprovidernetworkswithinOpenStackthatcorrespondtothephysicalnetworksconfiguredwithintheinfrastructure.ThisallowsOpenStacktomanagetheconnectivitybetweenthecloudandthephysicalnetwork.ThesenetworkscanbeusedtoprovideexternalaccessviafloatingIPaddresses,ortheycanprovideVMswithIPaddressesonthephysicalinfrastructuresubnets(thusavoidingtheuseoffloatingIPsforthoseVMs).
Incontrast,ordinaryuserscreatetenantnetworks.Thesenetworksareisolatedfromothertenants,andareunderthecontroloftheowner.Theymayormaynotmapdirectlytotheunderlyingphysicalnetworks,dependinguponthesegmentationstrategysetupbythecloudadministrator.Thatstrategyisdefinedbythecloudoperatorandhiddenfromthetenant.Fromanapplicationdeveloper’spointofview,theparticularsegmentationstrategyisnotimportant.Whatisimportantistounderstandthatthetenantnetworksareaccessibleonlytothetenantthatcreatesthem,exceptthroughfloatingIPaddresses.
NovaNetworkingNovanetworkingisdeprecatedinfavorofNeutronnetworking,butsomeexistingcloudsstilluseit,sohavingsomefamiliaritywithitcanbeuseful.
Novanetworkingprovidesasimplenetworkingsolutionwithlimitedflexibilityinthetopologyandconfiguration.Inparticular,tenantshavelittlecontroloverthetopologyandcannotcreatecomplexnetworkingenvironments.
Inmostinstallations,Novanetworkingwillbeconfiguredwitheitherasingle“flat”networksharedbyalltenants,orwithaVLANpertenant(SeeFigure2.9).
Figure2.9
InNovanetworking,asanapplicationdeveloper,youhavelittlecontroloverbuildingoutthetopology.
NeutronNetworkingNeutronnetworkingisthenew,standalonenetworkingservicewithinOpenStack.Asasoftware-definednetworkingsolution,itprovidestheabilitytocreatecomplextenanttopologies,anditintegrateswithawidevarietyofvendorSDNproducts.Theideaistobeabletoreproducephysicalnetworktopologiesinacompletelyvirtualenvironment.JustlikeNovaCompute,whichletsyouvirtualizemachineinstances,NeutronNetworkingletsyouvirtualizenetworkingcomponentssuchasrouters,firewalls,andloadbalancers,asshowninFigure2-10.
InNeutron,thereareseparateNetworknodes(showninFigure2.10),asopposedtoNovaNetworking,whichreliessolelyonthecomputenodes.TheNetwork
nodeshandletheadvancedservicessuchasLoadBalancer-as-a-Service,Firewall-as-a-Service,andVirtualPrivateNetwork-as-a-Service.Additionally,theyprovidetheconnectivitytotheexternalworldoutsidethecloud.InearlyversionsofNeutron(priortoJuno),allLayer3trafficbetweendifferentsubnetswentthroughthenetworknode,evenifitwasbetweenVMsonthesamecomputenode.OnlyLayer2trafficcouldtransitfromdirectlybetweenthecomputenodes,orevenwithinacomputenode.InJuno,theDistributedVirtualRouter(DVR)functionalitywasaddedtoprovidelocalroutingonthecomputenode.However,trafficstillgoesthroughthenetworknodestoleavethecloud,ortoaccessadvancedservices.
Figure2.10
HowNeutronHelpsApplicationsConsiderdeployingathree-tierapplicationinatraditionalenvironment.Youneedtobuyservers,switches,routers,firewalls,loadbalancers,andSSLoffloadloadbalancers–andyou’llneedtheminpairsforredundancy.Eachofthemneedstoberacked,connectedintheexactmannerneededfortheapplication,andmanuallyconfigured.You’llneedtoplanoutthespace,power,andcoolingneedscreatedbythenewapplication.Evenifyouvirtualizetheservers,youstillneedtosetupallofthenetworkinggear.Thisrequiresalotofexpenseincapitalequipmentaswellasalotoftimeforsetup.
APracticalNoteInpractice,youwouldn’tuseallofthisequipment.Modernnetworkdevicescanserveseveralofthesepurposes,eitherdirectlyorthroughservicemodules.InthatcaseyoucanuseVLANtaggingtocreateisolatedsegments,sofromasecurityperspectiveitisequivalent.However,eveninthatcase,Figure2.11illustratesthecomplexityofthisdeployment,aseachoftheseservicesstillneedsmanualconfiguration.
Figure2.11
Inasoftware-definedworld,allofthatcomplexitymovestothesoftwarelayer.Atthehardwarelayer,wehaveuniformracksofservers,withtop-of-rackswitches,typicallyconnectedtoaspine-and-leafnetworkingfabric(seeFigure2.12).
Figure2.12
Theserversherearethecompute,network,storageandotherphysicalnodesinyourcloud.Theleavesarethetop-of-rackswitchesthatallofthesepluginto.Thespinesaggregateallofthetrafficfromtheleaves,andeveryleafcanreacheveryotherleafwithjusttwohops,sinceeveryleafconnectstoeveryspine.Additionally,inter-leaftrafficcanbespreadacrossthespineswithouttakingalongerpath.Thishelpsreducebottlenecks.Inthislayout,youstillhavefullredundancyaseachserverisduallyconnectedtotwoleaves.
Noneofthehardwarelayerchangesarebaseduponapplicationdeployments,aslongasthereiscapacity.Andwhenthereisachange,youcanaddaserversorracksinasimpleandconsistentway,withouthavingtoknowanythingabouttheapplicationsthatwillberunningonthem.
Asnewapplicationsareprovisionedanddecommissioned,thereisnolongeraneedtorack,cableandconfigurespecifichardwaredevicesforthoseapplications.Networksareoverlaidontopoftheconsistenthardwareviaautomationandpuresoftware-basednetworkdevices.Youcreatevirtualrouters,loadbalancers,andfirewallsinsoftware,andconnectthemviaAPIcalls.Thiscandramaticallycutdownonthetimeittakestodeployanapplication,aswellasenablerepeatable,template-baseddeployment.
Ofcourse,softwaremaynotperformaswellasspecializedhardware.Additionally,therearemanyfeaturesthatthestandardOpenStackreferenceimplementationdoesn’tsupport.Neutronprovidesarichsetofpluggableinterfacestoaddresstheseconcerns.Thesepluginsenablethird-partyvendorstointegratedirectlyinto
theNeutronservice,extendingitsfunctionality.PluginscaninteractwithexternalSDNcontrollersorexistingphysicalnetworkinggear,provideadvancedservicessuchasVPN-as-a-Service,orintegratewithexternalIPAddressManagementplatforms.Thedifferencebetweenthisandsettingupatraditionalnetworkforanapplication,though,isthatitisstillalldonewiththesame,simpleAPIs,ratherthanthroughvendor-specificproprietaryconfigurationprotocols.
UnderstandingCoreNeutronObjectsTheNeutronobjectmodelconsistsofsomefamiliaranalogswiththephysicalworld,suchasports,subnets,androuters.TherearealsosomelogicalconceptsthatreallyonlyexistinOpenStack,suchassubnetpoolsandaddressscopes.
ANeutronnetworkcorrespondstoaLayer2broadcastdomain.Ifyou’renotthatfamiliarwithnetworking,inthephysicalworldyoucanthinkofthisasessentiallyasingle“wire”fornodestotalkover.Layer2dealsexclusivelywithMACaddresses–thereisnoneedforIPaddressesinthislayer.Switchesprovideoptimizationsontopofthe“singlewire”modelbyforwardingEthernetframesdownonlythenecessarylinks.TheyalsoprovideVLANs–orVirtualLocalAreaNetworks–whichallowyoutodivideasingleswitchintomultiplebroadcastdomains.Essentially,yougettosaywhichports“gotogether”.InNeutron,thenetworkmodelcapturesthisconcept.
ANeutronsubnetprovidestheLayer3connectivity.Thatis,itprovidestheIPaddressingandenablesNeutronrouterstopasstrafficbetweenNeutronnetworks.Thisisverysimilartothestandardnetworkingmodel.AsubnetisassociatedwithaparticularLayer2network,andaNeutronrouterisusedtointerconnectsubnets,justlikeinthephysicalworld.
InNeutron,whencreatingarouteryoucanadditionallyspecifythatitprovidehighavailability(HA),orthatitbeadistributedvirtualrouter,whichasmentionedaboveisspreadoutacrossallofthecomputenodes.DVRisamorerecentimplementationthanthestandardrouter,andassuchhassomelimitations.AsoftheKilorelease,DVRdoesnotworkwithFWaaSforeast-west(betweenVM)traffic.Also,itrequirescomputenodestohaveapublicIPtohandledistributedfloatingIPaddresses.
ANeutronportisassociatedwithanetwork.ItsanalogintherealworldisanactualswitchportwhereyouwouldpluginanEthernetcable.Itisthepointofattachmenttoanetwork.NeutronwillprovideNovawithaportto“plugin”theinstanceinterface.OnedistinctionthoughbetweentherealworldandNeutronisthatinNeutronaportisalsoautomaticallyassociatedwithoneormoreIPaddresses(oneforeachsubnetonthenetwork).ThisisablurringoftheLayer2andLayer3semantics,andmayberesolvedinalaterreleaseofNeutron.
ANeutronsecuritygroupprovidessimple,firewall-likefunctionality.Rulesmaybedefinedforingressandegresstraffic,andthoseruleswillbeappliedattheNeutronport.Thereisadefaultsecuritygroupthatwillallowtrafficbetween
instancesinthatgroup,andtrafficoutboundfrominstancesinthegroup(egresstraffic),butitrestrictsallinboundtraffic.YoucanutilizetheFirewall-as-a-Serviceprojectformoresophisticatedfeatures.
TheKiloreleaseofNeutronaddedanotherconceptthatismoreabstractthanthosedescribedpreviously–thesubnetpool.AsubnetpoolisacollectionofIPnetworkprefixesfromwhichatenantmayallocatesubnets.Thatis,inJunoandearlier,thetenanthadtospecifyaspecificsubnet–like10.10.10.0/24–toallocate.InKilo,thecloudadministratorcancreateasubnetpool–say10.10.0.0/16–fromwhichthetenantcanaskfor“anysubnet”ofaparticularsize.Thisway,thetenantreallydoesnotneedtofigureoutaheadoftimewhatthesubnetshouldbe–theycanjustaskthesubnetpooltofigureitout.Forexample,withoutsubnetpools,youwouldusethisAPIcalltocreateanewsubnet:
neutronsubnet-createprivate-network10.1.0.0/24
Thisrequiresthecallertoknowthat10.1.0.0/24isavalid,availablesubnetthatcanbeused.Withsubnetpools,theadministratorcancreateapoolforspecificuses–say,forwebservers.Thispoolcontainsawiderangeofaddressesfromwhichtoallocatesubnets,aswellasadefaultprefixlength(the“/24”above,whichcorrespondstothesubnetmask).So,insteadoftheabove,youcanexecuteasimplercommand:
neutronsubnet-createprivate-network–subnetpoolweb-pool
ThiscompletelyseparatesthedecisionsaboutIPaddressandsubnetallocationfromthesubnetcreationprocess.This,alongwiththePluggableIPAddressManagementfeatureaddedinLiberty,iscriticaltousingcloudsinlargerorganizationsthathavedifferentgroupsmanagingIPspaceandapplications.
InLiberty,onemoreconceptisadded,calledanaddressscope.ThisrepresentsauniqueLayer3addressspace.InNeutron,youcancreatethesamesubnetCIDR(forexample,10.0.0.0/24)ontwodifferentnetworks.ThiscanleadtooverlappingIPaddresses.ThisisperfectlyvalidinNeutron,exceptthatyoucannotconnectthosetwonetworkstothesamerouter.Ifyoudid,thenNeutronwouldnotbeabletodistinguishbetweenthesameIPaddressoneachnetwork.Theaddressscopegeneralizesthis,providinganobjectwithinNeutrontorepresenttheaddressspacetowhichasubnetbelongs.Bydoingthis,Neutronenablesbettercontroloverrouting,andpreventsmultipleusersfromaccidentallycreatingoverlappingspace.ItalsoletsNeutronknowwhenNetworkAddressTranslation(NAT)maybeneededevenbetweennon-overlappingsubnets–thiscanpreventaccidentaloverlapbetweenothersubnetsontherouter.
UnderstandingOverlayNetworksOneofthekeyfeaturesprovidedbyNeutronistheconceptofoverlaynetworks.Anoverlaynetworkisjustasegmentation,orsegregation,ofthenetworktrafficthatridesonthephysicalnetwork.Thekeypartisthatfromthepointofviewof
theVM,thereisasingle,ordinarynetwork.Butinfact,thisisanillusioncreatedbyNeutron,sincethedataisactuallymovingacrossvariousphysicalboundariesinthedatacenter.Forexample,whenaVMsendsoutaLayer2broadcastsuchasanARPrequest,thatrequestmaybepackagedupandsentacrossthephysicalnetworktoseveraldifferentcomputenodes.Then,itisunwrappedonthosenodesanddeliveredtoeachVMonthesameoverlaynetwork.Itisoverlaynetworksthatprovidetheabilitytoseparatetenanttraffic,enablingustosharetheunderlyingphysicalinfrastructureandthusmakefulluseofit(SeeFigure2.13).
Figure2.13
ThesimplestandmostfamiliarformofanoverlaynetworkistheVLAN.AVLANtagsEthernetframeswitha12-bitnumber,andthisenablesthephysicalnetworkinggeartodifferentiatebetweenthetrafficthatbelongswithindividualVLANs.WhenausercreatesatenantnetworkinNeutron,itcanbeassignedaparticularVLANtag,andNeutroncanthenkeepallofthattrafficsegregatedfromothertrafficwithinthenetwork.
Abigdrawback,however,isthata12-bittagprovidesatmost4096VLANs.Inalargemulti-tenantcloud,theremaybemanymoreseparatenetworksrequired.Othertechnologieshavebeendevelopedtoaddressthisgap.ThetwoyouwillseeinOpenStack’sreferenceimplementationareVirtualExtensibleLocalAreaNetwork(VXLAN)andGenericRoutingEncapsulation(GRE).WhileVLANsarebasedonLayer2technology–theytagEthernetframes–thesetwotechnologiesarebaseduponLayer3technology.Thatis,theyworkbyencapsulatingthedatainIPpacketsratherthanbytaggingEthernetframes.Thiscanallowtheoverlaynetworkstostretchacrosslargernetworks.Additionally,theVXLANprotocolprovidesa24-bitnumbertodifferentiatenetworks,allowingover16milliondistinctoverlaynetworks.
BRINGINGITALLTOGETHERTohelpunderstandhowthesedifferentpiecesinteract,let’sstepthroughwhathappenswhenyoulaunchaVMandseehowallofthepiecesfittogether.ThisisasimplifiedworkflowthattheuserandthevariousserviceswillgothroughinatypicalcaseoflaunchingaVMwithephemeralstorageonly(i.e.,thestorageandalldiskcontentsgoawaywhentheVMisterminated).Manyinternalstepsareglossedoverhere,sincethefocusisontheinteractionbetweentheservices.
InordertobootanyVM,you’llneedtoprepareafewthingsfirst.Forthisexample,wewillusetheindividualserviceCLIclients.Thereisalsoageneralopenstackclientbutitdoesnotofferallofthefeaturesoftheseparateserviceclients.
First,youneedtodecideontheflavoroftheVMyouwant.TheflavorrepresentsthecombinationofCPUs,memory,andstoragefortheVM.TheflavorscanberetrievedfromNova(somecolumnsomittedforbrevity):
$novaflavor-list
+----+-----------+-----------+------+-----------+------+-------+
|ID|Name|Memory_MB|Disk|Ephemeral|Swap|VCPUs|
+----+-----------+-----------+------+-----------+------+-------+
|1|m1.tiny|512|1|0||1|
|2|m1.small|2048|20|0||1|
|3|m1.medium|4096|40|0||2|
|4|m1.large|8192|80|0||4|
|42|m1.nano|64|0|0||1|
|5|m1.xlarge|16384|160|0||8|
|84|m1.micro|128|0|0||1|
+----+-----------+-----------+------+-----------+------+-------+
$
Wewillusem1.tiny.
Next,youneedtoknowwhatimagetouse.TheimagecontainsthebootableoperatingsystemfortheVM.Untilweneedtoactuallybuildanapplication,examplesinthisbookwillgenerallyuseCirrOS(https://launchpad.net/cirros),whichisaverysmall,minimalOSthatisusefulfortestingofthecloudplatform.Ifyouarefollowingalong,thenotherimagesmaybeavailableonyourOpenStackinstance.Chooseasmalloneforexperimentation.
$glanceimage-list
+---------+---------------------------------+...+----------+--------+
|ID|Name|...|Size|Status|
+---------+---------------------------------+...|----------+--------+
|6d…e0|cirros-0.3.4-x86_64-uec|...|25165824|active|
|5f…92|cirros-0.3.4-x86_64-uec-kernel|...|4979632|active|
|06…c6|cirros-0.3.4-x86_64-uec-ramdisk|...|3740163|active|
+---------+---------------------------------+...+----------+--------+
$
Sincewewanttobeabletoaccessourinstanceoverthenetwork,ratherthanjust
viatheconsole,youneedtoattachittoanetwork.So,calltheNeutronservicetofindouttheavailablenetworks.
$neutronnet-list
+---------+---------+------------------------------------------------------
----+
|id|name|subnets
|
+-------------------+------------------------------------------------------
----+
|50…56|public|09c872aa-02fa-4e81-9cb1-846399938c642001:db8::/64
|
||b9d882f3-8378-42cc-b5fa-4cb2576c7fb4192-168.20.0/25
|
|fa…ea|private|5bd94138-3a4a-4966-b216-b4530a0f489d
fddc:b6e3:ede0::/64|
||ece9ba64-cf28-424c-8187-8df763301a5610.0.0.0/24
|
+---------+---------+------------------------------------------------------
----+
NowwehaveeverythingNovaneedstoknowatboottime,sowesimplyrunthenovabootcommand(outputhasbeenabbreviated).
$novaboot–flavorm1.tiny–imagecirros-0.3.4-x86_64-uec\
–nicnet-id=fa3282e4-64ba-44fa-9644-46da784234eai-1
+--------------------------------------+-----------------------------------
---+
|Property|Value
|
+--------------------------------------+-----------------------------------
---+
|
|OS-EXT-STS:power_state|0
|
|OS-EXT-STS:task_state|scheduling
|
|OS-EXT-STS:vm_state|building
|
|OS-SRV-USG:launched_at|-
|
|OS-SRV-USG:terminated_at|-
|
|created|2015-07-24T05:52:20Z
|
|flavor|m1.tiny(1)
|
|id|a9d9e891-e85a-471b-9844-
cd3eda0659a0|
|image|cirros-0.3.4-x86_64-uec(6d…e0)
|
|key_name|-
|
|metadata|{}
|
|name|i-1
|
|progress|0
|
|security_groups|default
|
|status|BUILD
|
|tenant_id|56082fc3830e43d4af307bed5d1d5f90
|
|updated|2015-07-24T05:52:20Z
|
|user_id|e749c12a525d4b259e0e291fd91ca53a
|
+--------------------------------------+-----------------------------------
---+
$
SowhatdoesNovadowhenweinitiatethebootcommand?First,itvalidatesourcredentialswithKeystone,tomakesurewehavetheauthoritytolaunchtheVM.Afterthat,thebootprocessisastatemachinethattakestheinstancestatefromBUILDtoACTIVEundernormalcircumstances.NovafirststorestheinstanceinthedatabasewithStatusBUILDandTaskStatescheduling.TheprimaryStatusremainsBUILD,sotoseetheprogressofthebootweneedtolookatthesecondaryTaskStatus.BothstatusesaretrackedintheNovadatabase.
$novalist
+---------+------+--------+------------+-------------+--------------+
|ID|Name|Status|TaskState|PowerState|Networks|
+---------+------+--------+------------+-------------+--------------+
|a9…a0|i-1|BUILD|scheduling|NOSTATE||
+---------+------+--------+------------+-------------+--------------+
Next,novasendsarequesttotheNovascheduler(runningonthecontrollernode)viathemessagequeue.Itisthescheduler’sjobtofigureoutthephysicalcomputenodeonwhichtoruntheinstance.ItwillselectanodebaseduponthecharacteristicsoftheVM–howmuchCPUandmemoryitneeds,forexample–andtheavailablecapacityofeachhost.Itwillthenpostarequestbacktothemessagequeuethatincludestheselectedhost.Thecommandresultsaboveshowtheschedulingstate,however,inpracticeschedulingwilllikelybefastenoughthatyouwon’tcatchitinthatstate.
Novapicksthescheduledinstancerequestoffthequeueandupdatesthedatabase,thensendsamessageacrossthequeueagain–thistimetothenova-computeprocessthatsitsontheselectedcomputehost.ThenovacomputeagentmakesaRESTfulAPIcalltotheGlanceimageservicetoretrievetheimage.
Eachtimeoneservicetalkstoanother,Keystonemaybeinvokedtovalidatethetoken(thedetailsdependonthetypeoftoken).Inthiscase,Glancewouldverifythattheuserhaspermissiontotheselectedimage.Ifso,Novadownloadstheimagetoitsimagecache.
Nowthehostisselectedandtheimageisavailableonthathost.ButNovastillneedstoknowhowtoconnecttheinstancetoanetwork.Itsetsthetaskstatustonetworking,andthencallstheNeutronnetworkingservicetocreateaport.Theportcanbethoughtofjustlikeareal,physicalswitchport.Itprovidesaplaceto“plugin”theinstancenetworkinterfacetothevirtualswitchingfabric.Again,thisbetween-serviceinteractionisdoneviathesameRESTfulAPIsthatotherclientsuse.Infact,wecouldhavecreatedtheportaheadoftime,andprovidedaport_idtoNovainsteadofanetwork_id.
NeutroncreatestheportandallocatesandIPaddressonasubnetassociatedwiththesuppliednetwork_id.LikeNova,Neutronhasagentsrunningoneachcomputenode.Itisonthatnodethatitwillcreatethevirtualport.
FinallyNovatakesallofthisinformation,setsthetaskstatustospawning,andcallsthehypervisor(KVMbydefault)toactuallyspinuptheinstance.
SUMMARYInthischapteryoulearnedindetailaboutthecorecomponentsofOpenStackandhowtheyworktogethertocreateacloud.Finally,youputitalltogethertounderstandthedetailsofhowNovainteractswithKeystone,Neutron,Glance,andCindertospinupvirtualmachines.ThesearethebasicservicesyouwillfindinmostOpenStackclouds,butthereareahostofotherservices.Inthenextchapter,wewilllookatsomeofthelesscore–butstillimportant–servicesofferedinsomeOpenStackclouds.
3UnderstandingtheOpenStackEcosystem:AdditionalProjectsWHAT’SINTHISCHAPTER?
UnderstandingCloudOrchestration
OrchestrationcapabilitiesinOpenStack
OpenStackHeatindetails
Software-defined-storage(SDS)
ClouddatabasesasausecaseofSDS
Clouddatabases:maintainorconsume
OpenStackDatabaseasaService:Trove
AlookatMagnumandContainersasaService
CoverageofMuranoandCeilometer
ThecorecomponentsdiscussedinChapter2coverthebasicIaaSfunctionalityofOpenStack.Justusingthosefeatures,OpenStackenablesyoutosetupandrunapplications.However,thereismoretobuilding,deploying,andsupportinganapplicationthaniscoveredinthosecomponents.ThischapterwilldiscussadditionalOpenStackprojectsthatenableyoutodefinerepeatableapplicationdeploymentsonVMsorcontainers,makethoseapplicationsavailableviaDNS,andmonitorthevirtualinfrastructureonwhichthoseapplicationsarehosted.Althoughthesearen’tlabeledasorchestration,suchapplicationsalsorequiremanualconfigurationanddeploymentinsomemanner.ThischapterwillcoverhowtouseOpenStacktomanagecontainer-basedapplications,howtopackageapplicationsforusebyothers,andhowtotakeadvantageoftheDatabase-as-a-Servicefeaturetoshiftmorecomplexityfromyourapplicationtothecloudinfrastructure.
DEMOAPPLICATIONSOURCECODEYoucanaccessthesourcecodefromourdemoapplicationviaGitHub:https://github.com/johnbelamaric/openstack-appdev-book.
OPENSTACKHEATIncloudcomputingtheory,itiswellknownthatthereismorethanonetypeofservice.Oneofthemostpopularandinteresting(intermsofflexibility)servicesisthePlatform-as-a-Service(PaaS),whichallowsyoutotapintocloudcapabilitiesindifferentways,suchaswithacloudorchestrationservice.Let’stakealookatthescientificdefinitionofcloudorchestration:
Itprovidesyouwiththeabilitytocontrolandarrangeasetofunderlyingtechnologyinfrastructures(hardwareandhypervisor).Youcanmatchtheintendedcommandsinputtedbytheuserstocreateasetofautomatedeventsthatdelivertherequestwiththemaximumefficiency(source:http://howtobuildacloud.com/cloud-enablement/cloud-orchestration-starts-to-play-its-tune/)
Itprovidesyouwiththeabilitytomanage,coordinate,andprovisionallpartsofacustomersolutionautomatically,withnoadministrativeintervention,ideallyfromaself-serviceinterface.Thisismuchlikeaconductorwhoconductsanorchestramakingsurethatalloftheinstruments/performersareintuneandintime(source:https://www.flexiant.com/).
Puttingdefinitionsaside,themostimportantpointofcloudorchestrationservicesisnotwhattheyare,butwhattheydo.Asacloudconsumer,aprovider,oraresellerofcloudservices,allthatmattersisthatcloudorchestrationmakesyourcloudconsumptionexperiencebetter.Ifyouarelookingforsomeserviceorcapabilitythatwillmakeyourcloudapplicationresourcesmorescalable,instantlydeployable,efficient,simplertouse,andeasiertobillandmanage,youarelookingatcloudorchestrationservicecapabilities.
Youmayquestiontheideathatanorchestrationserviceisaplatformservice,butcloudorchestratorswerethefirstservicesthatgaveusanabilitytoconsume/operatecloudresourcesinapre-definedway(specificDSL)withinasingleAPIspecification(justrememberolddays,whenyouhadtolearntonsofAPIspecstoaccomplishyourbusinessneeds).
OrchestrationCapabilitiesinOpenStackSo,cloudorchestrationissomethingthatyoucan’tlivewithout,butwhataboutOpenStack?Canyousaythesamething?Let’sexaminetheOpenStackorchestrationservice,calledHeat.
HeatisthemainprojectintheOpenStackorchestrationprogram.Itimplementsanorchestrationenginetolaunchmultiplecompositecloudapplicationsbasedupontemplatesintheformoftextfilesthatcanbetreatedlikecode.AnativeHeattemplateformatisevolving,butHeatalsoprovidesthecompatibilitywiththeAWSCloudFormationtemplateformat.ThisallowsmanyexistingCloudFormationtemplatestobelaunchedonOpenStack.HeatprovidesbothanOpenStack-nativeRESTAPIandaCloudFormation-compatibleQueryAPI
(source:https://wiki.openstack.org/wiki/Heat).
OpenStackHeatinDetailsLet’sexaminewhatHeatcandoforyou.BelowyoucanseealistoftemplatetypesthatHeatsupports:
HOT:(HeatOrchestrationTemplate).HOTtemplatesareanewgenerationoftemplatesthataren’tbackwards-compatiblewithAWSCloudFormationtemplates,andcanonlybeusedwithOpenStack(DSLforHOT—YAML).
CFN:ShortforAWSCloudFormation.ThistypewasinitiallysupportedsinceHeat’sfirstreleases(DSLforCFN-JSON).
Eachtemplatedefinesinfrastructureresourcerequirements,therelationshipbetweeneachoftheresources,andanysoftwareconfigurationnecessaryinordertomanageacompleteapplicationresourcelifecycle.
Beforelookingatatemplateitisnecessarytounderstandafewterms:stack,resource,parameter,andoutput.
Stack:acollectionofobjectsdescribedbyatemplatewithitsrelationships/dependenciesthatwillbedeployedinthecloud.stackincludesinstances(VMs),networking,blockstorage,objectstoragebuckets,andauto-scalingrules.
Resource:anelementofstack.Forexample,VM,securitygroup,subnet,andblockstoragearetheresourcesofstack.
Parameters:thesearetidbitsofinformation,likeaspecificimageID,flavor,volumesize,oraparticularnetworkIDthatispassedtotheHeattemplatebytheuser.Ingeneralcases,templatesareparameterizedtoallowsomeflavorofflexibility,yetincommoncasesitisuptotheuser.Thegeneralapplicationofparameterslaysinconfiguringresources.Forexample,ifyouneedtodeployavirtualmachine(VM)resource,youhavetoexplicitlydefinetheflavorandtheimageID.Theseareparametersforresourcesandinthetemplateitispossibletohaveahugesectionforparametersinreallife.Parametersarenotamandatorything,however,butitispossiblethattheresourcedefinitionputssomedefaultvaluesinresourceconfiguration.
Outputs:thisisinteresting,sinceincommoncasesitoutputsafullycustomdatastructurethatisbeingdefinedattheendofasuccessfuldeployment.Let’sjustreviewasmallexample.Let’ssayyouhavethreeresources:VM,securitygroupwithrules,andsoftwaredeployment.TheideahereistodeployaVMwithsoftwareinit(Nodecellar,Wordpress,MySqlorwhatever)andweneedtorestricttheaccesstothatdeployedapplication.Thisdeploymentconfigurationassumesthatwe’redeployingaPaaSapplicationandusersareabletoaccessitwithinspecificconnectionstrings.Herearethetemplateoutputs:oncedeploymentisready,Heatwilltrytogetoutputsaccordingtoitsdefinition
fromthetemplateusingbuilt-intemplateDSLfunctions.
Nowit’stimetotakealookatareal-lifeexampleofaHeattemplate:
heat_template_version:2013-05-23
description:>
AHOTtemplatethatholdsaVMinstancewithanattached
Cindervolume.TheVMdoesnothing,itisonlycreated.
parameters:
key_name:
type:string
description:Nameofanexistingkeypairtousefortheinstance
constraints:
-custom_constraint:nova.keypair
description:Mustnameapublickey(pair)knowntoNova
flavor:
type:string
description:Flavorfortheinstancetobecreated
default:m1.small
constraints:
-custom_constraint:nova.flavor
description:MustbeaflavorknowntoNova
image:
type:string
description:>
NameorIDoftheimagetousefortheinstance.
Youcangetthedefaultfrom
http://cloud.fedoraproject.org/fedora-20.x86_64.qcow2
Thereisalso
http://cloud.fedoraproject.org/fedora-20.i386.qcow2
Anyimageshouldworksincethistemplate
doesnotasktheVMtodoanything.
constraints:
-custom_constraint:glance.image
description:MustidentifyanimageknowntoGlance
network:
type:string
description:ThenetworkfortheVM
default:private
vol_size:
type:number
description:ThesizeoftheCindervolume
default:1
resources:
my_instance:
type:OS::Nova::Server
properties:
key_name:{get_param:key_name}
image:{get_param:image}
flavor:{get_param:flavor}
networks:[{network:{get_param:network}}]
my_vol:
type:OS::Cinder::Volume
properties:
size:{get_param:vol_size}
vol_att:
type:OS::Cinder::VolumeAttachment
properties:
instance_uuid:{get_resource:my_instance}
volume_id:{get_resource:my_vol}
mountpoint:/dev/vdb
outputs:
instance_networks:
description:TheIPaddressesofthedeployedinstance
value:{get_attr:[my_instance,networks]}
Asyoucansee,thistemplatewaswrittenusingHOTDSL,andhereisthelistofparameters:
key_name
flavor
image
network
vol_size
Andhereisthelistofresources:
my_instance
my_vol
vol_attr
Herearethestackoutputs(asyoucanseenow,HOTDSLprovidesasetoffunctionstoretrievespecificresourceattributesorgetdeploymentparameters):
instance_networks
Let’sfigureoutwhatthistemplatedoes.ItdeploysaVM,provisionsablockstorage(datavolume),attachesvolumetotheVM,andaspartoftheoutput,itreturnsanIPaddressoftheVM.AsforOpenStackoperators,let’sexaminethearchitectureofHeat(seeFigure3.1):
heat-apiisanOpenStack-nativeRESTfulAPI.ThiscomponentprocessesAPIrequestsbysendingthemtotheHeatengineserviceviaAMQP.
heat-api-cfnissimilartotheCloudFormation-compatibleRESTfulAPI.
heat-engineprovidesthemainorchestrationfunctionality.
Figure3.1
Thischapterisnotaboutthehands-onbestpracticesfordeployingHeatintoyourOpenStackenvironment.You’veseenwhatHeatcando,though,andhowitcandoit.IfyouareinterestedindevelopingorconsumingHeat,itisnecessarytolearnitsAPIandtechnologystack.
Let’ssumupwhatwe’velearnedaboutorchestrationinOpenStack.Ithasarichecosystemofmodulesavailabletofacilitateautomationthroughoutallstagesofthestack’sresourcesandtheirlifecycle,resultingingreatlyreducedtime-to-marketformanyITdemands/projects.HeatistheleadingorchestrationtoolforOpenStack-basedclouds,anditisanofficialpartoftheOpenStackdistribution.Withstrongenterprisesupportandsubstantialon-goingcontribution,HeatisfastbecomingthegreattoolofchoiceforOpenStackprivateandpublicclouds.
OPENSTACKDATABASEASASERVICE:TROVEWehavecoveredorchestrationinthecloudandhowitcanhelpyourbusiness.Let’sspendsometimecoveringthedifferencesbetweencreatingapplicationsinandoutofacloud.Asasoftwarearchitectyouneedtogiveeveryonethebasicideaofhowyourapplicationshouldbedeployedandhowitshouldwork,especiallyinacloudinfrastructure.Ingeneral,youneedapersistentstorageforyourapp—youneedadatabase.So,whatcloudcangivethattoyou?WouldthatbeaclouddatabaseorjustInfrastructure-as-a-Service(IaaS)?
CloudDatabaseAsUseCaseofSoftware-Defined-Storage(SDS)YoumaywonderifHeatisabletobethesoftwarethatdefinesstoragewiththehelpofitsDSL.Thisistrue,butitisnecessarytohaveanabilitytomanagestorageinaveryspecificway.Forexample,giventhatsoftwareshouldenableasoftware-definedstorageenvironment,itmayalsoprovidepolicymanagementforfeatureoptionssuchasdeduplication,replication,clustering,fault-tolerance,thinprovisioning,snapshots,andbackup.
InthecaseofHeat,itisprettycomplicatedtoprovideallofthesecapabilities,sinceitwouldmakecloudorchestrationverycomplicatedandhardlymaintainable.ThatiswhyyoushoulduseHeatorimplementyourownorchestration,sinceacustomengineforserviceswilldothestorageprovisioning.WithinOpenStack,youcanfindabigvarietyofservicesthatdostorageprovisioning:Cinder,Swift,andManila.
Speakingofpersistentstorage,asadeveloperyouneedtohavethecapabilityofdeliveringadatabaseasaspecificusecaseofsoftware-definedstorage.ThisisgreathavingaservicethatusesdatabasedeliveryusingconceptsofSDS,andtakingalldeploymentsandmaintainingthembehindthescene.
Aclouddatabaseisadatabasethattypicallyrunsonacloudcomputingplatform,inourcasethatisOpenStack,andprovideslimitedaccess,allowinguserstointeractwiththedatabasethroughitsnativeAPI.Foralongperiodoftimetherewerenoclouddatabases,sodatabaseconsumerstriedtodealwithitintheirownway.Therearetwocommondeploymentmodels:userscanrundatabasesonthecloudindependently,usingapre-configuredvirtualmachineimage,ortheycanpurchaseaccessproprietarysolutionsthatareworkingabovedifferentcloudplatforms.Sowhat’stheproblemwiththelastapproach?
OpenStackandTroveThereareproblemswithusingproprietarysolutionsthatareworkingondifferentcloudplatforms.Itisnotenoughtobuyaproduct,sincewithinsomeperiodoftimetheproductmustbesupported.Andifyouareawareofsoftwareservicesandsoftwareproductbusinessmodels,youwoulddefinitelychooseaservicethatprovidesdatabasesinsteadofdevelopingandsupportingyourowncustom
solution.Thisisbecauseitseemsthatproductsalwayscostlessbecauseofaone-timepurchaseandnosupport,yeteveryproblemisyourpersonalheadache,andsupportforproductsingeneralbecomesmoreexpensivethanthecostoftheproduct.Ontheotherhand,purchasingaservicesubscriptiontakeslessmoneyduetoitstimeaccessrestrictions,butinthecaseofsoftwareservicessupport,itisbeinghandledbytheserviceprovider.
NotethatthefirstclouddatabaseservicewasprovidedbyAmazonAWS,calledAmazonRDBS.Itisonlyrelational,NoSQLnotevenonce,butwhenRDBSwasreleased,NoSQLwasnotwidelyavailable,soAmazonAWScustomerswerecompletelysatisfiedbySQLdatabases.Currently,RDBSisstillaliveandpopular,andnothingmuchhaschanged(newflavorsofdatabaseswereadded,whichareareplicationforMySQL).
Enterprisesneedclustersanddatacentersfullofclusters,andtheyneedthemasquicklyaspossible.So,hereareourdemands:weneednewSQL/NoSQLsolutions,weneedclusters,andweneedautomatedmanagementoperations(seeSDScapabilities),andfinally,weneeditallinOpenStackbytheendoftoday.So,OpenStackdefinitelymissedsuchabilities,primarilythewaytodeclarestorageasadatabaseusingaspecificlanguage.ThereareacoupleofpossiblewaystoaccomplishdatabaseinstallationwithinOpenStack:
Firstboot.dorcloud-init
Chef
Puppet
Ansible
Post-provisioningscriptsexecutionwithfabric
Itiseasytodeployadatabase.Butwhataboutthecostofyourtimetoautomatemanagementtasks?Ifyouchoosethispath,eventuallyyouwouldendupspendingtime/moneytoupdateyourscriptstoadoptthemtonewrequirements.
Obviously,enterprisecustomerswouldlovetoconsumeservicesandresourcesinsteadofmaintainingthem.CustomandveryspecificsolutionsmaynotworkintermsofSDS,however,sinceSDSDSLshouldbeflexible.So,weneedaservicefordatabasesthatmeettheconceptsofSDS.Let’sgobackto2012.RackspaceandHPdecidedtocollaborateandimplementsuchaserviceforOpenStack:OpenStackdatabaseservice,Trove.
BeforedescribingtheconceptsofTroveitself,pleasekeepinmindthatTroveisnotadatabase.Evenifitwasdefinedasadatabaseasaservice,Troveisnotadatabase.Troveisatoolthatdeliversandmanagesdatabaseinstancesinacloudenvironment.OpenStack’sDatabaseasaService(DBaaS)projectisinactivedevelopmentbutholdsarealtreasure.ThisserviceisdesignedtoprovideallofthegoodsofbothSQLandNoSQLdatabaseswithoutthehassleofhavingtohandlecomplexadministrativetasks.Itisnecessarytohaveadedicatedservicethat
completelyimplementsallSDSmanagementoperations.Theideawastoprovideascalableandreliableclouddatabaseasaserviceprovisioningfunctionalityforbothrelationalandnon-relationaldatabaseengines,andtocontinuetoimproveitsfully-featuredandextensibleopensourceframework(includingreplication,clustering,backup,restore,user/databasesCRUDoperations).
So,whatarethosedifferencesbetweenTroveandAmazonRDBS?TrovedoesNoSQLbootstrapping,however,startingwiththeJunoreleaseTrovedoesreplicationforMySQLandPercona5.5,aswellasshardedclusteringforMongoDB2.x.x.
OpenStackDBaaSInDetailLet’sdefinewhatTroveis.Incloudcomputingtherearetwodefinitionsforclouddatabases:adatasourceAPIserviceandadataplaneAPIservice.Let’stakeacloselookatthecloudpioneer,Amazon.AmazonAWSprovidestwodifferenttypesofdatabaseservices:AmazonRDBSandAmazonDynamoDB(andSimpleDB,thecheapversionofDynamoDB).Bothoftheseservicesaredatabaseservices,andbothdealwithdatabases,butincompletelydifferentways:
AmazonRDBS:adataplaneAPIservicethatdeploysdatabaseswithinasingleaccount.Thisisbestfordeploymentondemand.
AmazonDynamoDB:adatasourceAPIservicethatcreatesschemaentitiesoverpre-deployedNoSQLdatabaseclusters.
FromthisperspectiveTroveisnotadatabase.Troveisinsteadadatabaseinstancedeliveryservice.Trovedoesinstantdatabasedeploymentondemand.
BeforelookingatTrove’sAPI,youneedtounderstandafewtermsthatTroveuses.
Datastore:adatastructurethatdescribesasetofdatastoreversions,whichconsistsof:
ID:simpleauto-generatedUUID
Name:user-definedattribute;actualnameofadatastore
DefaultdatastoreVersionsID
Example:Mysql,Cassandra,Redis,etc.
DatastoreVersion:adatastructurethatdescribesaversionofaspecificdatabasepinnedtodatastore,whichconsistsof:
ID:simpleauto-generatedUUID
DatastoreID:referencetodatastore
Name:user-definedattribute;actualnameofadatabaseversion
Datastoremanager:trove-guestagentmanagerthatisusedfordatastoremanagement
ImageID:referencetoaspecificGlanceimageID
Packages:databasedistributionpackagesthatwouldbedeployedontoadatastoreVM
Active:booleanflagthatdefinesifaversioncanbeusedforinstancedeploymentornot
Example:Name-5.6
Packages:mysql-server=5.5,percona-xtrabackup=2.1
So,bothofthesetermsaredescribingwhichdatabaseflavorversionshouldbedeployed.
Alsoitisnecessarytounderstandwhichimagesshouldbeused.Unfortunately,Troveisnotabletoworkwithpurecloud-readyimagesduetoitsarchitecturalspecialties—eachGlanceimageshouldcontainTrove’sguestagent(anRPCservicethatmanagesadatabaseinstancewhereitwasinstalled).FormoreinformationonhowtocreateimagesforTrove,pleasetakealookatthisdocument:https://github.com/openstack/trove/blob/master/doc/source/dev/building_guest_images.rst
NowitistimetoproceedtoTrove’sAPIandwhatitcando:
Databaseinstancemanagement(withinsupporteddatastores)
Databasebackup/restore(forMySQLandPerconaitisalsosupportedtocreateanincrementalbackup)
Post-provisioningconfigurationmanagement
Clustering(startingwiththeJunoreleaseforMongoDB2.x.x,VerticaDB)
Replication(fromMySQLandPercona)
Users/databaseCRUDoperations(note,whenthisbookwaswrittennotallsupporteddata-storedriversinTrovewereabletoprovidesuchability)
Let’stakeapreciselookatTrove’sworkflowandwhichOpenStackservicesareinvolvedwithinstanceprovisioning.InFigure3.2youcanseeimportantTroveelements.
Figure3.2
ItisnecessarytoexplainwhathappenswhenausersubmitsaninstanceprovisioningtasktoTrove.Firstofall,wehavetodealwithhoweachnewinstanceisanewVMwithanattachedblockstorage.So,thereisnobaremetal(saygoodbyetoOracleanditslicense),andnocontainers.Secondly,forprovisioning,Troverequiresspecialimageswithadditionalsoftware,whichwillbedescribedlaterinthischapter.
So,eachtimeausercreatesaninstance,Trovedoesthefollowing:
NovaVMbootstrap
Cinderblockstorageprovisioning
OncetheVMisreadyandthevolumeprovisioned,TrovesendsoveranAMQPRPCmessagetotheTroveagentthatisbeingdeployedattheVMtosetupthedatabase.So,ifit’snotinstalled,installit,doadditionalconfiguration,andreportthatthedatabaseisready.YouprobablynotedthatTrovedoesitsownorchestration,sothisisacommunitydecision.FornowTrovedoesn’tsupportfullyHeat-basedprovisioning.InFigure3.3youcanseeCLIcallstoTroveforinstancecreationusingpython-troveclient.
Figure3.3
DatabaseBackupNowlet’stakealookathowtheinstancebackupprocedureisimplemented.Onceausersubmitsabackuprequest,itasksitsagenttoperformabackup.Dependinguponitsimplementationbackup,itcanbeonlineoroff-line.So,theagentusesnativedatabasetoolstoperformbackups(xtrabackupforMySQLflavors,nodetoolforCassandra,etc.).Oncebackupisready,theagentpackagesitintoanarchiveandthensendsittoremotebucketstorage:Swift.IntermsofsecurityconcernstheagentencryptsthebackupusinganAESblockcipher.Butthere’saproblem.AllinstancesareusingthesameAESkeywithinanydeployment.InFigure3.4youcanseeCLIcallsforbackinguptoTroveusingpython-troveclient(https://pypi.python.org/pypi/python-troveclient/1.2.0).
Figure3.4
TroveInstanceRestoreActuallytheTroveinstancerestoreisaninterestingoperation.YoushouldtakeintoaccountthatyoucanrestoredataonlyintoanewTroveinstance.So,inthiskey,therestorediffersfrominstanceprovisioningonlybyapplyingapulledbackupfromSwift.InFigure3.5youcanseeCLIcallstoTroveforrestoringanewinstanceusingpython-troveclient.
Figure3.5
TroveInstanceConfigurationManagementTakingintoaccountthatTroveisapurePaaS,there’snoaccesstoanyotherservicesonaninstanceinsteadofadatabase,andthere’sonlyonewaytomanageyourinstance—throughTrove’sAPI.OneoftheavailableAPIendpointsisconfigurationmanagementthatisbeingdeployed.FordifferenttypesofdatabasesTroveprovidesanabilitytomodifydifferenttypesofconfigurations.Forexample,inMySQLflavorsitispossibletomodifydynamicsystemvariablesthatarenotrequiredtoputthedatabaseintomaintenancemode,buttherearealsooptionsthatrequirethedatabaseservicetobeshutdown(datadir,logging,etc.).InFigure3.6youcanseeanexampleofachangingdatabaseconfigurationrightafteritsdeployment.
Figure3.6
So,youmaythinkthatwiththehelpofconfigurationmanagementyoucaneasilycreateareplicationgroupforMySQLflavors.Actually,Trovedevelopersdidthatforyou,asshowninFigure3.7—youcanseehowTroveaddressesreplicationwithinitsAPI.
Figure3.7
Speakingofreplication,aspartofitsreplicationcapabilities,Troveprovidesanabilitytopromoteslavetomasterandviceversa(i.e.,thedemotion).Forthesakeofstabilityandpredictabilityitwasdecidedtoimplementthisfeatureformanualmodeonlytoletusersdecidewhethertheywantordon’twanttodothat.Also,startingwiththeKiloreleaseTroveisabletoperformreplicationintwodifferentways(forMySQLflavors):regularbinlogreplication(binlogsarebeingtransferredthroughremotestorage,bythedefault—Swiftbuckets)andanewtypeofreplicationthatissupportedbyMySQL5.6andgreater—GTIDreplication(seemoreinfoathttps://dev.mysql.com/doc/refman/5.6/en/replication-gtids-concepts.html).
There’snothingmuchtosayaboutTroveclusterprovisioning.Basically,Trovecreatesasetofsingleinstancesofaspecificdatastoreanditsversion.Oncetheyareready,Trovestartstoexecuteoperationsforeachinstancetojointhemintoacluster.Thesetofoperationsalwaysfollowstheindustrybestpracticesforclusterbootstrapping(specifictoeachdatastore).
TroveArchitectureLikemostOpenStackservicesTroveitselfisdividedintomultipleservices:
trove-api:AservicethatprovidesaRESTfulAPIthatsupportsJSONtoprovisionandmanagesTroveinstances.
trove-taskmanage:Aservicethatdoestheheavyliftingasfarasprovisioninginstances,managingthelifecycleofinstances,andperformingoperationsonthedatabaseinstance.
trove-conductor:AservicethatismiddlewarebetweentheguestagentandTrove’sbackend.
trove-guestagent:AVM-siteservicethatmanagesdatabaseinstanceswithinitslifecycle.
InFigure3.8youcanseehowTrove’sarchitectureisorganized.
Figure3.8
Inthedatabaseworld,outsideofclouds,itisnecessarytoautomatetaskssuchasadailybackup,butitdoesseemthatTrovemissessuchabilityduetoheavydecisionsonwhichtechnologytopickorcreatingfromscratch.Implementingaschedulerisintheroadmap,butitisnotclearwhenitwillhappen.So,steppingasideofthecommunityplans,itisobviousthatsomedayTrove’sarchitecturewillbeextendedbythatscheduler.Sohereisthefutureofitsarchitecture—Figure3.9explicitlydescribeshowaschedulerwillbeintegrated.
Figure3.9
HerearesomelastwordsaboutTrove.TheideaforTrovewastocreateacompetitive(againstAmazonAWSorotherproprietarysolution)servicethatispartoftheOpenStackecosystem.Yes,itdoessupporttheprovisioningofmultipledatabaseflavorsandtheirversions(datastoreswithdatastoreversionsinTrove
terms).Andyes,itdoesbackup/restoreforsupporteddatabases.ItcandoclusteringforMongoDBandVerticaDB.Butareallofthesefeaturesneededbytheenterprise?Theanswerisyes.Andarethosesupporteddatabasesbeingrequestedandwantedbytheenterprise?Unfortunatelyno.Troveonlypartiallymeetscustomerneeds(atleasttheupstreamversion).SoOpenStackmustsupportwidelyuseddatabasessuchasOracle12c,MySQLandothers.
DESIGNATE:DNSASASERVICEBeingabletoquicklydeployvirtualmachinesandapplicationsisthepromiseofOpenStackandcloudcomputingingeneral.However,ifitstilltakesaphonecallorservicetickettocreateaDomainNameService(DNS)entryfortheapplication,alotoftheeffectivenessofautomationislost.That’swhereDNS-as-a-Servicecomesintoplay.ItenablesapplicationdeploymentsscriptstocreateDNSzonesandrecordsasneeded.DesignateistheprojectinOpenStackthatmakesthispossible.
UnderstandingtheDesignateArchitectureLikeotherOpenStackservices,Designatecontainsseveralcomponents:anAPIendpoint(designate-api),acentralizedlogicalcontroller(designate-central),aninternalDNSserver(MiniDNSordesignate-mdns),andamanager(designate-pool-manager)toconfiguredownstream,outward-facingDNSservers.Thereisalsoanoptionaldesignate-sinkservicethatwatchesthemessagequeueandcantakeotheractionsasneededbaseduponfiredevents(seeFigure3.10).
Figure3.10
DesignatecanbebackedbyavarietyofopensourceandcommercialDNSservers,suchasBIND,Infoblox,orPowerDNS.Thisisnotvisibletothetenant—thetenantsimplyhasaccesstoAPIstocreateandmanagedomains(zones)andtherecordsinthosezones.Eachoftheseservicesisaccessedviaa“backend”plugin,whichcontainsthespecificlogicforinteractingwiththatDNSserver.
WhenausermakesarequestviaHorizon,theCLIclient,ortheAPIdirectly,therequestwillgotothedesignate-apiservice.ThisservicemanagestheinboundHTTPconnections,servinguptheRESTfulAPI.Itcommunicateswithdesignate-centraloverthemessagebus.
Thedesignate-centralserviceisthehubofactivity,coordinatingtheactionsrequiredtocarryouttheAPIrequests,andmanagingthepersistentstoragefortheDesignatedata.WhenanAPIcallrequiresaconfigurationchangeononeofthebackendDNSservers,designate-centralwillsendanRPCrequesttodesignate-pool-manager,whichmodifiestheDNSserverconfigurations.Thespecificsofwhatactionsittakeswilldependonthebackendplugin.
Whendomainsorrecordsarecreatedormodified,designate-centralwillalsoupdatethedesignate-mdnsservice.ThisisasmallDNSserverthatworksasa“hiddenmaster”serverforallDesignatemanageddomains.Thatmeansthatitisauthoritativeforthedomain,butitdoesnotshowupasanNSrecordforthedomain—inotherwords,itishiddenfromview.Clientscannotfindittodirectlyaccessit(it’salsonotaccessibleexternally)—onlyothernameserverscanaccessit.ThebackendDNSservers,whichactuallyserverequestsfromclients,areconfiguredtoseedesignate-mdnsastheprimaryserver,andacceptzonetransfersfromit.DNSzonetransfersareastandardDNSmethodforsharingzonedataamongservers.
UsingDesignateAsanapplicationdeveloper,yourinteractionwithDesignatewillprimarilybetocreate,modify,anddeletezonesandrecords.Let’slookatthedesignateCLIclientandhowtouseit.Likeotherservices,theclientnameissimplytheservicename,designate.Itusesthesame,consistentauthenticationmeansasotherCLIclients.Italsoprovidesquotasonthenumberofentitiesyoucancreate.
$designatequota-gettenant-id
+-------------------+-------+
|Field|Value|
+-------------------+-------+
|domains|10|
|domain_recordsets|500|
|recordset_records|20|
|domain_records|500|
+-------------------+-------+
$
Thedomainsentryisjustwhatyoumightexpect—itreferstodomainnamessuch
asexample.com.Mostlikely,youwillberestrictedtocreatingsub-domainsofyourorganization’sdomain(e.g.,foo.example.comorfoobar.example.com).Tounderstandtheentriesinthisquotalist,youneedtoknowalittlemoreaboutDNS.
FULLYQUALIFIEDDOMAINNAMESDesignaterequiresyoutousefullyqualifieddomainnames—thisincludesthetrailing“.”.Strictlyspeaking,anameisnotaFQDNwithoutthat,andDesignatewillenforcethis.
Foreachdomain,theDNSserverholdsrecords.Eachrecordhasatype,aname,atime-to-liveandanyassociateddata.Whiletherearemanyrecordtypes,DesignatesupportsninecommontypesasoftheKilorelease,showninthefollowingtable.Remember,eachrecordalsohasaname—theexampledatashownhereistheresultofaqueryforthatname.
RecordType
ExampleData Description
A 10.0.0.1 AnIPv4Addressrecord.
AAAA 2001:DB8::1 AnIPv6Addressrecord.
CNAME foo.example.com. Acanonicalname—thisisanentryusedtomaponenametoanother.Forexample,ifthereisaDNSArecordnamedbar.example.com,referringto10.0.0.1,thenyoucancreateaCNAMErecordnamedfoo.example.com.referringtobar.example.com.(thetrue,orcanonical,nameoftheresource).
MX 10mail.example.com.
Amailexchangeserverforthedomain.Thisisusedbymailagentstodecidehowtosendmailtoemailaddressesinthisdomain.
NS ns1.example.com. Anameserverrecord.TheNSrecordsonadomainspecifywhichnameserversareauthoritativeforthedomain.
SSHFP 12a4b1a288…8821ab33ef
ApublicSSHhostkeyfingerprint.Thiscanbeusedtohelpverifyhostsarewhotheysaywhenusingssh.
SPF v=spf1ip4:192.0.2.0/24a–all
ASenderPolicyFrameworkrecord,usedtohelppreventemailspoofing.Itenablesyoutospecifyrulestofilteroutincomingemail.TXTrecordsareoftenusedforthisinstead.
SRV 2055060sip.example.com.
Ageneralservicelocatorrecord.Thisisusedtolocatenewerservicesratherthanusingaservice-specifictypelikeMX.SeeRFC2782.
TXT Someexampletext.
Arbitrarytext,eitherforhumanormachineconsumption.
Mostoften,youwillusetheA,AAAA,CNAMEandperhapsMXrecords.FordeployingsomeapplicationsyoumayalsotakeadvantageofSRVrecordstoadvertisetheavailabilityoftheapplicationservicetotherestoftheorganization.Theremainderareprimarilyusedbytheadministratororforspecialpurposes.
Recordsetsaregroupsofrecordswiththesametype,name,andTTL,butwithdifferentdata.So,youcandefineanArecordsetwithmultipleIPaddressesasdata.Thenameiswhatyouareactuallyusingwhenyoulookuparesource.Forexample,tolookuptheaddress(A)recordnameblue.foobar.example.comfromtheDNSserverat172.16.98.136,youcanusethehostutilityinLinux:
$host-tAblue.foobar.example.com.172.16.98.136
Usingdomainserver:
Name:172.16.98.136
Address:172.16.98.136#53
Aliases:
blue.foobar.example.comhasaddress10.1.0.100
$
Inthequotalist,thedomain_recordsetsentryindicatesthemaximumnumberofrecordsets(ie,uniquetype/namecombinations)youmayhaveinasingledomain.Therecordset_recordsindicatesthemaximumnumberofrecordsinasinglerecordset.Andfinallythedomain_recordsentryputsanadditionalconstraintontotalrecordsinadomain.
CreatingadomainusingtheCLIisstraightforward—youusethedomain-createcommand.
$designatedomain-create--ttl3600--namefoobar.example.com.
+-------------+--------------------------------------+
|Field|Value|
+-------------+--------------------------------------+
|description|None|
|created_at|2015-08-10T19:11:22.000000|
|updated_at|None|
|email|[email protected]|
|ttl|3600|
|serial|1439233882|
|id|7254c2b3-187c-428e-974d-03bac08cb2af|
|name|foobar.example.com.|
+-------------+--------------------------------------+
$
Youwillnoticethatyoumustspecifyanemailaddressasthecontactforthedomain.YoualsomayspecifytheTTLvalue.Thisvalueisusedbydownstreamcachingnameserverstoknowhowlongtoholdontothedatabeforerefreshingtheircache.Thevalueisinseconds;thelongeryouspecify,themoretimeitwilltakeforchangestogointoeffectacrosstheentireInternet.However,specifyingtoolowofavalueforafrequentlylookedupdomaincanoverburdenyourDNSservers.ThedefaultvalueinDesignateis3600,oronehour.
Onceyouhavecreatedadomain,youcanstartcreatingrecords.WhenyouspinupanewVM,youcancreateaDNSentryforitsothatotherVMswithinthecloudcanaccessitbyname,ratherthanbyIPaddress.Tocreatetherecordweusedintheexamplelookupearlier,usethiscommand.
$designaterecord-create--typeA--nameblue.foobar.example.com.\
--data10.1.0.100foobar.example.com.
+-------------+--------------------------------------+
|Field|Value|
+-------------+--------------------------------------+
|description|None|
|type|A|
|created_at|2015-08-10T19:18:59.000000|
|updated_at|None|
|domain_id|7254c2b3-187c-428e-974d-03bac08cb2af|
|priority|None|
|ttl|None|
|data|10.1.0.100|
|id|fc83692a-f484-41fa-81c8-25300a908f7b|
|name|blue.foobar.example.com.|
+-------------+--------------------------------------+
$
Youwillnoticethatthestatementabovesays“withinthecloud.”TheVMIPaddressatspinupistypicallyaprivateaddress,somachinesexternaltothecloudwillnotbeabletoaccesstheaddressdirectly.ToenableexternalsystemstoaccesstheVMviathenamelookup,youneedtoassociateaDNSentrywiththefloatingIPaddress,nottheprivateIPaddress.
Oneoptiontohandlethiscleanlyistousetwodifferentdomainnamesforinternalandexternalreferences.Forexample,ifyouwantothersinyourorganizationtoaccessyourapplicationfromoutsidethecloud,youcouldcreateadomaincloud.example.comandanothercloud-local.example.com.WhenyouprovisionaVM(oraportinNeutron),youcreateanentryinthecloud-local.example.comdomain.WhenyouassociateafloatingIPaddresswiththatVM,youcreateaseparateentryforthefloatingIPincloud.example.com.Yourinternalcloudapplicationscanrefertothecloud-local.example.comdomainandtheexternalclientstothecloud.example.comdomain.
Thisworks,butit’saprettycumbersomesolution.ThealternativetypicallyusedinDNSiscalledsplit-horizonDNS.Inthisconfiguration,theDNSservercanlookatinformationabouttheinboundrequest,suchastheDNSserverIPaddressitcameinthrough,orthesourceIPaddressofthequery.ItusesthisinformationtochoosetheDNSviewinwhichtoevaluatethequeryresponse.DNSviewsenableyoutodefineadifferentresponseforthesamequery—oneineachview.So,youcandefineanArecordforwww.cloud.example.com.Intheinternalviewthatresolvesto10.1.0.100,andanArecordforwww.cloud.example.comintheexternalviewthatresolvestothefloatingIPaddress.
Unfortunately,asoftheKilorelease,Designatedoesnotyetsupportsplit-horizonDNS.However,itisontheroadmapsowecanlookforwardtoitinafuturerelease.
Designateisapowerfulandimportantpartinautomatingyourdeployments.TheabilitytomakeyourapplicationimmediatelyaccessibleviaaDNSentryiscriticaltotherapidspinupofapplications.WithoutthecapabilitiesofDesignate,applicationdeploymentsinOpenStackwouldbelimitedbytheoftenmanualDNSentrycreationprocess.
MAGNUMOneofthenewestandmostinterestingcomponentsintheOpenStackecosystemisacontainerfocusedprojectcalledMagnum.Ifyouareunfamiliarwiththem,containersareavirtualizationtechnologysimilartovirtualmachines,onlytheyworkwithoutahypervisor.Amoredetailedconversationaboutexactlywhatcontainersare,howtheycomparetovirtualmachines,andthechallenges/solutionstheyprovidecanbefoundatthebeginningofChapter6.Intruth,whenusedinanOpenStackenvironment,containersactuallyhavetoliveontopofclassicallyprovisionedinstances.However,forthepurposesofunderstandingwhatMagnumisandwhyitisimportant,containerscansimplybelookedatasanothertypeofvirtualmachinethatcannotbemanagedviaNovaorNeutron.
ContainersAsAServiceMagnumisgenerallydefinedasaservicethatprovidescontainersandcontainermanagementwithinOpenStack.Itallowsyoutoprogrammaticallyprovision,delete,andnetworkcontainerswithouthavingtorelyonaspecificvendor,anddoessoinamulti-tenantcapablemanner.
Therearecurrentlyanumberofthesevendorspecificcontainerorchestrationsystems.Google’sKubernetes,andDocker’sSwarmarethemostwellknown,andarebothsupportedbyMagnum.MorerecentofferingslikeMesosandothersarenotyetsupported,butarelikelytobeimplementedatsomepointinthenearfuture.OneofthemajorconceptsbehindMangumthough,isthatyoudon’thavetorelyonanyspecificvendor.Instead,OpenStackprovidesasetofagnosticAPIsandinterfacesthatallowyoutochooseyourowncontainertypeandorchestrationsystem.Thispreventsvendorlock-inandallowsyoutomoreeasilyadoptnewtechnologyasitcomesalong.
Itsabilitytomanagecontainersinamulti-tenancyfashionmeansthatMagnum’sfunctionalitycanbeextendedtoconsumerswithinanOpenStack-backedpubliccloud.Untilnow,inadditiontobeingvendorspecific,alloftheprevailingsolutionsforcontainermanagementwouldprovideanyonewithaccesstotheorchestrationlayer,accesstoeverycontainerwithinit.WithMagnum,containersareisolatedbytenant,andtheiraccessisbackedbyKeystone.
BuiltUsingFlannel,Kubernetes,andDocker?Magnumiscreatedfromofanumberofdifferentcomponents,butyouwilloftenhearthatitisbuiltuponthreeratherenigmatictechnologies:flannel,Kubernetes,andDocker.Itishelpfultoknowwhateachofthesethingsare,butasyouwillsee,it’sabitofamisnomertoconsiderMagnumassimplyacombinationofthesethings.
Thefirstofthesetechnologies,flannel(yesit’salowercasef),wascreatedbythepeopleatCoreOSInc.Itisavirtualnetworkthatgivesasubnettoeachhostfor
usewithcontainerruntimes.Itprovidesanetworkbindingbetweentheclassicallyprovisionedhostserverandthemultiplecontainersthatexistontopofit,allowingtraffictoberoutedtoandfromspecificcontainers.flannelistransparentinMagnum.TherearenoflannelAPIstospeakto,noristhereanyspecificflannelfunctionalitythathasbeenexposed.Rather,flannelsimplyprovidesthenetworkingtocontainersthatNeutroncouldnot.
Thenextone,Kubernetes,isaGoogle-backedopensourceprojectthatprovidesMagnumwithadriverfortheorchestrationofDockercontainers.Likeflannel,youdon’tinteractdirectlywithKubernetes.Instead,youinteractwiththeMagnumAPI,whichcanthenuseKubernetestoprovision,alter,orremovecontainers,podsandbays.Unlikeflannel,byusingalternatedriverssuchasSwarmorMesos,itispossibletoactuallyuseMagnumwithoutKubernetesatall.
Lastly,thereisDocker.Dockeristhetechnologyyouhavemostlikelyheardof,butitcanalsobethemostconfusingsinceitisanumberofdifferentthings.WhenpeoplerefertoDocker,theycanbereferringtoitasacompany.DockeractuallyoffersanumberofproductscenteredaroundcontainersincludingDockerHub(ahostedregistryservice)andDockerSwarm(mentionedearlierasanalternativetoKubernetes).TheDockerEngineisalsooftenreferredtoasjustDocker.TheDockerEngineisaruntimeaswellasanumberoftoolsthatallowyoutobuildandrunDockercontainers.
InthecaseofOpenStackMagnum,DockerisbasicallyacontainerformatorsoftwaretorunthisformatofcontainersonahostwhenusingSwarm,whichisanorchestrationdriverfortheseDockerformattedcontainers.Whilenotsupportedcurrently,itisalsopossiblethatothercontainerformatslikeRocketcouldallowyoutouseMagnumwithoutDockeratall.
ThereferencetothesetechnologiesasthebasisforMagnumisnotdeceptive.It’smeanttoexplainMagnuminitsmostcommonusecase.AnyreferenceonhowtouseMagnumwilllikelydemonstratehowtodeployDockercontainersusingKubernetesandflannelwillbackthenetworkingbehindthescenes.Intruththough,theyaresimplymoretechnologyinanarrayoftechnicaloptionsthatOpenStackandMagnumprovideinasimplifiedwaytouse.
BuiltUsingOpenStackInadditiontousingKeystoneforauthenticationandpermissions,MagnumisactuallybuiltusinganumberoftheotherOpenStackprojectsthathavealreadybeendiscussed.ItemploysHeatforcreatingpodsandbayswherecontainerscanlive,Novaasitscomputebackbone,andNeutrontohandlenetworkingoutsideofthecontainersthemselves.Thiscanprovideyouwithalotofflexibilityonexactlyhowcontainersareimplementedinyourenvironment.
Forexample,thecomputationalunitthatrunsaclusterofcontainers(ornode)canbeanythingthatNovacansupplyasaserver.Thismeanscontainerscanbeprovisionedontopofbaremetalseversorvirtualmachines.Sonotonlydoes
Magnumprovidevendoragnosticcontainers,butitcanbebackedbyvendoragnosticcomputing.Thesamecanbesaidforitsnetworkingandevenstoragecomponents.Thisisintentional,andisagreatillustrationofhowOpenStackallowsyoutoworkwithwhateverassetsyouhaveavailable.
BuildingontopoftheexistingtoolswithinOpenStackprovidesfamiliarinterfaces,butthatisnottosaythatusingMagnumisnodifferentthanprovisioningaVMandthrowingitonaprivatenetwork.ThespecificneedsofcontainersthatmadethemapoorfitforNova,alsomaketheirorchestrationandconfigurationaslightlydifferentprocess.
Bay,Pods,Nodes,andContainersAsmentionedbefore,allcontainersthatarepartofMagnumrunontopofNovaprovisionedservers.Whatwasn’tmentioned,wasthatthesecontainersactuallyrunontopofsomethingcalledBaysthatactuallyprovidesthecontainerorchestrationitself.Dependingonthedriver/vendor,containersorpodsarethencreatedontopofthesebaysingroupscallednodes.Figure3.11maymakethisalittleclearer.
Figure3.11
Toprovisionacontainer,youmustfirstselectandprovisionabaytype.Thiswillnormallybedoneusingoneofseveralbaymodelsthatcanbeself-defined,butwillmostlikelybeprovidedbythesystemnatively.BaymodelsaresimilartoFlavorswhendealingwithvirtualmachines.Therewilllikelybeonebaymodelavailableforeachvendor/driverthathasbeenconfiguredinthesystem,andlikemostassetswithinOpenStackthebaymodelscanbelistedwithacommand.However,fornow,selectingabaymodelessentiallymeanschoosingbetweenKubernetesandSwarm.
Whateverthechoice,thebaymodelisspecifiedwithinaheattemplateandtheactualbayiscreatedthroughHeat.BaysarethenavailableasstackswithintheheatAPIorintheHorizoninterface.
Fromthispoint,theMagnumAPItakesover.WithinabayyoucancallthemagnumAPItocreatecontainers(orpods),stop,startandrebootthemlikeyoucanwithVM’sinNova.Thiscoversthebasics,soyoushouldhavesomeideaofwhatMagnumisandhowitworks.
MagnumastheFutureofOpenStackTherehavebeenalotofquestionsinthecontainercommunitylatelyastotheneedforOpenStackinthefaceofprojectssuchasKubernetes.Afterall,KubernetesandDockerbothprovidenearlycompleteorchestrationsolutions.
AfewreasonshavealreadybeenmentionedastowhyyoumightlooktowardOpenStackasasolution.Multi-tenancyandvendoragnosticAPIsarebothhighlydesirablequalities.Nothavingtoacquirein-depthknowledgeofsomeofthemoreesoterictechnologiessuchasflannelcanalsobeabigplus.
ThebigwinherethoughisthatOpenStackistryingtobuildamorefuture-proofplatformandMagnumislikelytobeabigpartofOpenStack’sfuture.Containersareexcellenttechnology,buttheyareoneofthefastestchangingsolutionsoutthere.Likeanynewtechnologytheinitialwinnersareoftenlongtermlosers,soit’sriskytogetindeepwithanysinglecontainervendor/format/platformjustyet.Becauseitislargelyprovideragnostic,placingabetonMagnumisthusamuchlessriskyventure.Forexample,theabilitytoshiftgearsfromKubernetestoSwarmwithouthavingtomodifyyourdeploymentsystemcouldbeahugewin,andwhilevirtualmachinesarelikelytobeabigpartofthelandscapeformanyyearstocome,containersareheretostay.
MURANO:APPLICATIONASASERVICEFromaclouduserperspectivesinceOpenStackgotitsownorchestratoritmadeuserexperiencemoresolid.Itgavelotsofimprovements,butfromcloudappstheintegrationprocesswastoocomplicatedduetospecificlimitationsregardingthewayHeatallowsyoutodescribetheinfrastructurethatneedstobedeployed.So,evenusingthelatestHeatHOTDSLcloud,consumersstillcancreateaspecificconfiguration,butwritingatemplatewouldbecomeanightmare.
So,toimproveuserexperienceandprovidemoreflexiblecapabilitiesforclouduserstodeployandmaintaintheirowncloud-readyapplicationitwasdecidedtoimplementanewtypeofOpenStackservicethatwoulduseHeatasthedeploymenttoolthatprovidesanAPIthatwillallowyoutodefineapplicationsusingthesameenvironmenttemplates.
ApplicationCatalogMuranowasdesignedtoprovideawaytomakethird-partyapplicationsandservicesrunningonVMsorevenexternalservicesavailableasself-serviceforOpenStack.Theseapplicationsmaybeasimplemulti-tierapplicationwithauto-scalingandself-healing(withinHeatcapabilities).Fromthethird-partytooldeveloper’sperspective,theapplicationcatalogwillprovideawaytopublishapplications,includingdeploymentrulesandrequirements,suggestedconfigurations,outputparametersandbillingrules.Fromtheuser’sperspective,theapplicationcatalogwillbeaplacetofindandself-provisionthird-partyapplicationsandservices,andintegratethemintotheirenvironment,includingbillingcosts.
TheApplicationCatalogservicewasprovidedtosimplifytheprocessofcreatingapplicationsand/orservicesonOpenStack.Installingthird-partyservicesandapplicationscanbedifficultinanyenvironment,butthedynamicnatureofanOpenStackenvironmentcanmakethisproblemworse.MuranoisdesignedtosolvethisproblembyprovidinganadditionalintegrationlayerbetweenthirdpartycomponentsandtheOpenStackinfrastructure.ThisintegrationlayermakesitpossibletoprovidebothInfrastructure-as-a-ServiceandPlatform-as-a-Servicefromasinglecontrolplane.Forusers,thiscontrolplanisasingleinterfacefromwhichyoucanprovisionanentirefully-functionalcloud-basedapplicationenvironment.TheApplicationCatalogservicewasintegratedtoallOpenStackcomponentsdirectlyandindirectlyviaorchestrator(OpenStackHeat).TheCeilometerservicecollectsusageinformation,whichtheMurano-APIusesduringbillingrulesprocessingtocalculatebillinginformation.TheMuranoAPIwillexposeAPIcallstomanage(CRUD)servicesavailablefordeployment.ThisAPIwillbeusedbytheServiceadministratoruserinterfacetosimplifyservicemanagement.
ApplicationPublisher
TheprocessbeginswhenanApplicationPublishercreatesanewapplicationdescriptionandpublishestotheApplicationcatalog.Oncetheapplicationisuploadedthenit’llbeavailablewithinanyapplicationcataloginstances,dependingonthepoliciesforthatinstance.ApplicationPublishersshouldbeabletocreatenewapplicationsbydefiningservicemetadata,describingpropertiesandspecifyingallofthestepsnecessaryfordeployingtheapplicationanditsdependencies.Thedevelopercancreatethisdefinitionfromscratchoruseanexistingdefinitionbyextendingit,similartoinheritanceintheobject-orientedparadigm.TheApplicationPublishercandefinetheexternaldependenciesofanapplication.Thislistofdependenciesdefinestheotherservices(specifiedbytheirtype)thatmustbepresentintheenvironmentwhenanapplicationisbeingdeployed.
TheApplicationPublishermaydefineadditionaltermsofuseforanapplication.Forexample,thedevelopermaylimititsusageandextensibility(viainheritanceorreferencingfromanotherapplication)orspecifybillingrules.AnotherimportantsetofparametersthattheApplicationPublishermayspecifyintheServiceDefinitionaretheusagemetrics.TheseusagemetricsdefinewhichaspectsoftheserviceshouldbemonitoredbyCeilometerorothermonitoringtoolssupportedbyMuranowhenitsinstancesarerunning.TheApplicationPublishercanthenspecifythebillingrulesusedwiththosemetrics,essentiallydefininghowmuchserviceusagewillcosttheuser.AservicedefinitionisnotboundtoanyparticularOpenStackdeploymentorinstanceofMurano.Thedevelopermaycreateaservicedefinitionandthenpublishthatdefinitioninseveralservicecataloginstances.
ApplicationCatalogAdministratorApublishedservice/applicationdefinitionismanagedbythecatalogadministrator.Catalogadministratorsarethemaintainersoftheapplicationservicecatalog.Theyhavetheabilitytomanuallyaddorremoveservicedefinitionsinacatalog,oractasmoderatorsallowingordisallowingotherApplicationPublisherstopublishtheirservicedefinitions.Thiscontrolcanbegranularornot,astheadministratorchooses.Forexample,theadministratormayspecifythatanynewsubmissionsmustbeapprovedbeforebeingavailabletoanyendusers,ortheadministratormayinsteadchoosetomakeservicesavailableonlytotheOpenStacktenantassociatedwiththeapplicationpublisheruntilaserviceisapproved.
Administratorsmaydefinetheirownbillingrules,whichwillbeinadditiontothebillingrulesspecifiedbytheapplicationpublisher(iftheyweredefined).Thisenablescatalogadministratorstocoverthecostsinvolvedinrunningandmaintainingthecloud.
CatalogadministratorsconfiguresRole-BasedAccessControlrules(RBAC),whichdefineswhichusers(whichareassociatedwithtenants)ofthecloudhaveaccessto
whichservicesinthecatalog,andwhethertheymaybedirectlydeployedormustbeapproved.
ApplicationCatalogEndUsersOpenStackusersshouldbeabletocreateenvironmentscomposedofoneormoreavailableservices.Applicationcatalogconsumptionsbyendusersfollows:
Theuserbrowsesalistofavailableservices/applicationsandselectsoneormorefordeployment.Ifaselectedservicehasdependenciesthatrequireotherservicestobedeployedinthesameenvironment,theusermayeitherselectaninstanceofthenecessaryservicefrominstancesofthattypethatarealreadypresentintheenvironment,oraddanewinstanceofthattypeinstead.Dependenciesmayincludeotherservices,ortheymayincluderesourcessuchasafloatingIPaddressorlicensekey.Eachserviceaddedtotheenvironmentmustbeproperlyconfigured;theuserispromptedtoprovideallrequiredproperties,andtheinputisvalidatedaccordingtotherulesdefinedineachservicedefinition.Whentheuserhasfinishedconfiguringtheenvironment,heorshecandeploytheenvironment—ifheorshehastheappropriatepermissions.Deploymentoftheenvironmentmeansthatinstancesarecreated,servicesaredeployed,andallrequiredconfigurationactionstakeplaceandareaccomplishedproperly.
Insomeenvironments,itwillbemoreappropriateforenduserstosubmittheirdeploymentstoITasaticket.TheITdepartmentcanthensanity-checkthedefinitions,determinewhethertheyareappropriate,andapprove,modify,orrejectthedeployment.Iftherequestisapprovedormodified,theITdepartmentcantheninitiatethedeployment,ratherthantheuser.
Userscanbrowseanydeployedenvironmentsforwhichtheyhavepermissions,andinspecttheirstate.Inspectionincludestheabilitytodeterminewhichservicesarerunningonwhichnodes,howtheservicesareconfigured,andsoon.Userscanmodifyservicesettings,addnewservicesorremoveexistingones,validatethechanges(i.e.checkthatalltherequiredpropertiesaresettovalidvalues,alltheservicedependenciesexistandsoon),andredeploytheenvironmentbypropagatingthesechangesintotheCloud.Theusercanalsoinspecttheusagemetricsoftheservicesrunninginhisorherenvironments,andseebillableactivitiesandthetotalamountofmoneyspentforaparticularservice.
Itsoundsgoodwhenwe’resaying“anapplication”or“service,”butwehaven’tdefinedwhatanapplicationorserviceis,soitwouldbeveryusefultomentionafewexamplesofanapplicationthatmaybedeploywithinMurano:
RDBSandNoSQLdatabasesprovidedbyTrove
HadoopClusterprovidedbySahara
OpenShiftPaaSClusterprovisionedthroughHeat
MSSQLCluster
ChefServerorPuppetMasternodeinstalledmyMuranoworkflows
NagiosorZabbixmonitoringmanagedbyMuranoworkflows
MuranoArchitectureFollowingbestpracticesinOpenStack,Muranowasdesignedthatwaytohaveitscomponentsdecoupled(seeFigure3.12),anditdoesconsistof:
murano-api,aRESTfulservicethatfacestousers
murano-conductor,anactualenginethatdoesmostofheavyworkforcreatingdeployments
murano-agent,aVM-sideservicethatdoessoftwaredeploymentandconfigurationaccordingtoagivenapplicationdescription
backingservice(MySQL)
deploymentengine(Heat)
Figure3.12
MuranoUsageExampleMuranoasanApplicationcatalogintendstosupportapplications,definedindifferentformats.OnesuchexampleisHeatHOTDSLtemplatessupport.ItmeansthatanyHeattemplatecouldbeaddedasaseparateapplicationintotheApplicationCatalog.
Beforeuploadinganapplicationintothecatalog,itshouldbepreparedandpackagedappropriately.TheMuranocommandlinewilldoallofthatpreparationforyou.JustchoosethedesiredHeatOrchestrationTemplateandperformthefollowingcommand:
muranopackage-create–templateWordPress_2_Instances.yaml
NotethattheMuranoRESTclientallowsyoutospecifyadditionalparametersduringpackagecreation:
applicationname
applicationlogo(usedatUI)
applicationdescription
applicationauthor(s)
output(localstoragepathtosavecreatedpackage)
fullname
ButunderthehoodMuranodoesmorethancanbeseen;itcreatesamanifestaccordingtoagivendescription,soinourcasethemanifestforgiventemplatewouldlooksomethinglikethis:
Format:Heat.HOT/1.0
Type:Application
FullName:io.murano.apps.linux.Wordpress
Name:Wordpress
Description:|
WordPressiswebsoftwareyoucanusetocreateabeautifulwebsiteor
blog.
Thistemplateinstallsasingle-instanceWordPressdeploymentusinga
local
MySQLdatabasetostorethedata.
Author:'Openstack,Inc'
Tags:[Linux,connection]
Logo:logo.png
Oncethemanifesthasbeencreated,theuserwouldneedtopackagetheapplicationpackagebeforeuploadingittoMurano.Usersmustnamethetemplatefileastemplate.yaml,andthenameforthemanifestfileshouldbemanifest.yaml.Theuserthenneedstopackageanarchive*.ziportar.gzorwhatever.Youcandoapplicationimporting:
muranopackage-import–categoryWeb–templatewordpress.tar.gz
ThisisonlyabasicexampleofhowuserscanconsumeMuranoanditscapabilitiesasanApplicationcatalogforOpenStack.Forotherusecasesandusageexamplespleasetakealookathttp://murano.readthedocs.org/.
FromacloudusersperspectiveMuranoisveryuseful.OutsideoftheOpenStackecosystemyoushouldlookatRedHatOpenShift,whichisaPaaSplatformforapplicationdeploymentandmanagement.YoumightalsolookatGigaspacesCloudify,whichisaPaaSsolutionthataimstobeacompletesubstitutionforHeat,Murano,andSolumforOpenStackenterprisecustomers/consumers.ButMuranoisanofficialpartofOpenStack,soitmeansthatMuranoisfreeandcomesoutoftheboxforanyOpenStackdistributions.
CEILOMETER:TELEMETRYASASERVICEApplicationsandsystemsrequiremonitoring.Inordertoensurecontinuousservicedelivery,youneedtoknowwhetheryourapplicationsorinfrastructurerunningthoseapplicationshaveencounteredanyfaults,andwhethertheyareexperiencingheavyutilization.Ceilometerisprimarilyfocusedonthelatterfunction—monitoringresourceutilizationacrossthecloud,althoughitdoesprovidesomealarmingandnotificationfunctionalityaswell.Ceilometermonitoringmaybeusedforcapacityplanning,billingandchargeback,aswellaselasticscaling.
CeilometerArchitectureThemajorcomponentsoftheCeilometerarchitectureincludetheAPI,thepollingagents,collectorsforstoringagentresults,alarmevaluators,alarmnotifiers,andpossiblyseveraldifferentbackenddatabases(seeFigure3.13).
Figure3.13
TherearetwobasictypesofCeilometeragents:notificationreceiversandpollers.
Thepollingagentsperiodicallyrequestvariousmetricsfromotherservices.Forexample,theceilometer-agent-computewillrunonacomputenodeandgatherguestCPUstatisticsfromthehypervisoronthatcomputenode.Thenotificationreceiveragentssimplylistenonthemessagebus,andgatherinformationabouttheinnerworkingsofotherOpenStacksystemsbasedontheirnotificationoutputs.
Allofthisdatacollectedbytheagentsissentbacktotheceilometer-collector,whichisadaemon(ormanyinstancesofthedaemon)thattransformsandstoresthedataintothebackenddatabases.Theremaybeseveraldifferentdatabasesused,baseduponthedifferenttypesofdata.
Theceilometer-alarm-evaluatorprocessisconfiguredtolookatthedatainthesystemandevaluatewhetheralarmingcriteriaaremet.Thesecriteriaareuser-definedandconfigurable.Oncethecriteriaaremet,thenceilometer-alarm-notifierwilltakeanactionbasedupontheraisedalarm.ThiscouldbecallingaspecificURL,oranotheruser-specifiedaction.
ElasticScalingwithCeilometerInChapter6,youwillseeindetailhowyourapplicationscanscaleelasticallybycombiningthetelemetrydatafromCeilometerwiththeorchestrationcapabilitiesofHeat.Inshort,youconfigureHeatandCeilometertomonitortheCeilometermetricsforagroupofresources(say,VMsandyouaremonitoringCPUutilization).Whenathresholdisreached,analarmfires,whichinturncallsouttoHeattoscaleup(ordown)thenumberofinstances.Thisisapowerfulwaytomeetunevendemand,whileoptimizingthecostsassociatedwithanapplication.
SUMMARYThereisalottobesaidaboutusingOpenStackassimplyaplatformforprovisioningserversandnetworks.Indoingso,itwouldbeeasytodiscountmanyoftheprojectsdiscussedinthischapter.Afterall,mostofushavemadeitthisfarwithoutapplicationpackaging,containers,oranysortoforchestrationsystem.However,theexpandedecosystemoftechnologypresentedherehintsatalargergoalforOpenStack.ItistryingtobemorethanjustanIAASprovider.Infact,manyoftheseprojectsoffersolutionstothefundamentalneedsofwebdevelopment.It’salmostuncommonthesedaysforanapplicationnottoinvolveadatabase(Trove),DNSentries(Designate),andalerts(Ceilometer).Eventhoughitisn’tscriptedandlabeledasorchestration,suchapplicationsalsorequiremanualconfigurationanddeploymentinsomemanner.
Inthissense,OpenStackisattemptingtomaketheprocessofdevelopinganddeployingcloudbasedapplicationsnotjustpossible,buteasierandmoreformalized.It’salsotryingtoprovidescriptableself-servicesolutionsforsomeofthemorecommontasksinwebdevelopmentingeneral.Forthatreasonalone,thesesecondarycomponentsareworthlearningaboutandexperimentingwith.Sobeforewemoveonandstartlookingatwhatacloudapplicationlookslike,takeanotherlookatthischapterandaskyourselfiftheseprojectsprovidesolutionsforproblemsyoufrequentlyencounter.Inalllikelihood,theydo,andutilizingthemcanmakeyoumoreproductive,andyourapplicationslessproprietary.
PARTIIDevelopingandDeployingApplicationswithOpenStack
CHAPTER4:APPLICATIONDEVELOPMENT
CHAPTER5:IMPROVINGONTHEAPPLICATION
CHAPTER6:DEPLOYINGTHEAPPLICATION
4ApplicationDevelopmentWHAT’SINTHISCHAPTER?
Legacyapplications
Whydoyouneedmigrationtoclouds?
Migrate-to-cloudmethodology
ConvertyourapplicationintoanOpenStackapp
Buildingapplicationsfromscratch
Developmentstack
Applicationnetworkconnectivity
Applicationsecurity
Hands-onapplicationdeployment
Inthischapteryouwillbeexplicitlyshownhowtoperformalegacyapplicationmigrationfromaself-maintainedproprietaryenvironmenttoanOpenStackenvironment.Butbeforedivingin,let’smakesureweunderstandthefullmeaningoftheterm“legacyapplication.”Incomputerscience,legacyapplicationsarethosethatcomefromplatformsandtechniquesthatexistearlierthanthecurrenttechnologystack,andingeneraltheseareapplicationsthatareservingcriticalbusinessneedsinanorganization.Okay,let’sgetstarted.
CONVERTINGALEGACYAPPTOANOPENSTACKAPPWhentheword“legacy”appearswithinanycontext,thefirstthoughtisthatwe’retalkingaboutsomethingveryoldthatcan’tbeadjustedtothecurrentstateofthings.Butifwe’retalkingaboutsoftware,alegacyapplicationisnotnecessarilydefinedbyage.Legacymayrefertothelackofvendorsupportorasystem’sincapacitytomeetorganizationalrequirements.Legacyconditionsrefertoasystem’sdifficulty(orinability)tobemaintained,supportedorimproved.Alegacyapplicationisusuallyincompatiblewithnewlypurchasedsystems.Anorganizationmightcontinuetouselegacyapplicationsforawiderangeofreasons,suchasthefollowing:
Itworks,sowhyshouldweinvestmore?
Thelegacysystemiscomplex,anddocumentationispoor.Simplyitsdefiningscopecanbedifficult.
Aredesigniscostly,duetocomplexityoramonolithicarchitecture.
WhyMigratetoClouds?Inmostcases,itisreallycomplicatedtokeepappsrunningduringupdateswithoutamaintenancewindow.Inthecaseoflegacyapplications,“update”evenmeansthatthewholeapplicationwasre-writtenusingnewprogramminglanguages,andinvolvingnewtypesofservices(forexample,switchingfromself-maintaineddatabasestoclouddatabases).Thisshouldmakelegacyapplicationseasiertomaintaininthefuture,giventhatyoucanupdateapplicationswithouthavingtoentirelyrewritethem,whichallowsacompanytousetheirapplicationsonanyenvironmentsoroperatingsystems.
Yet,fortheenterpriseandtheirlegacyapplications,asystemredesignwouldtakealotofeffort(money,time,andanunclearvalue-add).
EnterpriseITorganizationsarefacingcriticalchallengesmaintaininglegacyapplications:
Costofproprietaryhardwareandsoftware
Attritioninpeoplewithqualifiedskillsandexperience
Inabilitytosupportthemoderncomputingdemandsofmobileandbigfastdata
CloudcomputingcanhelpwithlegacyapplicationsintermsofmaintenancefortheITdepartment.Unfortunately,manyITorganizationsseetheprospectofmodernizinglegacyapplicationsasa“missionimpossible”withthepathforward“toocloudy”andthecostsandriskstoogreat.Theyhaveapoint,buttherearesomefactorsthatcanhelpdetermineifourlegacyapplicationscanmigratetothecloud:
Structure:Alarge,single-tiered,monolithiclegacyapplicationisn’tagoodfitforclouds.Efficienciesaregainedwhentheapplicationismodularortheloadcanbespreadoutoverseveralapplicationinstancestoallowhighavailability(HA)andscalability.
Softwareandhardwaredependencies:Aparticularchipsetoranexternaldevicesuchasaneyescannermightnotbeagoodfitforthecloud.Thesamethingcanapplytosoftware,sincealegacyapplicationmayrequiretheuseofaspecificoperatingsystemorsetoflibrariesthatcan’tbeusedinacloudnorbevirtualized.Ifthisisthecase,thendefinitelyanapplikethisisnotagoodfitforthecloud.
Durabilityandfault-tolerance:DespiteapplicationServiceLevelAgreements(SLA),we’relivinginaworldwhereeverythingbreaks:networksaredisrupted,serversfail,andthemulti-tenantusageofanapplicationlookslikeaDistributedDenial-of-Serviceattack(DDoS)insteadofshowingregularbehavior.Applicationsmustsurviveorbesturdyenoughtocontendwithanygivenissues.
Asaresult,manyenterprisecompaniesareresigningthemselvestolivewithlegacyapplicationsbecausemovingtothecloudisnotastepforwardduetotheamountofeffortthatisrequired.Eventually,thebusinesslosesconfidenceinIT’sabilitytodeliver,andthecostscontinuetorisewithoutcorrespondingvalueoranyvisiblebenefit.Let’sexaminesomespecificadvantagesformovingfromalegacyapptoacloudapp.
First,movingyourlegacyapptothecloudlowersthetotalcostofownership.Maintainingmainframelicenseleasingcostsisoneareatolookat.Sincethecloudfurthercommoditizestheinfrastructure,modernizingmainframeappstothecloudshoulddecreasethetotalcostduetotheabsenceofneedingtomaintaintheenvironmentbyitself.
Inclouds,flexibilitydefinestherateatwhichlegacyapplicationneedscanbesuccessfullyadjustedtomeettheever-changingneedsofthebusiness.Inthecaseofenvironmentdelivery,cloudscomeoutontopcomparedtoself-managedhardware.Thisisduetotheflexibilityofthecloudenvironmentdefinitionandthepaceofprovisioningaswell.
Fromabusinessperspectiveit’salwaysbettertospendlessandachievemore.Inthecaseofclouds,hardwarecostslessbecausecloudconsumersdon’tneedtomanagetheirhardwarethemselves,sotheycanavoidspendingmoneyforelectricityandhardwareupgrades.
Inthecaseofproprietaryhardware,toscaleupyouneedtobuynewhardware,setitup,andmanageit.Atthepointwhenyoumustscaledown,theorganizationwillendupwithunusedhardware.Withacloudsolutionyoucanscaleyouroperationandyoudon’tneedtobuyhardware,allofwhichsavestime.
Developersofcoursecreatethecodethatmustbetestedintheenvironmentthat
isclosetoproduction.Inthecaseofproprietaryhardwareitisnecessarytohaveadedicateddevelopment/testingenvironmentmaintainedbytheITdepartment,probablyononeserver.Developinginthecloud,however,onlyrequiresdeveloperstohaveaseparateaccounttoworkwithanditiseasytocreateproduction-likeenvironmentstorunnewcodeand/orreproducebugs.
Theseareallgreatreasonswhyyoushouldconsidermovingfromalegacyenvironmenttoacloudenvironment,andtheclouddoesvirtualizeandorchestratealotofthemanualjobsthatarebeingperformedbyanITdepartment.Theseincludeprocessessuchasnetworking,softwareinstallation,VMhardwarecustomization,scaling,andmore.Anddon’tforgetupdatingtoacloud-readyapplicationcanbetherightbusinessmodelforenterprisecustomers.
Migrate-To-CloudsMethodologySo,ifyourapplicationisluckyenoughtobeacloud-readyapplication,anditseemslikeyouhaveconvincedyourcompanytomovefromself-maintainedhardwaretothecloud,itisimportanttounderstandthewidely-appliedstrategiesthatyoucanusetoswitchtothecloud:
Liftandshift:Ifyourapplicationenvironmentcaneasilymigratefromalegacyenvironmenttothecloudthenyoujustneedtoliftitandshiftittothecloudenvironment.
GreenFieldapproach(http://www.thegreenfieldorganisation.com/approach2.html):Fromthedefinition,youcanseethatthisisrisky.Thisapproachofrewritinganentirelegacyapplicationisthemostexpensiveandcriticalmodernizationapproach.However,automatedcodeanalysis,codeconversion,testing,andclouddeploymenttoolscangreatlyreducetherisksandcostsassociatedwiththis.So,inthiscaseitisstronglyrecommendedthatyoufigureoutthetrueriskratebeforeimplementingthisapproach.
Incrementalreplacement:Thisapproachrequiresyoutoreplacethesingleunitofanapplicationatatime.Thishasproventobecost-effectiveandlessrisky.Unfortunately,therearenoguidelinesthatcanreallyhelpyousincemosteveryapplicationisunique.
Consideralloftheintegrationsbetweenthelegacyapplicationinfrastructureandotherapplications—integratingapplicationswillneedtobeupdatedandtestedtakingintoaccountthecloudcapabilities.Thisisaveryimportantstepsinceit’snecessarytoimplementdeploymentarchitecture.Oncecomplete,youshoulddefinethehardwareconfigurationforeachapplication’scomponent(cloudsoffervarioustypesofbusinessmodels:payingforresourcesondemandorpayingforayear/monthsubscription).
Younextthingtoconsiderisaccessibility.Thisstepdefinesthenetworkingconfiguration,exposingwhichcomponentsofanapplicationshouldbeaccessible
tootherservices.Itisimportanttoleaveanapplicationnetworkingconfigurationinthesameconfigurationthatwasappliedbefore,soyouendupwiththeexpectedbehaviorthatwasobservedwiththelegacyapplicationhardware.
Forsoftwareconfigurationoncloudinstancestherearetwosteps:softwareinstallation(canbedoneonpre-provisioningorpost-provisioning)andpost-installation(post-provisioning)configuration.Cloudprovidersareofferingbaseimageswithoperatingsystems,butthisisnotwhatshouldbeused,becauseoftheavailabilityofmoreadvancedwaysofsoftwareinstallationatthepre-provisioningstage.ItismorethanrecommendedtocreatecustomimagesforVMprovisioning,andforthistaskpleasetakealookathttp://docs.openstack.org/developer/diskimage-builder/.Atthispointwe’rereadytodeploythecloud-readyapplicationanddopost-provisioningsoftwareconfigurationtostarttheapplication.
Thelaststepistoapplymonitoringsystemstotracktheenvironmentstateduringitswork.Here’stheshortlistofwhatshouldbetakenintoaccountforthis:
Hardwareconfigurationforapplicationcomponents
Applicationcomponentsdeploymentstrategy
Networkingconfiguration
Customimagecomposing
Environmentdeployment
Post-provisioningsoftwareconfiguration
Applyingmonitoring
Testinganapplication
Itdoesn’tseemlikethislistiscomplete,butifyoucombineitwiththealreadypre-definedlistofapplicationdependenciesyoushouldbeabletoobservethefulllistofapplicationneeds.Onceyouhavethisfulllist,thenyoushouldbegintheactualconverting(inthiscaseconvertingmeansapplyingamigrationstrategytoanapplicationanddoingtheactualdeployment)ofthelegacyapplicationtoafull-gearOpenStackapplication.
BUILDINGAPPSFROMSCRATCHNoteveryapplicationintheworldisalegacyapplicationbecausemanyofthemweredevelopedwhencloudsbecamepopularandapplicationsthemselveswerealreadyhardware-agnostic,butnotbuiltforcloudsatall.Soitispossiblethatmigratingtothecloudmaynotgivethenecessaryvalueaddexpectedbyacloud-orientedbusinessmodel.Andthismeansthatcreatinganewapplicationfromscratchmaygivethatbenefit,butinalongerperiodoftime.
ApplicationDesignGuidelinesforOpenStackDevelopinganewapplicationthatwillgotothecloudrequiresspecificguidelineswhendevelopingandintegratingapplicationsspecificallytoOpenStack:
Beapessimisticaspossible.Everythingbreaksso,“loveyourchaosmonkey”(achaosmonkeyisaservicethatidentifiesgroupsofsystemsandrandomlyterminatesoneofthesystemsinagroup).
Putyoureggsintomultiplebaskets.Leveragemultipleregions,availabilityzones,andcomputehosts.Designportability(rememberliftandshift).
Thinkofscalability.
WhenintegratingintoOpenStackdon’tforgettobeparanoid—designsecuritywisely.
Manageyourdatawisely.Dataisalwaysacriticalresource,sodon’thesitatetoenabledatareplication/clustering,anddoaregularbackup.
Bedynamic.Letyourapplicationbesmartbyenablingauto-scaling.
Handsoff—automateallbusinessprocessestoincreaseconsistency.
Notallapplicationsrequirethesamehighlevelofsecurity.
Predictabilityandelasticity—withincreasing/decreasingamountofresourcestheapplicationshouldactinapredictableway.
Divideandconquer.Makeyourapplicationgranularasmuchaspossible,especiallywhenintegratingHAsolutions.
Duetonetworkinglatencyitisnecessarytokeepyourdatapartitionsclosetoeachotherbutnotonthesamecomputehostorregion.
Loosecoupling,serviceinterfaces,separationofconcerns,abstractionandwelldefinedAPIsdeliverflexibility.
Becostaware:autoscaling,datatransmission,virtualsoftwarelicenses,reservedinstances,andsooncanrapidlyincreasemonthlyusagecharges.Monitorusageclosely.
BestPracticesinCloud-ReadyAppDevelopment
IfyourapplicationisdividedintoaserverandclientsideyouneedtoconsiderifitisnecessarytoconsumetheOpenStackAPI(managingcloudresources).YoumustdecideifyouwanttouseexistingclientbindingsforOpenStackservicesorimplementyourown.Forexample,ifyouarereusingexistingones,itisrecommendedthatyouusePython,becausetheOpenStackcommunitydoesdevelopmentanddeliveryforclientbindingsforyou.Ifyoudon’tusePython,youwillhavetoresearchiftherearesupportedup-to-dateclientbindingsoryoumustimplementyourown.Soitisuptoyourdevelopmentteamtodecidewhichlanguageshouldbeusedfordevelopment,includingallgivenpoints(abilitytocodefast,workonvirtualizedhosts,etc.).
Onceyouhavemadeadecisionregardingbasedevelopmenttechnologies(includingcodinglanguage,additionalsoftware,SDKs,etc.)itistimetofigureoutyourbestpracticesforapplicationdevelopment.
ManageYourCodeAppropriatelyApplicationsthatarebeingdevelopedshouldbeversion-controlledusinganysoftwaresuchasGIT,Mercurial,orSVN.Itisveryimportantiftheapplicationisdistributedthateachofitscomponentsshouldbetreatedasseparatecloudapplications.Notethatmultipleapplicationsthataresharingthesamecodebaseisaviolationofthismethodology.So,basically,keepyourapplicationsseparate.Goingbacktotheversioncontrolsystem,itismorethanobvioustousethembecausetherewouldbeaneedtohave,forexample,astableproductionversionorstagingthatisbeingrecentlydeveloped.
DependencyManagementForanycloud-readyapplicationsitisnecessarythatyouexplicitlydefinetheirdependenciesinamannerthatisunderstandabletothepackagingsystemofthedistribution.Agoldenruleistoneverrelyonadeploymentenvironment,sinceitispossiblethatfromversiontoversiontherearesomepackagesthatmightnotbepresented,whichmeansexplicitisbetterthanimplicit.AsimpleexampleishowUbuntu12.04hasPostgreSQL9.1initssourcerepositories,butUbuntu14.XXdoesn’t.
ConfigurationManagementMakeyourapplicationconfigurable.Itispossiblethatthedeploymentenvironmentmayvary(deploymenthostname,credentials,IPaddressesincaseofSwitches,NATs,etc.).Therearealsoapplicationconfigurationparametersthatareremainingthesameacrossdeployments,soitdoesn’tmeantheyshouldnotbeconfigurable,butusesomesortofdefaultvalues.Anotherimportantitemtotakeadvantageofisconfigurationparametergrouping.Forexample,ifanapplicationusesadatabaseandanAMQPserviceforitsinternalneeds,pleaseputthoseoptionsintodifferentsectionssuchas[database],[messaging],andfordifferenttypesofdeploymentsitwouldbenicetohavesectionslike[production],
[staging],ifnecessary.
Build,Release,andHaveFunTherearefourmainstagesbeforeallowingaccesstoanapplication:
Build:Simple,right?Makeadistributionofyoursourcecode,anditdoesn’tmatterwhatitwillbe:DEB,RPM,PythonEGG,GitHubTag,orwhatever.
Staging:Oftentakesacoupleiterations.Intherealworld,astagingenvironmentwithaninstalledbuildisbeingexaminedusingpost-deploymentverifications.Bysaying“post-deployment”verificationwemeanthattheQAteamrunsasetofscenariosthatmimicuserbehavior.Duringstagingitispossibletodiscovercertainbugsorunexpectedapplicationbehavior.InthiscasetheQAteampreparesanadditionalsetoftestscenariosfornewstagingdeployment.
Release:TheKraken!Oftenthereleasestageinvolvesnewversionpublishing,soprepareversionreleasedocumentation,anddoanyannouncementswithinanyavailablecommunicationchannels.Beforedoingareleaseitisnecessarytoprepareamechanismfortheuserreports(JIRA,Slackchannel,oramailinglist).
Havefun:Yes,havefunwithuserreports,issues,andnewrequestedversionfeatures.
PrepareYourApptoWorkatScaleorDieMostdistributedapplicationsaredistributedbecausekeepingasingleinstanceofanapplicationgivesazerofault-tolerance.Butlet’sfigureouthowanapplicationcanscalewithoutconsumingmoreVMs.Almostalldevelopmentframeworkshavemultithreaded,processedlibrariesforcreatingaserviceslikeRESTfulservicesorapplicationenginesthatcanhandlemultiplerequestsatthesametime.Theterm“worker”isanentitythatisbeingmanagedbyataskbroker.Here’sasimpleexample:thePythonlibraryFlasksupportsprocessesandthreads,butbecauseofitsimplementationitisnotrecommendedtouseitasauseraccessibleservice.InproductionitisrecommendedtouseNginx+PythonGunicorn+Flask,butlet’sunderstandwhy.Nginxworksasaproxyanditdoesagoodjob,butPythonGunicornworksasalocalRESTfulservicewrapperandallowsyoutorunanapplicationwithinmultipleworkersthatarebeingexecutedasseparateprocesseswithacommontaskdistributor.TheFlaskapplicationholdsanimplementationoftheRESTfulapplication.
Speakingofthenumberofworkers,takeintoaccountthatit’sstronglysuggestedtorunonlyonetypeservicesperVMinstance.So,yourapplicationshouldrunanumberofworkersequaltothenumberofvCPU.However,wearestilltalkingaboutasingleVMwithmultipleworkersinit,andwestillatthepointwhereweare,anapplicationshouldsurviveandbeavailableforitsusers.Andherecomesloadbalancingandhighavailability—cloud-readyapplicationsshouldbereadyto
workcorrectlywithinmultipleinstancesbehindaloadbalancer(eachapplicationdoesn’tstoredatalocally,butdoespersistintoabackingservice)withinanHAmode.
Whyishighavailabilityandloadbalancingneeded?Firstofall,HAmodegivesyoutheabilitytoaccessapplicationswithinitsmultipleinstances(example,Galeramaster-2-musterreplication),soyouhaveaninstanceforanAtoZuserwhocangetthesamedatafromanyofthem.ThisishowHAmodeworks.Butindevelopinganapplicationthatisconsumingacloudapplication,itisnotveryusefultorememberasetofIPaddressesordomainnamesforeachapplicationinstance.LoadbalancingprovidesyouwiththeabilitytohidethecloudapplicationbehindoneIPaddressorDNSname.Thisisbeneficialbecausetheloadbalancerdistributesrequestsbetweencloudapplicationinstances.Becauseofthis,yourapplicationshouldnothavetoworryaboutaccessibilityofaspecificinstance.
MaximizeRobustnesswithFastBootstrappingandGracefulShutdownOpenStackapplicationsshouldstrivetominimizebootstraptime.Inanidealworld,anapplicationtakesafewsecondsfromthebootstrapexecutionuntiltheprocessisupandreadytoreceivetasks.Ashortstartuptimeprovidesmoreagilityforthereleaseprocessandscalingup;andithelpstoimproverobustness,becausetheapplicationinstancemanagercanmoreeasilymoveittonewphysicalmachines(byauto-scalingevents).ApplicationsshutdowngracefullywhentheyreceiveaSIGTERMsignalfromtheirmanager.Unfortunatelymostapplicationdevelopersareputtingworriesaboutagracefulshutdowntothebacklog.
KeepDevelopment,Staging,Pre-ProductionandProductionAsCloseAsPossibleAsdevelopersyouneedtokeepinmindthefollowing:
Makeyourtimegapsmallbetweenwritingcodeandputtingitintostaging/pre-production/production.
Makethepersonnelgapsmall.Youarethecommitterofnewcode,soyouareresponsiblefordeploymentwithinanyenvironment.
Makethetoolsgapsmall.Eachdevelopershouldkeeptheirenvironmentalmostsimilartoaproductionenvironment.
Keepthisinmindwhentestingyourcode.Asadeveloperyoushouldresisttheurgetousedifferentbackingservicesbetweendevelopmentandproduction,evenwhenadapterstheoreticallyabstractawayanydifferencesinbackingservices.Differencesbetweenbackingservicesmeansthattinyincompatibilitiescropup,causingcodethatworkedandpassedanytypesoftestsindevelopmentorstagingtofailinproduction.
TestAsMuchAsPossible
Inapplicationdevelopmentthatinvolvestheuseofattachedresourcesitisnecessarytowritethenexttypesoftesting:
Fake-modeintegrationtests:Thistypeoftestingallowsyoutoexamineyourcodenotinvolvingattachedresources(foron-demandservicesthatcostyoumoney)butuseinsteadtheirfakeimplementationstubs.
Real-modetests:HandleanyAPIbackingservices.
Post-deploymentchecks:Thistypeexaminesuserstories,scenariosagainstdeployedapplication,andoftentakespartatstagingandpre-production.
ContinuousIntegration/ContinuousDeliveryContinuousIntegration(CI)isthepracticeoftestingeachchangedonetoyourcodebaseautomaticallyandasearlyaspossible.So,forthesakeofstabilityinsurance,yourprojectshoulduseCIvotesaspartofcodereview,becauseCIwouldpreventyoufrommergingcodethatdoesn’tworkcorrectly.ContinuousDelivery(CD)followsyourtestsresultstopushyourchangestoeitherastagingorpre-production(pushingintoproductionmaycauseproblems).Inanycase,CDmakessureaversionofyourcodeisalwaysaccessible.ItispossiblethatyouneedtokeepyourownCI/CDduetospecificreasons.Butifyourorganizationissmallandyoudon’thaveenoughresourcestoinvestintobuildingyourownenvironment,youcanuseanyCI-as-a-Service.Therearetwowell-knownservices:TravisCI(https://travis-ci.org/)andCircleCI(https://circleci.com/).Feelfreetopicktheoneyoulike.
So,youhaveSDKs,andyouhaveguidelinesonhowtodothis,andhownotto.YouhaveCIandCD.Itisnowtimetodosometrickymagic—deployanapplication,arealcloudapplication.
OPENSTACKAPPDESCRIPTIONANDDEPLOYMENTSTRATEGIESSo,thisisagoodtimetotalkabitaboutlegacyapplicationdescription.
Comingbacktothemethodologyofmigratinganapplicationtothecloud,youneedtohaveallofthestepsimplementedthatwehavecoveredinthischapterforyourapplicationtobecomecloud-ready.Let’sassumethatyouhavetheseinputs:
Applicationconsistsofthesecomponents:WebUI,RESTfulservice,back-endservice,andabackingservice.
WebUIandRESTfulservicearefacingtousers.
Back-endserviceisaccessibleonlybyaRESTfulservice.
Backingservicecanbeanattachedserviceoritcanbethepartofanapplication.Onlyapplicationback-endservicestalktothebackingservice.
So,whatwouldbethebestsolutiontomakethisapplicationcloud-ready?
DEMOAPPLICATIONSOURCECODEYoucanaccessthesourcecodefromourdemoapplicationviaGitHub:https://github.com/johnbelamaric/openstack-appdev-book.
Cloud-ReadyAppDescriptionFollowingthemigrationsteps,youneedtodecoupleyourlegacyapplicationintomultiplenodes.Let’sassumethatyourapplicationconsistsofthesenodes(seeFigure4.1):
WebUInode
RESTfulservicenode
Back-endservicenode
Backingservice(MySQL)
Figure4.1
Youneedtodefinethehardwarerequirements,i.e.intermsofOpenStack–definespecificinstanceflavorsthatdescribethenumberofvCPUs,RAM,ephemeralandrootdisk.Forthesakeofsimplicitylet’sassumethatyouareokwithonlyoneflavor,butmostreal-worldcasesmustdefineflavorparametersforeachapplicationservice,becauseoftheworkflows.Inmostcases,someinstanceswouldrequirealotofvCPUstodocalculations,andotherinstanceswouldrequiretonsofRAMandarootdisktododataprocessing(HadoopanditsHDFSwithmap-reducewouldbeagoodexamplehere).
Forthecursoryglanceitlooksfine.UsersareabletoaccesstheapplicationwithintheWebUIorRESTfulservice.Suchanapplicationwouldbeagoodexampleofhowtointegrateintothecloudsincethatgivenappismulti-tiered.
Whenwe’retalkingaboutMySQLandbackingservicesingeneralwehavetoconsiderthatthistypeofserviceshouldbedurable,andavailablenomatterwhathappens.So,basedongiveninputsweneedtofigureoutwhichoperatingsystemisneeded,howmuchresources(RAM,vCPUareneeded),anddowewanttokeepMySQLdataasanattachedblockstorageprovidedbyGlance(thesestepsanddecisionsareveryimportant,becauseallofthisaffectsthelifecycleoftheservice).So,relyingonbackgroundknowledgewestronglyrecommendyouuseaflavor
thatdoeshaveatleast4vCPUsandattheveryleast8GBRAM.Regardingstorage,werecommendyouuseablockstoragevolumetoallowforquickfailrecoveryandconsistency.
TheapplicationcomponentsaretheWebUI,RESTfulservice,andback-endservicenodes.ByitselftheRESTfulservicenodeisnotastandaloneapplicationthatisbeingdeployedaspartofapplicationdelivery.Accordingtobestpracticesofapplicationdevelopment,itshouldbetreatedasaseparateapplication.Comingbacktowhatwe’vediscussedforMySQL,weneedtofigureoutwhatwouldbethebestoptionsfordeployingthisapplication.Byitself,theRESTfulserviceisastatelessapplication,butithastoworkfasttoservemultipleusersatthesametime.ItisrecommendedthatyouuseaflavorthathaslotsofRAM,avCPUquestionisnotcriticalfornow,andwedon’tneedblockstoragefornowbecausethere’snothingtostore,becausewejustprocesstherequests.Speakingofanapplicationback-endservice,thispartoftheapplicationistough,sinceitdoesalmostalloftheheavywork.Sothisnodeshouldbeverypowerful,andithastohavelotsofvCPUs,RAM,anddiskspacethatarerequiredbyanapplication’sworkflowdefinition(notblockstorage,butflavorrootdisk).ThereisnothingdifferentabouttheWebUInode—itshouldbefast,andtherearenootherdemands.
OncetheRESTfulserviceandWebUInodesgetdeployed,userswillbeabletoaccesstheRESTfulservicewithintheRESTfulservicenodebyitsIPaddressandWebUIindependently(accordingtoagivenschema,UIcanworkwithsingleinstanceofaRESTfulserviceatthesametime).Pleasekeepinmindthatintherealworld,eachservicethatisfacingtoauserneedsmustbesolidandreadytobestress-tested,becauseinsomecasesusersareactinglikeDDoSattackers.
Aftercompletingthissectionwehaveacloud-basedapplicationthathasbeendeployed,takingintoaccountallbestpracticesandapplicationdemands.
NetworkDeploymentStrategyLet’sgobackanddescribetheapplicationdeploymentschema.Wehavethreetypesofservices,inotherwordsthreedifferentcloudapplications,andeachapplicationdeservesitsownaccesslevelfromtheoutside.Forexample,thecurrentschemadescribesanapplicationdeploymentwithinasinglenetworkthatseemsokforanexample,butsuchSLAdoesn’tlookgoodforothercases.WebUIandRESTfulservicesarefacingtouserswithinapublicnetwork,sotheusercanaccessbothofthemandsuchthingsbreaktheconceptsofasecureSLA.
PublicandPrivate(Management)NetworkYoumightsuggestthateachcomponentuseitsownnetwork,butitwilladdanoverheadsinceyou’dneedtodoroutingandmighteventuallyendupwithcomplex,hardlymaintainablesolution.Ofcourseyouarenottryingtolinkmultipledatacentersintoasinglenetworkforthissolution.Inthiscaseitwould
beenoughtodefinetwonetworks—public(withInternet,andaccessiblefromtheoutside)andprivate(noInternet,andaccessiblefromapublicnetwork).Firstofall,itisnecessarytofigureoutwhichnetworkeachservicebelongsto.It’seasywithourexample:networkplacementisdescribedinFigure4.2;WebUIaspublicNICinFigure4.3;RESTfulservicesasprivateNICinFigure4.4;applicationback-endserviceasprivateNICsinFigure4.5;andMySQLnodeasprivateNICinFigure4.6.
Figure4.2
Figure4.3
Figure4.4
Figure4.5
Figure4.6
Asyoucansee,baseduponthedescriptiongivenabove,applicationtiersmayhaveacoupleofnetworksattachedtopreventunwantedaccess.Now,let’stakealookateachcomponent,startingwiththeWebUI.SincethistypeofapplicationtierneedstobeavailabletousersitshouldhaveapublicIPaddressanditdoesn’thaveinternalnetworkaccesstopreventsecurityrisks.So,thegreencolorwirecorrespondstothepublicnetworkshowninFigure4.3.
TheRESTfulservicetierissimilartotheWebUItierforthisapplication,sincethecomponentshouldbeaccessiblewithinthepublicIPaddress.But,sincethesecomponentsaretiedtothebackendservice,ithastohaveaccesstotheprivatenetwork(seeFigure4.4).Theredlinewirecorrespondstotheprivatenetworkaccess.
Goingforward,let’sexaminetheapplicationback-endservicetieranditsnetworking,showninFigure4.5.Thispartoftheapplicationisonlyaccessiblewithintheprivatenetwork.
Takealookatthelastcomponentofourapplication—MySQL(seeFigure4.6).Thispartoftheapplicationfollowsasimilarnetworkingstrategyastheback-endservice.Theprivatenetworkandthiscomponentareaccessibleonlybytheback-endservice.
KeepinmindthattheaccessibilityoftheapplicationcomponentandthenetworkstrategyrequiresanSLAsetupforanapplicationwithingivennetworks.InthecaseofOpenStackitisrecommendedthatyouusesecuritygroups(availableinNova-networkandNeutron):
FortheWebUIinstance:SupposeweuseNginxforhostingtheUIcodeanddefaultportsforHTTPandHTTPS.Itwouldbenecessarytocloseanyportsexcept80and443forinboundconnectionsandopentheportfortheloadbalancerforoutboundconnections.
ForRESTfulservicenodes:Securitygroupsforinboundconnectionsrequirealoadbalancerportonly.SecuritygroupsforoutboundconnectionsrequireAMQPbrokerportsordirectaccessportstotheapplicationback-endservice.
Fortheapplicationback-endservice:SecuritygroupsforinboundconnectionsrequireaRESTfulservicefornodesportsfromtheirIPsonlyornorules(inthecaseofAMQPtransport,therewouldbeonlyoutboundconnectionstotheAMQPbroker).SecuritygroupsforoutboundconnectionsrequireMySQLportswithaMySQLmasterinstanceIPasCIDR,andinthecaseofAMQP,brokerinstance(s)port(s).
ForMySQLnode:Securitygroupsforinboundconnectionsrequireanapplicationback-endserviceport,andMySQLslaveportswiththeirIPsasCIDRs.SecuritygroupsforoutboundconnectionsrequireamasternodeportandanIPasCIDR.
SUMMARYInthischapterwecoveredhowtodoamigration,includinglimitationsandcriticalpoints,butitwasn’tjustasimpleliftandshift.Wetriedtoexplicitlyexplainhowtodecoupleapplicationservices,andhowtoimplementadeploymentstrategy,includingnetworkingandSLA.We’veamendedstepslikeapplicationtestingandsoftwareconfiguration,duetothevarietyoftechniquesapplicableforsuchcases,andalsowe’veskippedmonitoringbecauseofthecomplexityoftryingtodescribethegenericusecaseforcloudapplicationmonitoring.Buteveryothercaseandtechniquedescribedinthischapterareapplicableforanytypesofcloud-readyapplications,regardlessiftheyarealegacyapplicationinthepastoracompletelynewapplicationthatisunderdesignrightnow.
5ImprovingontheApplicationWHAT’SINTHISCHAPTER?
Understandingthetypesoffailurescenariosthatcanaffectapplicationsrunninginthecloud
ProvidingaccessintotheapplicationandunderstandinghowhostnameandIPaddressesplayanimportantrole
Methodsforscalinganapplicationtomultipleinstancesandregionsandadaptingtoeventsintheenvironment
Improvingthebasicapplication
Itiscommonforapplicationstobeinitiallydevelopedforthecloudinaverysimplemanner.Thedevelopermaystartwithdeployingtheapplicationasasingleinstanceinthecloud.Iftheapplicationhasdifferenttypesoffunctions,suchasawebfront-endandadatabaseback-end,thesefunctionscanbebrokenintoacoupledifferentinstances.
Thischapterdiscusseswhatyouasthedeveloperneedtodonext.Youneedtoknowwhatkindoffailuresoccurinthecloudandhowthosefailurescouldaffecttheapplication.Youalsoneedtounderstandtheapplicationcomponentsandhowtheyrelatetofailuresinordertobuildamorerobustandreliableapplication.
Differenttechniquesareexaminedonhowtoscaletheapplicationinthecloud.Thechapteralsotakesalookatperformanceandwhyitisimportanttoknowwhenandwhereperformanceissuesoccur.Often,scalingtheapplicationintherightplacescanmitigateperformanceissueswhentheyoccur.
Thechapteralsotakesalookatdataprotection.Howimportantisthedatatotheapplication?Isitimportantthatdataisneverlost?Cansomedatabelostandrecreatedorreplacedlater?Howimportantisthedata?Theanswerstothesequestionscanaffectdecisionsonhowdataisprotectedinthecloud.
Highavailabilitymeansthattheapplicationisalwaysavailableandminimizesdowntime.Italsomeansthattheapplicationshouldrunreliablyandbeperformant.Thischaptertakesalookatwhatitmeanstobuildahighlyavailableapplicationandsomeofthechallengesdevelopersmayrunintoalongtheway.
Finally,wetakeabasicapplicationandimproveuponittodemonstratetheconceptsinthischapter.Threedifferentcomponentsareexaminedastheyaretakentothenextlevelinprovidinghighavailability.
DEMOAPPLICATIONSOURCECODEYoucanaccessthesourcecodefromourdemoapplicationviaGitHub:https://github.com/johnbelamaric/openstack-appdev-book.
FAILURESCENARIOSOperatorsoftheOpenStackcloudunderstandthatitisdifficulttokeepthecloudrunningproblem-free.Thelargeracloudenvironmentis,themorelikelyproblemswilloccur.Developersneedtounderstandwhattypesofproblemscanaffecttheapplicationandhowtodealwiththem.Applicationsthattakethesefailurescenariosintoaccountwillsufferlessdowntimeandcontinuetorun,evenwhenproblemsdooccur.
HardwareFailureAtypicalOpenStackenvironmentcontainsafewadministrativeserverstohelprunthecloud,aswellasabunchofotherservers,calledcomputenodes,thatprovidethemeansforapplicationstobedeployedtothecloud.Thebiggertheenvironment,themorehardwarethatwillberequiredtorunit.
Eventually,aserver’shardwareisgoingtofail.Themostcommontypesofhardwarefailureincludediskdrives,memory,CPU,powersupplies,andnetworkinterfaces.Somehardwarefailurescanbringtheserverdownentirely.Somehardwarefailuresmayresultinareducedserverperformance.Otherfailuresmaynotaffecttheserveratall,suchasoneofthepowersuppliesfailing.
Ifanapplicationisbuiltwithouthighavailabilityinmind,itislikelythattheapplicationhasmanysinglepointsoffailurebuiltintoit.Ifaserverfailsandanyoneofthosesinglepointsoffailuresisonthatserver,theapplicationwillfailaswell.
NetworkFailureThereareseveraldifferentwaysthatanetworkcanbesetupandoperatedwithinanOpenStackenvironment.However,fromtheperspectiveoftheinstancerunninginthecloud,ithasanetworkinterfacecardwithanactivenetworklinkandanassignedIPaddress.Allthatmatterstotheinstancesisthatitisconnectedtothenetworkandthatitcanaccessotherinstancesordevicesonthenetworkreliably.
OnewaythatinstancesexperiencenetworkfailuresiswhensomethingbreaksintheOpenStacknetworkstack.TheinstancestillseesanetworkandstillhasanIPaddress,butitisunabletoconnecttoanyotherdevicesonthenetworkandotherdevicesareunabletoconnecttotheinstance.Therootcauseofthenetworkissuewillaffecthownetworkconnectivityisrestoredintheinstance.Forexample,issueswithNeutronorOVSonthecomputenodewheretheinstanceexistsmayrequiretheinstancetoberebootedinordertorestoreconnectivity.
AnotherwaythatinstancesexperiencenetworkfailuresisthroughthelossoftheIPaddressonitsnetworkinterfacecard.TheIPaddressisprovidedtotheinstancebyaDHCPservicethatrunsonthenetworknode.ItisrarefortheDHCPserviceitselftogodown,butissuesintheOpenStacknetworkstackmaydisrupt
theabilityfortheDHCPservicetocommunicatetotheinstance.DefaultconfigurationsofOpenStacktendtoexpireDHCPleasesveryquickly,whichresultsintheinstancerenewingitsDHCPleaseoften.Networkcommunicationissuescandisrupttherenewalprocess,whichresultsintheIPaddressbeingreleasedfromtheinstanceandultimatelytakingitsnetworkdown.
Theoperatingsysteminstalledontheinstancecanmakeadifferenceonhowitrespondstonetworkissuesaswell.Forexample,whenaninstancelosesaDHCPaddress,UbuntutypicallycontinuestoretryrenewingtheDHCPaddress.Whenthenetworkissuesareresolved,therenewalprocesssucceedsandtheIPaddressisrestored.However,RedHatandCentOSarecommonlyconfiguredbydefaulttogiveupaftertherenewalprocessfails,whichmeansthatevenifthenetworkissuesareresolved,theinstanceisnolongerattemptingtorenewtheDHCPleaseandpermanentlystaysoffthenetwork.Theeasiestwaytoresolvethenetworkconnectivityissuewiththeinstanceistoreboottheinstance.AbettersolutionwouldbetoadjusttheDHCPclientforRedHatandCentOSinstancestoalwaysretryDHCPrenewalsinsteadofgivingup.
Externalnetworkissuescanalsooccur.AtypicalOpenStackenvironmentwillbesetupwithasetofadministrativenodes,numerouscomputenodes,oneormoreswitchestoconnectallthenodestogether,andarouterfortheswitchestoconnecttofortrafficcominginorleavingtheOpenStackenvironment.Theswitchesarecriticaltotheoperationoftheenvironment,asthatisthelifelinebetweenthecomputenodeandthenetworknode.Aswitchproblemcandisruptcommunicationbetweenthenodes.Anissueattheroutermaynotdisruptcommunicationbetweennodes,butitmaypreventaccesstootherthingsonthenetwork,suchasDNSlookups,accesstoauthenticationservers,andanyothernetworkservicestheinstancesmaydependon.
StorageFailureAnOpenStackinstancemakesuseofeitherephemeralstorageorpersistentstorage,orevenacombinationofboth.Ephemeralstorageisdefinedasstoragethatmaynotbepermanent.Forexample,thestorageassociatedwiththeinstancecouldbedeletediftheinstanceitselfisterminated.Persistentstorageisdefinedasstoragethatispermanent.Ifaninstanceisterminated,thepersistentstorageassociatedwiththeinstanceistypicallynotdeleted,butmaybedetachedandmadeavailabletobeattachedtoanotherinstance.
Persistentstorageistypicallyimplementedasobjectstorageorblockstorage.ObjectstorageisoftenimplementedusingSwiftorsomeotherproductthatimplementstheSwiftAPI,suchasCeph.Whenusingobjectstorage,containersarecreatedandbinaryobjectsarestoredinsidethecontainers.InstancescanretrievethestoredobjectsusingtheAPIimplementedbytheobjectstoragesystem.Blockstorageshowsuptoinstancesasblockdevicesintheoperatingsystem,whichcanthenbemountedonadirectoryorusedasarawdevice.
Ephemeralstorageissimilartoblockstorageinthewaythatitappearstotheinstanceasblockdevices.Thismeansthatinstancescanmounttheblockdeviceonadirectoryoruseitasarawdevice.EphemeralisconfiguredbydefaultinOpenStacktousethestoragefromthedisksinthecomputenodes.Itispossibletoconfigureephemeralstorageusingotherarchitecturestoo,butusingcomputenodedisksforephemeralstorageisthemostcommonusage.Unlessaninstanceislaunchedusinga“bootfromvolume”method,theinstancewillbecreatedusingthecomputenodeephemeralstorage.
OneofthemostcommonhardwarefailuresencounteredinanOpenStackenvironmentisdiskfailure.Diskfailurescanhaveawideeffectoninstances,dependingonhowOpenStackisconfiguredandhowthediskfailureaffectsthedeviceitisinstalledin.Ephemeralstoragewilllikelyhaveagreatereffectoninstancesthanpersistentstorage.Withephemeralstorage,dataisveryunlikelytobereplicatedandthechancefordatalosswillbehigher.Forpersistentstorage,dataisoftenreplicatedandcanbeaccessedinmultipleways.Ifasinglediskfailsinapersistentstoragecluster,theinstancemaynotevennotice,sincethedataremainsavailableandconsistent.
Let’slookatthecasewheretheinstanceisrunningonephemeralstorage.Theoperatingsystemisonanephemeralrootdiskthatlivesonacomputenode.ThecomputenodecouldbeconfiguredwithsomekindofRAIDthatreplicatesdatabehindthescenes.Asinglediskfailuremaynotaffecttheinstanceatall,muchlikeasinglediskfailureinpersistentstorage.However,itisnotuncommontoseeaRAIDdeviceexperienceadiskfailurethatresultsintheblockdevicegoingintoread-onlymodeinsidetheinstance.Eventhoughthedataisstillavailableandcanbereadbytheinstance,writesareblocked.Read-onlymodeusuallyoccursatthecomputenodelevel,whichaffectsalltheinstancesrunningonthatnode.Rebootingthecomputenodeisoftenneededtofixtheissue.
IfthecomputenodeisnotconfiguredwithRAIDorsomekindofdatareplicationforephemeralstorage,thenalossofadiskisusuallycatastrophictotheinstance.Ifthefaileddiskiswherethatinstance’sstoragewaslocated,thenthatdataispermanentlylost.Theinstancewillneedtobeterminatedandrebuilt.
Forblockstorage,instancesmayexperienceproblemswiththemountedvolume.Ifthereareseriousissuesinthepersistentstoragecluster,avolumemaybecomeunavailabletotheinstance.Ifthevolumeismounted,anyreadsandwritesmayhang,waitingforaresponse.Ifthevolumeisnotmounted,itmayrefusetomountorbedetectedasavaliddisk.Thisisseenmoreoftenwhenaninstanceisbeinglaunchedorrebooted.Ifthevolumeisunavailableforsomereason,theinstancemayfailtolaunchorneedadministratorinteractiontogettheinstancetoboottherestoftheway.
MostvolumeissuesoccurbecauseofissueswithintheOpenStackenvironmentandnotnecessarilywiththepersistentstoragecluster.TheremaybeanissuewithCinderoranissuewiththecommunicationbetweenNovaandCinder.Manyof
theseissuesmaynotaffectavolumethatisalreadymountedinaninstanceandcurrentlybeingused.However,theseissueswilllikelyaffectthelaunchingorrebootingofinstances.Thisalsoaffectstheabilitytodetachvolumesfromoneinstancesothattheycanbeattachedtoanotherinstance.Inmostcases,thisonlyaffectstheabilitytoaccessthedataanddoesnotresultindataloss.
Objectstorageisaccessedinadifferentmannerthanforblockstorage.Objectsarepushedintostorageorfetchedfromstorage.Ifthereareanyissuesintheobjectstoragesystem,itusuallymanifestsasobjectedbeingunavailableoroperationstimingout.
Persistentstorageismostoftenconfiguredwithsomekindofreplication.Replicationfactorsof2or3arecommon,buttheremaybecaseswherereplicationisdisabledforsomereason.Itisimportanttoasktheadministratorsabouthowreplicationisconfiguredinordertobetterunderstandhowfailurescouldaffectaccesstodataandthepotentialfordataloss.
Instanceshaveadifficulttimedealingwithstoragedevicesbecomingunavailable.Iftheapplicationdependsondataalwaysbeingavailable,itisimportantthatmonitoringisconfiguredtomonitorstorageavailableandintegrity.Forephemeralstorage,mostfailuresresultsintheinstancegoingdownaswell.However,instancesshouldmonitorforwhenfilesystemsgointoaread-onlystate.Instancesmayoperatefinewitharead-onlyfilesystem,especiallyiftheapplicationonlyreadsdataanddoesn’twritedata.Monitoringmaynotseetheissueeither,norwilltheissuebeseeninanyofthelogs.Sincearead-onlyfilesystemisanindicationthatthereisanunderlyingproblemwiththecomputenode,catchingitearlysotheapplicationcanadaptarounditisagoodidea.
SoftwareFailureAnothertypeoffailurescenarioispurelysoftwarespecific.Forexample,akernelbugwithintheoperatingsystemofthecomputenodemaycauseittocrashorhang.Thiswillresultintheinstancebecomingunavailable.Sometimes,itmaybebecauseofakernelbugintheinstance’soperatingsystem.Theinstanceitselfwillcrashorhang,requiringareboottoputitbackintooperation.
IssuesintheOpenStacksoftwaresuitemayalsocauseproblems.Mostproblemsofthisnaturedon’taffectaninstance,unlessitisanissuethatwillaffecttheinstance’snetworkorabilitytoaccessitsstorage.CommonOpenStacksoftwareissuesincludeproblemswithRabbitMQ,CinderandCeilometer.Theseissuesmaynotaffectcurrentinstances,buttheycouldverylikelyaffecttheuser’sabilitytolaunchnewinstances,terminateinstances,ordoanyotherOpenStackrelatedmanagement.Forapplicationsthatmakeuseoftheelasticnatureofthecloudtodynamicallygrowandshrinkinstancesbasedondemand,softwareproblemscanreducecloudelasticitysignificantly.
Anotherissuethatcouldoccurisalackofresourceavailability.Ifaninstanceisrunninganapplicationthatisleakingmemory,thatinstancewilleventuallyrun
outofmemoryandfail.Ifanapplicationislaunchinglotsofprocessesanddoesnotproperlycleanupafteritself,theinstancecanrunoutofprocessslotsandbeunabletolaunchnewprocesses.Ifanapplicationfailstoclosefilesthatitopensandisnolongerusedandopensalotoffilesovertime,theapplicationmayuseupalltheavailablefiledescriptors.Thiscancausetheapplicationtofailorevenpossiblytheinstance.Whenaninstancerunsoutofresources,itmayresultintheinstancecrashing,butitmoreoftenresultsintheinstancebecomingunavailable.Monitoringmaydetectmultiplealarmsandattemptstologinmaybeunsuccessful.Rebootingtheinstanceoftenfixestheproblem.However,iftheproblemoccursrepeatedly,theapplicationneedstobeexaminedforbugsandpotentialconfigurationtweaks.Itisbettertofixtheproblemwiththeapplicationthantotrysolvingtheproblembylaunchinglargerinstanceswithmoreresources.
ExternalFailuresInstancesmayexperienceDNSlookupissuesduetosomeexternalissue.ThiscouldbetheresultofanetworkoutagebetweentheOpenStackenvironmentandtheDNSservers.ItcouldalsobeanissuewiththeDNSserversthemselves.DNSissuescanlooklikeageneralnetworkissuefromtheperspectiveoftheinstance.NearlyeverythinganinstancedoesonthenetworkrequiresaDNSlookup.WhenaDNSissueexists,lookupsgenerallydonotjustfail,rathertheytimeout.Iftheinstanceisconfiguredtodolookupsonmultipleservers,thetimeoutscanstackupforeachrequest,compoundingproblemsforapplicationstryingtoconnecttoservicesonthenetwork.
InstancescanreducetheeffectthatDNSissueshavebytuningtimeoutsettingsinthe/etc/resolv.conffileandbydoingsomekindofDNScachinginsidetheinstanceitself.Ifcachingisused,onceahostnameisresolvedtoanIPaddress,itwillbekeptinthecacheforaperiodoftimesofutureDNSlookupsforthathostnamecanbeskipped.Manyinstancesareconfiguredwithoutcachingenabled.Dependingontheoperatingsysteminstalledintheinstance,NSCDordnsmasqmayneedtobetweakedinordertoenableDNScaching.
Anothercommonissuethatcanoccurtoinstancesisitsinabilitytotalktoimportantservicesonthenetwork.Agoodexampleofacommonserviceisanauthenticationservice.ActiveDirectory,LDAP,KerberosandRadiusareallexamplesofauthenticationservicesthatcouldbeused.Networkissuesandissueswiththeauthenticationserviceitselfcancauseanapplicationtomisbehaveorfail.Distributedapplicationsmayseeperiodicfailuresifonlyaportionoftheinstancesexperienceauthenticationissues.Forexample,usersmayseeaperiodicwebpagefailureiftheirclickresultedinanactionthattalksaninstancesthatisunabletodoauthentication.
Authenticationserviceissuesaredifficulttoovercomeintheinstance.Thebestwaytodealwithauthenticationserviceissuesistodetectthemwhentheyoccur,understandwhetherornotitistransientoriftheissueistrendingfrombadto
worse,andreacttotheissue.Adistributedapplicationcoulddetectauthenticationissuesinaportionoftheinstancesandchoosetoremovethoseinstancesfromthepool,workingaroundtheproblemuntilauthenticationservicehasbeenrestored.Attheveryleast,thereshouldbemonitoringthatalertstheapplicationownerstotheissuesothattherootcausecanbeinvestigatedandthenecessaryadministratorsinvolved.
Instancescanalsoexperienceissueswithtimeskew.Thisisasubtleproblemthatmaynotbenoticedwithoutpropermonitoring.Manyapplicationsmaynotevencareabouttimeskew,especiallyforinstancesthatarerunningportionsofanapplicationthatdoesnotrequirestate.However,authenticationcommonlydoesrequiretheinstance’stimetobeveryclosetothetimetheauthenticationserversees.Someauthenticationmethodsareverystrict,resultinginfailedauthenticationattemptsiftheinstance’stimeismorethanaminuteortwooff.Someapplications,suchasfinancialapplications,requireaccuratetimeaswell.
RunningNTPinsidetheinstancescanhelpkeeptheinstance’sclocksynchronizedtothecorrecttime.However,NTPisnotfullyreliable,becauseitdependsontheperformanceofthecomputenodetheinstancerunsonanditdependsonthenetworkperformancebetweentheinstanceandtheNTPservers.IfthecomputenodebecomesCPUbound,theinstance’stimemaystayoutofsync,evenwithNTPrunning.BythetimeNTPadjuststhetimefortheinstance,theadjustedtimecouldbewrong.Networkissuescandisrupttimeupdates.TheNTPservicecouldalsobehavinganissue.Forexample,oneoftheNTPserverscouldbeoutoftimesyncitselfandreportingthewrongtime.SomeoftheseissuescanbesolvedbyconfiguringtheinstancetopointtoseveralreliableNTPservers.Iftimesynchronizationisimportanttotheapplication’soperation,itisessentialthatmonitoringisconfiguredtocatchtheseissuessothatappropriateactionscanbetaken.
HOSTNAMEANDIPADDRESSINGApplicationstendtobeverycomplex,andcomprisedofmanyfunctionalunits,withoneunittalkingtoanother.Usersalsoneedawaytousetheapplication.ThisisaccomplishedbyassigninghostnamesandIPaddressestoallofthedifferencepiecesofanapplicationthatneedit.Anexampleforasimpleapplicationmightbeawebserverthattalkstoaback-enddatabase.ThewebserverhasanIPaddressthatusersconnectto,andthedatabasehasanIPaddressthatthewebservertalksto.
Whathappenswhenthewebserviceisactuallyawholebunchofinstances?Whathappensifthedatabaseback-endisactuallyadatabaseclusterrunningseveralservers?ItwouldcertainlybepossibletoassignpublicIPstoallinstancessothateverysingleinstanceisaccessible.However,ifauserisconnectingtothewebinterfaceofanapplication,itwouldbebadpracticetoprovidealltheIPstotheuserandforcetheusertoselectwhichonetouse.
SinglePointofEntryNormally,anapplicationhasasinglepointofentryfortheusers.Ifitisawebapplication,itisaURLtheyenterinthewebbrowser.Ifitisaclient/servertypeapplicationtheclientisconfiguredtohitaparticularserveraddress.Whathappenswhenawebapplicationisnowabunchofinstances?Ifthedatabaseback-endisseveralserversrunninginacluster,howisthewebfront-endconfiguredtotalktothedatabaseback-end?Thereareacoupletechniquesthatcanbeusedtodealwithapplicationconnectivityandthecommunicationbetweenthefunctionalunitswithintheapplication.
Mostapplicationsshouldhavejustasinglepointofentryforconnectionstocomeinto,whichisusuallyahostname.Whenaconnectiontotheapplicationismadeusingahostname,thehostnameisconvertedintoanIPaddressthroughtheuseofDNSservice,whichisaservicethatprovideshostnameandIPaddressmappings.TheDNSlookupoccursbehindthescenesandistransparenttotheuserorserviceconnectingtotheapplication.TheDNSservicemayreturnasingleIPaddressoralistofIPaddressesforthathostname.AnIPaddressisthenchosenandtheconnectionmadetotheapplication.
RoundRobinDNSWhenitcomestoassigningmorethanoneIPaddresstoasinglehostname,thereareacoupletechniquesthatcanbeemployed.ThefirsttechniqueistouseDNStoassignmultiple“Arecords”tothehostname.AnArecordinDNSisessentiallyanIPaddressassignment.WhenaDNSlookupoccursandtherearemultipleArecordsassignedtothename,theDNSserverreturnsalloftheIPaddressesassignedtothatname.However,eachtimetheDNSserverisqueried,thelistisrotatedbyonesothatthefirstIPaddressinthelistisalwaysdifferent.Thisisknownas“roundrobin.”
Forexample,thenamemywebhasthreeArecordsassignedtoit,1.1.1.1,2.2.2.2and3.3.3.3.ThefirsttimeDNSisqueried,theserverrespondswith1.1.1.1,2.2.2.2,3.3.3.3.ThesecondtimeDNSisqueried,theserverrespondswith2.2.2.2,3.3.3.3,1.1.1.1.ThethirdtimeDNSisqueried,theserverrespondswith3.3.3.3,1.1.1.1,2.2.2.2.ThefourthtimeDNSisqueried,theserverrespondswith1.1.1.1,2.2.2.2,3.3.3.3again.
TheclientthatisdoingtheDNSquerywillgetbackalistofIPaddressesandthenhastochoosewhichIPaddressitwilluse.Generally,clientsalwayspickthefirstIPaddressinthelist,whichiswhytheDNSserverrotatesthelisteverytimethelistisreturned.However,thereisadownsidetodoingroundrobininDNS.IfanyoftheserversintheIPaddresslistisnotresponding,theclientwillnotknowthatandwillattempttheconnectionanyways.ClientsveryrarelyhaveextralogicintheircodethattriestoconnecttothefirstIPandwhenthatfails,triesthenextIPinthelist.
Itmaybedifficultfortheadministratortoreactquicklytoserverunavailabilityorperformanceissues.Ifaserverisgoingtobedownforanextendedtimeperiod,thebadIPaddresscanbepulledoutofthelist.However,DNSserversareoftenconfiguredtocacheIPaddressinformationforaperiodoftime.ItiscommonforDNSentriestobecachedfor24hoursormore.Ifthatisthecase,removinganIPaddressfromthelistcouldtakeuptoadayormoretobereflectedintheDNSqueriesmadebytheclient.
IfaserverisgoingtobedownforplannedmaintenanceandtheadministratorknowsthatanIPaddresswillneedtocomeoutofthelist,acommontechniqueistoreducethecachetimetoashortperiodoftime,suchas1minute,wellaheadofthescheduledmaintenancetime.Whenmaintenanceisabouttobegin,theIPcanberemoved,whichclientswillseewithinaminuteoftheupdate.MaintenancecanoccurandtheIPaddressre-addedbacktothelist.Ifmaintenanceissuccessful,thecachetimecanbeadjustedbackuptoitsoriginalsetting.
GlobalServerLoadBalancing(GSLB)RoundRobinDNSisacheapandeasymeanstoallowaccesstomultipleinstancesthatprovideanimportantpieceoffunctionalitytoanapplication.Itwasalreadymentionedthatifoneoftheinstancesisdown,clientsmaystilltrytoconnecttotheinstance,beingunawareofthatissue.However,thereareotherlimitationstoRoundRobinDNSthatcanalsoaffecttheapplication.Forexample,theremightbenoabilitytoguidetheclientinselectinganappropriateIPaddressoutofthelistbasedonperformanceorpossiblyhowcloseaninstanceistotheclient.
GlobalServerLoadBalancing(GSLB)isaservicethatprovidesacombinationofDNSandloadbalancingfunctionality.GSLB’sareoftensetupinasimilarfashionasRoundRobinDNS.AhostnamemaybeassignedtomultipleIPaddresses.However,insteadoftheGSLBreturningarotatinglistofIPstotheclient,theGSLBwillreturnthelistofIPsinanorderthatmakesthemostsensefortheclient
thatisdoingtheDNSquery.IfaninstanceisdownintheIPlist,theGSLBwillremovetheIPentirelyfromthelistuntiltheinstanceisbackup.IPsareoftenorderedbygeographiclocationsothatthefirstIPaddressisphysicallyclosesttotheclientdoingthelookup.IPsmayalsobeorderedbasedonperformanceornumberofconnectionsgoingtothoseIPs.
EnterprisesmayalsocombineGSLBswithRoundRobinDNSandusebothtechniques.Thisisusefulwhenanapplicationishostedatmultiplesites.Forexample,anapplicationhostedintheUnitedStatesandinEuropecouldhavetheGSLBprovideonlythelistofIPsassociatedwiththeUnitedStateswhenclientfromNorthAmericaqueriesDNS.Furthermore,thetrimmeddownlistcouldberotatedinthesamefashionasstandardRoundRobinDNS.SincetheGSLBisawareofserveruptimeandperformance,IPscanstillberemovedwhenaserverisdown.
GSLBcanbeaffectedbysomeofthesameissuesasRoundRobinDNS.SinceGSLBisessentiallyprovidingIPsbacktotheclientviaDNSrequests,makingchangestothelistofIPaddressescanbeaffectedbycachetime.ForGSLBsdesignedforfailoverwhenanissueoccurs,cachetimesmaybesettosmalltimesalready.However,clientsoftencacheDNSlookupsaswell.ThismeansthatwhenanIPaddressisremovedfromthelistbytheGSLB,aclientmaynotnoticethatuntilitsinternalcachehasexpiredforthatlist.
GSLBprovidesanotherlevelofservicebeyondwhatDNSprovidesbyitself.However,GSLBoftencomeswithextracost,soitmaynotbefeasibletotakeadvantageofit.IfGSLBisavailable,itisthebestwaytorunportionsoftheapplicationacrossmultiplesitesinareliableway.
FixedandFloatingIPAddressesOpenStackmakesuseoftwotypesofIPaddressesforitsinstances.AfixedIPaddressisautomaticallyassignedbyOpenStackwhenaninstanceisfirstlaunched.ThefixedIPaddresscanbeeitherapublicoraprivateaddress,dependingonhowtheenvironmentisconfigured.Publicaddressesallowconnectionsfromoutsidetheenvironmenttoconnectdirectlytotheinstances.Privateaddressesdonotallowoutsideconnections,butoftendoallowconnectionstootherinstanceswithinthesameenvironmenttobemade.
TheothertypeofIPaddressOpenStacksupportsisafloatingIPaddress.FloatingIPaddressesarenotautomaticallyassignedtoaninstancewhentheyarefirstlaunched.WhenOpenStackisconfiguredtousefloatingIPs,aglobalfloatingIPpoolissetupwithalloftheIPaddressespermittedtobeusedasafloatingIP.UserswillthenpullIPaddressesoutoftheglobalpoolandintotheirtenantpool,markingthoseIPsasonlyuseablebythatspecifictenant.UserscanthenassignIPaddressesfromtheirtenantpooltospecificinstancesrunninginthetenant.FloatingIPaddressesaremostoftenpublicIPaddresseswhichallowsoutsideconnectionstobemadetothatIPaddress.OpenStackenvironmentsthatmake
useoffloatingIPaddresseswilloftenconfigurefixedIPaddressestobeprivateaddressesandfloatingIPaddressestobepublicaddresses.
OneadvantagethatfloatingIPaddresseshaveoverfixedIPaddressesisthattheusercanassignandunassignthematanytime.TheusercanmoveafloatingIPaddressfromoneinstancetoanotherwithouthavingtoterminateandrelaunchaninstance.ItisalsopossibletohavemorethanonefloatingIPaddressassignedtoaninstance.Thisgivestheuseralotofflexibilityinhowaconnectioncomesintotheapplication.Ifaninstanceishavingproblemsorcrashes,thefloatingIPaddresscanbemovedtoaworkinginstance.Itisalsousefulinmaintenance.Forexample,apatchcanbeappliedtoallinstances.AninstancecanbepatchedandthenhavethefloatingIPmovedtoitsothattheotherinstancecanbepatchedwithoutaffectingserviceavailability.
AnotheradvantagethatfloatingIPshaveisthattheycanbeusedasameanstoconserveIPaddressusageinanetwork.ThefixedIPnetworkisoftenbigger,sizedtobelargerthanthenumberofinstanceslikelytoeverbelaunchedinthatenvironment.ThefloatingIPnetworkmaynotbeasbigandmaybeafinitevaluableresource.Ifthatisthecase,userscouldassignfloatingIPstoonlytheinstancesthatneedoutsideconnectivityandrelyonlyonfixedIPsforinstancesthatonlyrelyonconnectionsinsidetheenvironment.
Forexample,aparticularOpenStacksetuphasapublicnetworkassignedtothefloatingIPaddressesandaprivateinternallyroutednetworkassignedtothefixedIPaddresses.ThedevelopersetsupaninstancerunningHAProxyandassignsafloatingIPaddresstoit.Thedeveloperalsosetsupabunchofwebinstancesprovidingthewebfront-endfortheapplication.ThewebinstancesareconfiguredwithfixedIPaddressesonlyandarenotaccessiblefromtheoutsideworld.ThefixedIPsareaddedtotheHAProxysetupandanytimesomebodyconnectstothefloatingIP’softheHAProxyinstance,HAProxyconnectstooneofthewebinstancesandproxiesthetrafficbetweenthem.Ifoneofthewebinstancesgoesdown,HAProxysendstraffictoanotherwebinstance.Ifthedeveloperneedstologintoanyofthewebinstances,thiscanbedonebyfirstloggingintotheHAProxyinstanceandthenfromthere,byloggingintothedesiredwebinstance.
NeutronPortReservationNeutronassignsIPaddressestoinstancesusingtheconceptofportassignments.Aportisessentiallyavirtualswitchportthattheinstanceconnectsto.AportisassignedaMACaddressandafixedIPaddress.Whenaninstanceconnectstoaport,theinstance’snetworkinterfaceinheritstheMACaddressandIPassignmentaswell.
Bydefault,whenaninstanceislaunched,aportiscreatedwithaMACaddressandafixedIPaddressandthenassignedtothatinstance.Whentheinstanceisterminated,theportisdestroyed,whichfreesthefixedIPaddressupforfutureuse.IffloatingIPsarenotused,thereisnowaytopredictwhatIPaddressthe
instancewillget.NorisitpossibletoguaranteethatifaninstanceisrebuiltbybeingterminatedandthenrelaunchedthatitwillgetthesameIPaddressitoriginallyhad.
Neutronprovidesamechanismtoallowtheusertocreateaportaheadoftimeandassignthatporttoaninstanceasitisbeinglaunched.Whentheportiscreated,theuserhastheoptionofspecifyinganIPaddressorletOpenStackchosetheIPaddressinstead.Tocreateaport,usethe“neutronport-create”command.Whentheinstanceislaunched,theportIDofthenewlycreatedportcanbeassignedusingnovaboot––nicport-id=PORT_ID.Whentheinstancecomeup,itshouldhaveanetworkinterfaceconfiguredusingtheMACaddressandfixedIPaddressassociatedwiththeuser-createdport.
However,beawarethatiftheinstanceisterminated,OpenStackwillhappilydestroyboththeinstanceandanyassociatedport.IftheuserwantstopreservetheIPaddressassociatedwiththeinstance,theportmustbedetachedfromtheinstancefirstbeforetheinstanceisterminated.Thiscanbedonebyusingneutronport-updatePORT_ID––device_id''––device_owner''.Thisshouldworkonanyport,includingaportthatwascreatedatthetimetheinstancewaslaunched.Aftertheportisdetached,itcanbeusedagainwhenlaunchinganotherinstance.
InolderversionsofOpenStack,Neutronportreservationwasn’tveryreliable.Portscouldbedetachedfrominstances,buttheysometimesmaynotworkproperlywhenattachedtoanewlylaunchedinstance,especiallyiftheinstancetheportwasoriginallyattachedtoisstillrunning.Also,portscouldonlybeattachedtoinstanceswhentheywerelaunched.Itmaybepossibletoattachaporttoanexistinginstancebyusingneutronport-update.ConsulttheOpenStackdocumentationandtestvigorouslybeforeusingportreservationsforproductionwork.
PermanentIPAddressesUsersareaccustomedtohavingasingleknownIPaddressassociatedwiththeirapplication.AhostnameisusuallyassignedtothatIPaddress,buttheIPaddressrarelychanges.OncetheyhaveanIPaddress,firewallportsareopenedupspecificallyforthatIPaddressandthataddressmaypotentiallybeembeddedinapplicationcode.Ofcourse,ifthatIPaddresseverchanges,itcanbeanightmaretoupdatetheapplicationtosupportthatchange,asfirewallshavetobeupdatedandsourcecodescouredtofindallthehardcodedentries.
Whenusersaredevelopingapplicationsforthecloud,itishardforthemtoletgooftheconceptthatalltheirinstancesshouldhaveapermanentIPaddressassigned.Evenifanapplicationisbuiltwithmultipleinstancesandregionsinmind,usersmaystillhavetoopenfirewallportsforalltheIPaddressesassociatedwiththeirinstances.
IftheOpenStackenvironmentsupportsfloatingIPaddresses,thenhavingapermanentIPmaystillbepossible.Ifaninstanceneedstobedestroyedand
rebuilt,theusercanmovethefloatingIPaddressfromthedoomedinstancetoanewone.ThefirewallrulesassociatedwiththatIPaddresscontinuestowork.ThesamethingcanbeaccomplishedbycreatingandassigningNeutronportstonewinstances.However,itiscriticaltomakesurethatportisdetachedfromtheinstancebeforetheinstanceisterminated,otherwisetheportwillbedestroyedandtheIPaddressputbackintotheglobalIPpool.
AnotherthingusersshouldbecautiousofisifanIPaddressislostandfirewallrulesareassociatedwiththataddress,someotheruserandapplicationmaygetthatIPaddressandalltheassociatedfirewallruleswithit.Theotherapplicationwillhavenoideawhatportshavebeenopenedupinthefirewall.Thismaynotbeanissueifthesecuritygroupsareproperlysetupandrestrictinboundtraffic.However,itiscommonfordeveloperstosavenetworksecurityforlastornotaddressitatallandnotbeawareoftheadditionalexposuresthatIPaddressreusemaybringtotheirapplication.
SCALINGOnceabasicapplicationhasbeenbuiltforthecloud,itneedstoevolvesothatitcansurvivefailuresinthecloud,aswellastogrowsothatitcancontinuetomeetuserdemandandperformancerequirements.Scalinganapplicationverticallymayaddressperformanceissues,butitrarelyimprovesonitsabilitytodealwithcloudfailures.Scalingtheapplicationhorizontallycanaddressbothperformanceandresiliencytocloudfailures.
Whatdoesitmeantoscaleanapplicationhorizontally?Itmeansthattheapplicationisscaledbyaddingmoreinstancestoit.Thisisdifferentfromverticalscalingwheretheinstancesthemselvesaremadebigger.Horizontalscalingdoesn’tmeanmakingadditionalcopiesoftheapplicationandrunningthosecopiesinthecloud.Itmeanstakingasingleapplicationandspreadingitouttoruninmoreinstances.
Howcananapplicationbespreadacrossmultipleinstances?Thefirststepistounderstandallthedifferentpiecesthatmakeupanapplicationandthentakeeachpieceandruneachofthemintheirowninstance.Theneachpieceisexpandedtoruninmultipleinstances.Somepiecesmaybeeasiertoruninmultipleinstancesthanothers.Onceanapplicationcanscalesuccessfullyinasingleregion,thenstepscanbetakentoscaletheapplicationtootherregions.Anapplicationrunninginmultipleregionscanincreaseperformancebyhavinguserscommunicatewithinstancesphysicallyclosertothemandincreasesitsresiliencyindealingwithpotentialregion-wideoutages.
ApplicationAnatomyApplicationsaretypicallyverycomplex,oftencontainingmultipleprogramsworkinginconcerttoprovideasetofservicestotheend-user.Itisraretofindanapplicationthatisasingleprogramthatdoeseverything,suchasprovidingawebinterfaceandadatabaseserviceallinone.Understandingallofthedifferentpiecesofanapplicationisimportantwhentryingtobuildanddeployittothecloud.
Mostapplicationsprovidesomekindofuserinterface.Userinterfacescantakemanyforms,suchasaclientinterfacethatrunsontheuser’sdesktop,awebinterfaceaccessedfromabrowser,acommand-lineprogramtheuserrunsfromanoperatingsystemprompt,ormaybeanAPIthattheuserusesfromwithinascriptorprogram.
Userinterfacesprovideamechanismforaccessingandmanipulatingthedatatheapplicationmanages.Thisdataisoftenstoredinadatabase.Manyapplicationsuserelationaldatabasesthatprovidebetterorganizationandfasteraccesstothedata,suchaswithOracleandMySQL.Someapplicationsalsomakeuseofdocumentstoredatabases,suchaswithMongoDB.Documentstoredatabasesprovideameansofstoringunstructureddataandobjects.Applicationsmayalso
makeuseofmultipledatabasesanddatabasetypes,furtheraddingtothecomplexityoftheapplication.
Someapplicationsalsomakeuseofanapplicationlayercalledmiddleware.Middlewarecontainssoftwarethattypicallyisusedtoconnectapplicationcomponentstootherapplicationcomponents.Middlewareprovidesaconsistentmeansofconnectingdifferentpiecesoftheapplicationtoeachother,makingiteasiertoswitchcomponentsoutforothercomponentsinthefuture.
Applicationsmayhaveothercomponentstoo.Forexample,theremaybeanetworkorsecuritycomponentthatmonitorstrafficinsomeway.Theremaybealoggingcomponentthataggregatesthelogsofalltheothercomponentsintoasinglesearchablelocation.Theremaybeamonitoringcomponentthatchecksapplicationfunctionalityandperformance.
Eachcomponentneedstoaddresspotentialfailurescenariosasappropriate.Aweb-baseduserinterfacecandealwithfailurescenariosbysimplyscalingout.Sincemostweb-baseduserinterfacescanbestatelesswithrespecttodata,instancescanbelostwithlittleimpacttotheapplication,aslongasthereareenoughinstancestohandletheincomingload.Databasesoftendealwithfailurescenariosbyhavinganumberofinstancesparticipatinginacluster.Aslongasthemajorityoftheinstancesintheclusterremainavailable,thedatabaseislikelytoremainupandavailable.
Eachcomponentcanalsodealwithproblemsindependentlyofeachother.Forexample,ifaperformanceissueisfoundinthemiddlewarecomponent,thatcomponentcanbescaledoutmoretoaddresstheperformanceissue.Thereisn’taneedtoscaleoutthewebcomponentorthedatabasecomponent,sincetheproblemwasisolatedonlytothemiddlewarecomponent.Adjustingcomponentsindependentlywhenneededgivestheapplicationtremendousflexibilityindealingwithfailurescenariosandperformanceissues.
MultipleInstancesAnapplicationthatrunsinasingleinstanceorinjustafewinstancesismorelikelytobeaffectedbysimplefailurescenarios,suchashardwarefailureormaintenance.Asinglecomputenodefailurecouldrobtheapplicationofanimportantpieceoffunctionality,resultinginusersnotbeingabletoreachtheapplicationorimportantdatabeingavailabletothem.
Thebestwaytodealwithmostfailurescenariosistohavetheapplicationruninasmanyinstancesaspossible.Ifoneinstanceinagroupgoesdown,theotherinstancesinthatgroupcontinuetoprovidethesamefunctionalitysotheapplicationremainsoperational.
Mostapplicationscanbebrokendownintosmallerpiecesbasedonfunctionsthatcanbeisolatedfromotherfunctions.Forexample,aweb-baseduserinterfacecanoftenbeseparatedfromadatabaseback-endsinceusersdonotneeddirectaccess
tothedatabaseandthedatabasedoesn’tcareabouthowtheusersseeormakeuseofthatdata.Breakinganapplicationintosmallerfunctionalunitsisthefirststepinrunninganapplicationinmultipleinstances.Thewebinterfacecanruninoneinstanceandthedatabasecanruninanotherinstance.
Oncetheapplicationhasbeenbrokenintosmallerfunctionalunitsandeachfunctionalunitseparatedintomultipleinstances,theinstancescanthenbescaledoutsothateachfunctionalunitalsorunsinmultipleinstances.Forexample,theweb-baseduserinterfacecanruninseveralinstancesinsteadofjustasingleinstance.
Runningtheapplicationacrossmanyinstancesaddsaconsiderableamountofcomplexitytotheapplication.However,italsoprovidestwokeyimprovementstotheapplication.Thefirstkeyimprovementisthatitshouldmaketheapplicationmoreresilienttofailuresoccurringinthecloud.Acomputenodefailureisnotlikelytotakeoutalltheinstancesofthatfunctionalunit.Theotherkeyimprovementisthatitiseasiertoscaletheapplicationhorizontally.Forexample,ifuserdemandincreasestothepointaparticularfunctionalunitisbecomingperformance-boundorrunningintoresourcealimit,thenumberofinstancesforthatfunctionalunitcouldbeincreasedtohandletheuserdemand.Thisnotonlyspreadsperformanceacrossmoreinstances,butifaninstancecanonlyhandleacertainnumberofusers,multipleinstancescanincreasethetotalnumberofusersthatcanbehandled.
Statelessapplicationsaremucheasiertoruninamultipleinstancesetup.Datakeptinaninstanceisnotimportantenoughtoprotectagainstlossifthereisafailureinthecloud.Furthermore,oneinstancedoesn’tdependondatainanotherinstance.Ifaninstancegoesaway,ausercanberoutedthroughanotherinstanceseamlesslywithouthavingtoknowwhatthatuserwasdoingintheotherinstancebeforethat.
Statefulapplicationsaremoredifficulttoruninamultipleinstancesetup.Dataneedstobekeptaboutwhatishappeningandwhathasalreadyoccurredsothatwhathappensnextcanbedetermined.Forexample,youcanhaveamulti-requesttransactionthatisoccurringintheapplication.Ifalloftherequestsgothroughasingleinstance,theinstancehasallofthedataaboutthetransactionandcanhandlethetransactionend-to-endwithoutdifficulty.However,ifonerequestgoesthroughoneinstanceandanotherrequestgoesthroughotherinstances,howdoesoneinstanceknowabouttherequeststhatwentthroughtheotherinstances?Astatefulapplicationneedstotrackalltherequestsofatransaction,nomatterhowmanyinstancestherequestswentthrough.
MultipleLocationsJustasanapplicationneedstoruninmultipleinstancesinordertoscaleandbemoreresilienttofailuresinthecloud,theapplicationalsoneedstobedeployedinmultiplelocations.Asdiscussedpreviously,thereareallkindsoffailuresthatcan
occurinthecloud,orevenoutsidethecloud,thatcanaffectacloudapplication.Forexample,anoutageinthedatacentercantakeoutanentirelocationorregion.Eveniftheapplicationrunsinmanyinstances,ifallofthoseinstancesraninthesamelocation,theapplicationisstillunavailable.
ItisimportanttounderstandtheOpenStackenvironmentthattheapplicationisgoingtobedeployedto.Iftherearemultipleregionsavailable,findoutwheretheregionsarephysicallylocated.Theapplicationshouldbedeployedtogeographicallydiverselocations,suchasontheeastcoastandonthewestcoast.Ifapowerornetworkoutagetakesoutallofthedatacentersinaparticularregion,otherregionscanpickuptheloadandallowtheapplicationtocontinueoperating.
Itisalsoimportanttounderstandhowregionsmaydifferfromeachotherwithrespecttospeed,redundancyandreliability,andlocationwithrespecttotheusersthatmayneedtousetheapplication.AnOpenStackregioncanbeinstalledinareallynicedatacenterthatoffershighspeednetwork,lotsofbandwidth,powerandnetworkredundancy.Itcanalsobeinstalledinalowertierfacilitywheretheremaynotbeasmuchbandwidthorredundancy,whichmeansthatfailurescouldhappenmoreoftenandhaveagreatereffectonapplicationsdeployedthere.However,thoseregionsmaybeclosertotheend-userorprovidelowerlatencyconnectionsandultimatelyprovidemoreplussesthanminusesforbeinginthoseregions.Knowinghowregionsdiffermayresultinanapplicationbeingdeployedwithfewerinstancesinoneregionversusanother,ormaybecertainfunctionsofanapplicationmaybedeployedtoahigherriskregion.
Managinganapplicationthatrunsinmultipleregionsisevenmorecomplexthanjustmanaginganapplicationthatrunsinmultipleinstances.Someofthechallengescanbereducedifalltherequestsofatransactionorallthetransactionsforausercanbekepttothesameregion.Dataaccessandintegritycanalsobechallenging.Ifadatabaseisgoingtoruninmultipleregions,dataneedstobereplicatedandsynced.Iftheapplicationrequiresreal-timedataaccess,ensuringthedataiscurrentinalllocationsatalltimescanbedifficult,especiallyiftheregionsareseparatedgeographicallybyalargedistance.
LoadBalancingLoadbalancingprovidesameanstodirecttrafficflowtothoseinstancesthatshouldreceiveit.Inthemostbasicform,incomingtrafficcanbesplitequallytoalloftheinstances,whichspreadsloadevenlyandallowsforbetterscaling.Inmoreadvancedforms,instancescanbemonitoredsothattrafficissplitbasedonavailability,performanceandlevelofactivity.Inparticular,ifaninstancegoesdown,itcanbeexcludedfromreceivingadditionaltrafficuntilthatinstanceisrestoredbacktoservice.
Loadbalancerstypicallyprovideaneasymeanstoconfigurehowtrafficshouldflowinsideanapplication.Apooliscreatedtomonitoraparticularserviceandserverscanbeaddedandremovedfromthepoolonthefly.Loadbalancers
monitortheservicesofeachserveranddeterminewhattrafficshouldgotoit,ifany.ApooloftenhasanIPaddressandportassignedtoit.Aslongasatleastoneserverinthepoolisabletoreceivetraffic,thepool’sIPaddressandportisactive.
Loadbalancersmonitortheservicesinapoolbyconnectingtotheservice.Monitoringcanbeassimpleasjustconnectingsuccessfullytotheservice,oritcanbeascomplexasconnectingtotheserviceandexpectingaspecificbannerorstringtobereturned.Someloadbalancersprovideameansofattachingcustomscriptstothecheckssothatcomplexcheckscanbeperformed,suchasauthenticatingtotheserviceandperformingsomekindofaction.Loadbalancerscanalsomonitorperformanceinaway,bylookingathowlongitschecksaretakingandbasingdecisionsonthat.Successfulchecksmarktheserviceasavailableandunsuccessfulchecksmarktheserviceasunavailable.
Oncetheloadbalancerhascollectedallofthedatafromthechecksperformedontheservice,itneedstodecidehowtodistributetheincomingtraffic.Apoolsetuptousearoundrobinalgorithmwillsendtraffictoeachservice,oneaftertheotherinsequentialrotatingfashion.Apoolsetuptousealeastconnectionsalgorithmwillsendtraffictotheservicethathasthefewestactiveconnections.Apoolcouldalsobesetuptosendtraffictotheservicewiththeleastnetworklatency.Morecomplexalgorithmscanalsobesupported,combiningsimplealgorithms,orsettingupapriorityofservicesthatshouldgettrafficbeforeotherservicesgettraffic.
Therearemanytypesofloadbalancersavailable.Hardwareloadbalancersusuallyprovidethemostcapabilities,reliabilityandabilitytohandlelargeamountsoftraffic.However,theyarealsomoreexpensivethananyothertypeofloadbalancer.Also,hardwareloadbalancersmanagedbyanotherteammayaddadditionalcomplexitytoitsuse.Nonetheless,ifhardwareloadbalancersareavailable,itisrecommendedtotakeadvantageofthem.
Softwareloadbalancersarecheaperandcanbemoreflexiblethanhardwareloadbalancers.Youcanbuildandincorporatesoftwareloadbalancersintotheapplication,tightlycouplinghowloadbalancingisdonewiththeneedsoftheapplication.Therearemanytypesofsoftwareloadbalancers.OneofthemorepopularchoicesisHAProxy.ThereareanumberofloadbalancersavailableusingApacheandJavaaswell.
OpenStackalsoprovidesaLoad-Balancing-as-a-Service(LBaaS),whichisimplementedusingNeutron.Itsupportsmanyofthesamefeaturesthatregularloadbalancerssupport,suchasservicemonitoring,managementoftheservicesinthepool,managingconnectionlimits,andprovidingsessionpersistence.CheckwiththeOpenStackcloudadministratorstoseeifLBaaSisavailableandhowitcanbeused.
Oneofthethingsthatneedtobeconsideredwhensettinguploadbalancingforanapplicationiswhatkindoftrafficwillbegoingthroughit.Notallnetworkprotocolsmaybesupportedbyloadbalancers.Ifsessiontrackingisused,either
theapplicationneedstosharesessioninformationacrossalloftheneededservers,ortheloadbalancerneedstobeconfiguredtosendasinglesession’straffictothesameback-endserveruntilthatsessionisterminated.
Anotherthingtobeconsideredisthatloadbalancingwillincreaseloggingquiteabitontheserversinthepool.Generally,loadbalancersliketocheckserviceseveryfewsecondstomakesuretheyareup.Inanenterpriseenvironment,theremaybetwoormoreloadbalancersconfiguredidentically,allofthemcheckingeveryfewsecondsonthosesameservices.Unlesstheapplicationisconfiguredtonotlogthoseconnections,logscangrowquiteabit.
Ultimately,loadbalancingprovidesavaluablewaytoimproveanapplication.Itprovidesameanstomonitortheservicesandremoveserversfromapoolthatarenolongerworking.Italsoprovidesameanstoaddandremoveserversonthefly,whichisanimportantpartofapplicationscalability.
PerformanceWhenanapplicationisarchitectedsothatitsvariouspiecescanscaletomultipleinstancesandthosedifferenttypesofinstancescanscaleindependentlyofeachother,thecomplexityoftheapplicationincreasesdramatically.Whenproblemsoccurwithintheapplication,itbecomesmoredifficulttoidentifywheretheproblemisactuallyoccurring.Sometimes,problemsmanifestasbrokenfunctionalitywithintheapplication.However,moreoftenthannot,problemsmanifestasperformanceissues.
Whatkindofperformanceissuescouldanapplicationexperience?Performanceissuescantakemanyforms.Forexample,abackupsystemhastobackupallthedataofanapplicationeverynightandhastobecompletedbeforethenextbusinessday.However,overtime,backupsaretakinglongerandeventuallyrisknotfinishingintime.Anotherexamplemaybeanapplicationthatacceptsfileuploadsandithastoviruschecktheapplicationbeforeconfirmingtotheuseritwassuccessful.Itmaybethatviruscheckingistakinglongerandlongeranduploadsarefailingbecausetheyaretimingoutortheuserdoesn’twaitaroundlongenoughforittocomplete.
Applicationperformanceisoftencharacterizedastheamountoftimetoperformspecificactions.Forexample,awebuserclickingonalinkwithinawebpagewillexpecttheclicktoimmediatelyrespondwithanewpageandexpecttoseethenewpagecompletelyloadedwithinashortperiodoftime.Perceivedslownesscansometimesbeattributedtotheaccumulationofallthedifferentthingsthathastohappenbehindthescenes.Ifasingle-userclickresultsintwentydifferentactionsoccurring,eachactionmaybequick,butthetotaltimetoprocessalltwentyactionsmaybetoolong.
Itisincrediblyimportanttomonitoreveryaspectofanapplication.Datacanbecollectedonhowlongdatabasetransactionstake.Datacanbecollectedonhowlongdataistransferredoverthenetworkorwrittentodisk.Datacanbecollected
onthenumberofsuccessfulorfailedevents.Datacanbecollectedonnumberofconnectionsandlogins.Allofthisdatashouldbecollectedovertimesothatitcanbeanalyzedforpotentialissuesandunderstoodincontextwithotherevents,suchasholidays,specialeventsorabnormallyhighusage.
Whenperformanceissuesarediscovered,anumberofthingscanbedone.Someperformanceissuesmayberelatedtohigheractivityandcanbesolvedbysimplyaddingmoreinstancestothepooltohandleit.Otherperformanceissuesmayberelatedtoachangeintheusagepattern.Forexample,usersmaybesearchingonsomethinginadifferentway,andtheSQLquerycreatedtodothatsearchissomehowsearchinginefficientlyinthedatabase.Finetuningthesearchcapabilityorcreatinganewindexinthedatabaseorfinetuningdatabasesettingsmaybethemoreappropriatewaytofixtheperformanceissuethansimplyaddingmoreinstancestothedatabaseservice.
Operatingsystemperformanceshouldalsobeheavilymonitored.ForLinuxservers,itisagoodideatorunSARandcollectdataonCPU,memoryanddiskperformance.AgoodmetrictomonitoristheCPUstealtime,whichcanbeseenintheSARdataas%steal.Ifthisvalueisconsistentlynon-zero,itusuallymeansCPUcyclesarebeingstolenfromthatinstanceandgiventoanother.Lookingatthatmetricincombinationwiththe%idlemetricandlookingatthesevaluesacrossalltheinstancescollectivelycanprovidecluesastowhetherthehypervisorisoverloadedorthatmaybetheinstanceisundersized.
OpenStackprovidessomemetricsdataforapplicationdeveloperstotakeadvantageof.CeilometercollectsinformationaboutCPUandRAMusage,diskactivity,networkbandwidthandotherdata.ItispossiblethatMonascaisbeingusedaswell,whichprovidesmanyofthesamemetricsasCeilometer.BesuretotalkwiththeOpenStackcloudadministratorstoseeifmetricsarebeingcollectedinthecloudandhowtheycanbeusedbytheapplication.
DataStorageInOpenStackthereareanumberofdifferentwaysthatdatacanbestored.Bydefault,whenaninstanceislaunched,itusesephemeralstorage.Ephemeralstorageisusuallystorageassociatedwiththecomputenodeswheretheinstanceruns.Iftheinstanceisterminated,alltheephemeralstorageassociatedwiththatinstanceisalsodeleted.EphemeralstorageistheleastprotecteddatawithinOpenStack.Thestorageislikelynotbackeduporreplicated.Alostdiskorcomputenodecouldleadtodataloss.
BlockstorageisprovidedbyCinderinOpenStackandpresentsthatstorageasvolumesthatcanbeattachedtotheinstances.Volumesshowupasblockdevicesinsidetheinstancesandcanbemountedasdisksorfilesystems.Volumescanbeattached,unattachedandmovedtodifferentinstances.Whenaninstanceisterminated,thevolumesaredetachedfromtheinstanceandisnotdeleted.Thevolumecanthenbeattachedtoanewinstanceifneedbe.Blockstorageis
implementedinCinderthroughtheuseofdrivers,manyofwhicharevendorspecific.Veryoften,blockstorageissetuptobeperformantandtoreplicatedatatopreventissuesresultingindataloss.
ObjectstorageisprovidedbyOpenStackthroughtheSwiftAPI.Dataisstoredinacompletelydifferentwaythanwithblockstorage.Theapplicationcreatescontainersandthenuploadsfilesintothosecontainers.Accesstothefilesrequiresthemtobedownloadedfromthecontainerandintotheinstance.Containersandtheirassociatedfileshavenoconceptofinstances.Ifaninstancethatusesacontaineristerminated,nothinghappenstothecontainersoritsfiles,remainingaccessiblebyotherinstancesinthecloud.Infact,oneoftheadvantagesSwifthasoverCinderisthatcontainerscanbeaccessedbymanyinstances,butablockstoragevolumecanonlybeattachedandaccessedbyonlyoneinstanceatatime.Objectstorageisalsooftensetuptobeperformantandtoreplicatedatatoprotectagainstdataloss.
Whenbuildinganapplicationthatneedstostoredatapermanently,selectingtheappropriatedatastorageback-endisextremelyimportant.Howimportantisthedata?Isitokayforthedatatobelostifaninstancedies?Canthedatabereplacedorrebuiltifanewinstanceiscreated?Howlongisthedataneeded?Doesthedataneedtobealwaysimmediatelyavailable?Howmuchdataneedstobestored?Thesequestionscanplayabigroleindecidingwhatisusedtostoredataandhowitisstored.Besuretotalktothestorageadministratorstobetterunderstandtheavailableoptions.Inparticular,discusswiththemabouttheirdatareplicationsettings,howmuchstoragetheyhaveandwhatyourapplication’slongtermneedsaresotheycanplanaccordingly.
Ifdataisstoredinanenvironmentthatreplicatesdata,theapplicationshouldtakecarenottodoitsowndatareplication.Ifthestorageclusterreplicatesdatathreetimesandtheapplicationisalsoreplicatingdatathreetimes,thisreallymeansthatthedataisbeingstoredatotalofninetimesinthecluster!Thiscanaffectapplicationperformanceduetounnecessaryreplication,aswellasconsumewaymorediskspacethanisreallyneeded.
Applicationscantakeadvantageofmultiplestorageoptionsatthesametime.Sinceephemeralstorageisoftenfasterthanusingblockorobjectstorage,aninstancecankeepitsmoreoftenuseddataonephemeralstorageandthelessuseddataonblockstorage.Datathatisrarelyusedcouldbeputintoobjectstorageforlongtermstorage.Besuretoconsideralloptionswhenbuildinganapplicationthatrequiresstoringdata.
HighAvailabilityTobuildanapplicationforhighavailabilityinmindmeansthattheapplicationhastobeavailableasmuchaspossibleandthatitneedstorunproperlyandperformantatalltimes.Ahighlyavailableapplicationoftenrunseverywhereandisabletoadapttothechangesintheenvironmentwhereitruns.Buildingan
applicationishardenough,butbuildingahighlyavailableapplicationisevenharder.
Whataresomeofthetechniquesinvolvedinrunningahighlyavailableapplication?Oneofthemostimportanttechniquesistoensuretheapplicationandallofitspiecescanruninmanyinstances,andthatthoseinstancescanalsoruninmultipleenvironments.Themoreplacestheapplicationrunsin,themoreresilienttohardwareorevendatacenterfailures.Multipleinstancesalsoallowstheapplicationtoscaleappropriatelyasneeded.
Anothertechniqueistoputservicesbehindloadbalancerssothattrafficcanbeappropriatelydistributed.Furthermore,ifanyinstancesbecomeunavailable,theloadbalancerswillautomaticallyremovethoseservicesfromthepoolandredistributetraffictotheremainingservices.UsingGSLBcanalsofurtherincreasehighavailabilitybyredirectingtraffictodifferentdatacentersbasedonwereconnectionsarecomingfrom.Ifadatacentergoesoffline,GLSBscanautomaticallyredirectalltraffictoanotherdatacenteruntiltheissueisresolved.
Itisalsowisetounderstandapplicationusageandhowthattiesinwiththebiggerpicture.Externaleventscancausesignificantincreasesintrafficusage.Holidayscanresultinincreasesforholidayshopping,especiallyondayslikeBlackFridayandCyberMonday.Sportingevents,liketheSuperBowl,canincreasewebsiteactivityforviewingon-demanddata.Universitiescanseeincreasedactivityassociatedwiththebeginningoftheschoolyearorchangesinquartersandsemesters.Majornewseventscoulddriveupstockactivity.Alloftheseneedtobeconsideredwhenbuildinganapplicationforhighavailability.Ideally,ifaneventcanbeanticipatedaheadoftime,theapplicationcanbescaledupwardsaccordinglyaheadofthateventtodealwithexpecteddemandandthenscaledbackdownafterthateventhaspassed.
Howcantheapplicationscaletomeetdemand?Onewayisforsomebodytoactivelymonitortheservicesandmanuallyaddinstancesasneededuntiltheapplicationcanhandlethatneed.Thiscanbeanexpensivewaytoaddresstheproblemandintroducesahumanelementandrisktotheoverallprocess.Anotherandbetterwayistomonitortheapplicationsforproblemsandperformanceandauto-scaletheapplicationinapragmaticway.OpenStackprovidesmanyAPIsformanaginginstancesandservicesinthecloud.TheapplicationcandetectwhenitneedstogrowaparticularserviceandusetheAPItodothat.Whendemandsubsides,theapplicationcanreducethenumberofinstancesrunninginanautomaticway.
Anotherimportantthingtoconsiderisbuildinginextracapacityintheapplicationaheadoftime.Insteadofexpectingeachinstancetobe100percentbusyandonlydeploythenumberofinstancesneededtohandlealloftheload,buildeachinstancetobe60percentbusyandrunmoreinstances.Oneadvantagetothisstrategyisthatbriefspikesincapacitycanoccurthatmightnottriggerauto-scaling.Withextraheadroombuiltintotheinstancesthemselves,spikescan
behandledwithoutcausinganyissueswithperformanceintheapplication.Thekeyistoover-provisionandunder-utilize.
Highavailabilitydoespresentotherchallengesthough.Takingalookatacasewhereaparticularservicerunsinmultipleinstanceswithoneinstanceactingasamasterandtheotherinstancesactinginapassiverole.Veryoften,theinstancesaretalkingtoeachotherallthetime,ensuringthemasterisaliveandwell.Whathappensifsomethingbreaksthecommunicationbetweenthemasterandpassiveinstances?Themastermaynotbeawareofthisissueandcontinuestooperatenormally.Thepassiveinstanceseesthemastergoawayandimmediatelyputsitselfintomastermode.Whatiftheotherpassiveinstancedoesthesameexactthing?Therecouldbethreemasterserversallatthesametime.Thisiscommonlyknownassplit-brainsyndromeandcanbeahardproblemtoavoidincertainfailurescenarios.Thisproblemcanbeevenmorepronouncedbetweenregionswhennetworkcommunicationisdisrupted.
Now,we’regoingtoseehowwecanimplementwhatwe’vediscussedinthischaptertoimproveoursampleapplication.
IMPROVINGOURAPPLICATIONStartingwiththesimpleapplicationconceptintroducedinthepreviouschapter,wewanttobuildonthatandshowhowitcanbeimprovedupon.Conceptually,theprocessisn’tthatdifficult.However,notallofitiseasyeither.Forexample,anapplicationthatrequirespersistentsessionsneedstoworkinamulti-instanceenvironment.Inanycase,iftheapplicationcanbebrokenintoitsbasiccomponents,eachcomponentcanbeimproveduponindependentlyandinawaythatmakesthemostsenseforthatcomponent.
SimpleApplicationLet’staketheapplicationthatwasstartedinthepreviouschapter.Theapplicationhasthreecomponentstoit:aweb-basedfront-endthatuserswillaccess,anAPIlayerthatthefront-endtalksto,andadatabaseback-end.TheapplicationmaylooksomethinglikeFigure5.1.
Figure5.1
Initially,theapplicationmayhavebeenkeptsimpleinordertoprovideaproofofconceptsotheapplicationisviableinthecloudandtoseekapprovalforcontinuingitsdevelopment.Eachcomponentmayexistasasingleinstance.Fortheaboveexample,theapplicationwouldexistinthreeinstances,oneforeachofthedifferentcomponents.
ComplexApplicationTheaboveexamplecouldbeconsideredoverlysimplistic.MorecomplexapplicationsmayuseanAPIlayertoabstractaccesstomultipletypesofback-ends.TheAPIprovidesaconsistentmeanstoaccessdifferenttypesofdata,makingiteasiertoextendfunctionalityoreventoallowback-endstobeswappedoutwithouthavingtorecodeanyofthefront-ends.TheAPIcouldalsotakeinputfrommorethanjustawebfront-end.UserscouldaccesstheAPIusingcommandlinetoolsoraclientprogram.ThisapplicationmaylooklikeFigure5.2.
Figure5.2
Whenlookingatthecomponentstobuildthisapplication,itturnsoutthatitreallyisn’tthatcomplex.TheAPIlayerisstilljustasingleinstance.Thewebfront-endandthedatabasearealsoeachtheirowninstance.Theclientprogramandcommandlinetoolsdon’tneedtheirowninstances.TheyarejustabstractmethodsfortheusertoaccesstheAPIdirectly.TheAPIcanalsoaccessfilestoragedirectlyandcommunicatetootherapplicationsintheenvironment.Theendresultisthatthisapplicationisstillonlythreeinstances,evenwithmore“stuff”goingonwithit.
ImprovingtheWebUIComponentInordertoimproveonthewebfront-end,theapplicationneedstobescaledouttomultipleinstances.Thenumberofusersexpectedtousetheapplicationcanbeusedasaguidelinetodeterminethenumberofinstancesthatlikelywillbeneededtorunthewebfront-end.Also,usersneedaconsistentmeansofaccessingthewebservicewithouthavingtoworryaboutwhichinstancetheyareconnectingto.Thisisaccomplishedbyputtingthewebinstancesbehindaloadbalancer(seeFigure5.3).
Figure5.3
Onechallengethatmayneedtobeaddressedwhenputtingawebservicebehindaloadbalanceriswhenthewebservicedoessessionmanagementinordertotrackuseractivityduringthelifetimeofthesession.AsessionstartswiththeuserloggingintothewebserviceandgetsassignedaSessionID.Theuser’sSessionIDmaybetrackedbyembeddingitintheURLsorahiddenform,ormaybeeventhroughtheuseofwebbrowsercookies.Thewebservicemaintainsinformationaboutthesessionwhiletheuserisloggedin.Thesessionendswhentheuserlogsoutorthereisnoactivityfromtheuseraftersometime.
Thedifficultywithsessionmanagementisofteninitsimplementation.Whathappensifauserlogsinusingoneinstance,butthenextclickonawebpagesendstheusertoadifferentinstance.Howissessioninformationsharedbetweeninstances?Ifsessioninformationisstoredlocallywithinaninstance,otherinstancesmaynotevenhavethatuser’sinformation.
Mostloadbalancershaveawayofdealingwiththisissue,implementingafeaturecalledsessionaffinity,persistentsessions,orstickysessions.OnemethodusedinthefeatureassignsthesourceIPoftheusertoaspecificinstanceandalltrafficcomingfromthatsourceIPwillalwaysgotothatinstance.Anothermethodusesatrackingcookietheloadbalancercreatesandassignsalltrafficcontainingthatcookietoaspecificinstance.Onedrawbackbyusingsessionpersistenceinaloadbalanceristhatpinningtraffictospecificinstancessignificantlyreducestheloadbalancer’sabilitytobalancetrafficinmeaningfulways.Overtime,someinstancesmaybesignificantlybusierthanotherinstancessimplybecauseofhowusersareusingtheapplication.Ifaninstancebecomesoverloaded,addingmoreinstancestotheWebUIlayermaynothelpbecausethoseusersarepermanentlypinnedtotheoverloadedinstance.
Thebestwaytodealwithsessionmanagementusingmultipleinstancesistoabstractsessionmanagementtoashareddatabasethatallinstancescanaccess.Ifsessioninformationisnotkeptlocallywithinaninstance,itnolongermatterswhichinstancetheuserhitsoreveniftheusershitsmultipleinstancesinthesamesession.Thisalsoavoidstheproblemthatloadbalancershavewithpersistentsessions,sinceusertrafficisnotpinnedtospecificinstances.Thedrawback,however,isthatthedatabaseusedtostoresessioninformationneedstoalsobeimplementedinahighlyavailablemanner.Thispreventsasingledatabaseinstancefrombreakingthewebinterfacecompletely.
ImprovingtheAPIComponentInordertoimproveontheAPIlayer,italsoneedstobescaledouttomultipleinstances.ThenumberofinstancescanbechosenbasedonhowperformanttheAPIinstanceisindealingwithincomingconnections,communicatingwithitsvariousback-ends,andpassingthatdatabacktotherequestingsources.SincetheAPIlayerisoftenimplementedusingsimilartechnologiesemployedbythewebfront-end,themethodforrunningtheAPIusingmultipleinstancesissimilartothatusedbythewebfront-end.ThisisaccomplishedbyputtingtheAPIlayerbehindaloadbalancer(seeFigure5.4).
Figure5.4
OneadvantagethattheAPIlayeroftenhasoverthewebfront-endisthatitdoesn’thavetokeeptrackofusersessions.Thismakesiteasiertorunmultipleinstancesbehindtheloadbalancer,sinceitdoesn’tmatterwhichAPIinstanceisbeinghitatanyparticulartime.
However,APIsmayimplementtheirownformofsessionmanagementthroughtheuseofanauthenticationtoken.TheuserreceivestheauthenticationtokenwhentheyauthenticatesuccessfullywiththeAPI.Theusercanthenusethattokenineachfollow-upcalltotheAPIwithouthavingtoauthenticateeachrequest.Afteraperiodoftime,thetokenmayexpireandforcetheusertore-authenticate,whicheitherrenewsthetokenorgivestheuseranewtoken.
TheAPIlayeroftenmanagesauthenticationtokensusingaback-enddatabase.Thismeansthatifadatabaseisbeingused,thedatabaseneedstobehighlyavailableinordertopreventasingledatabaseinstancefromdisruptingAPIfunctionality.IftheAPIisonlymakinguseofthedatabasefortokenmanagement,theAPIcouldcontinuetofunctionwithouttokens,forcinguserstoauthenticateeachAPIrequest.
ImprovingtheDatabaseComponentForthedatabaselayer,scalingthedatabaseouttomoreinstancesisnotassimplesasjustrunningmultiplecopiesofthedatabaseinstance.ForthewebandAPIlayers,theinstancesreallydonotneedtoknowanythingabouttheotherinstancesinthatlayer.Therecouldbeasingle,severalormanywebandAPIinstancesandtheapplicationwouldrunthesameway.
So,howcanthedatabaselayerbeimproved?Thedatabaselayerisscaledout,butitisscaledonamuchsmallerlevel.WherethewebandAPIlayersmayhavehundredsofinstances,thedatabaselayermayonlyhaveafewinstances.Thedatabaseinstancesoftenreplicatedatasothateachinstanceisidenticaltotheother.Itishowthedataisreplicatedthatmakesthedatabaselayermorecomplex.Thereareacoupledifferentwaysthatthedatabaselayercanbeputtogethertoprovideredundancyandincreasedperformance.
OneofthemorepopularmethodsforscalingthedatabaselayeristorunaGaleraClusterforMySQL.AGaleraClusterallowsmultipleMySQLinstancestocommunicatetoeachotherandreplicatedata.Itrunsinmultimastermode,whichmeansthatread/writecommunicationcanoccurwithanyinstanceinthecluster.Whenatransactioniscommitted,thedataisreplicatedtoallinstancesandreturnssuccessfullyonlywhenthatdatawaswrittentoallofthedatabasessuccessfully(seeFigure5.5).
Figure5.5
AnothermethodforscalingthedatabaselayeristorunaMySQLCluster.Generally,MySQLClustersaresetupintwodifferentsetsofnodes,theSQLnodesandthedatanodes.TheAPIlayertalkstotheSQLnodes,whichdetermineswherethedataisstoredandthenmakesthenecessaryqueriestotheappropriatedatanodes.Thedatacanbesplitintosmallerchunks,calledpartitions,andstoredonasubsetofthedatanodes.Replicationoccurswithinpairsofdatanodeswithinthecluster.Themoredatanodesthereare,themorepartitionsthereare,spreadingthedataacrosstheentirecluster(seeFigure5.6).
Figure5.6
OneadvantageofrunningaMySQLClusteristhatitcanscaletomoreinstances.Themoreinstancesthatareadded,themorethedatacanbespreadacrossthatcluster.However,MySQLClusterismoresensitivetolatenciesandrequiresmoreCPUandnetworkresourcestorunefficiently.Theapplicationmayalsoneedtobereworkedtotakeadvantageofthepartitioningofdata,otherwise,asinglequerycouldhiteverydatanodeandresultinapotentiallyworseperformance.
ForGaleraMySQLCluster,itrequiresverylittlechangefromtheapplicationpointofview.Thereisnodatapartitioning,soeveryinstancehasacompletecopyofthedata.Thiscanalsobeadrawback,however,sincethemoreinstancesthereareinthecluster,themoredatathathastobereplicatedtoeveryotherinstance.ThisisgenerallywhyGaleraClustersaresmall,usuallyatleastthreeinstances,butnotmuchlarger.AnotherconsiderationwhenrunningaGaleraClusteristhattherealwayshastobeatleast50percentoftheinstancesrunningintheclusteratanypointintime.Iftheclusterdropsbelow50percent,theentireclusterstopsandthedatabasegoesoffline.Itcansometimesbedifficulttobringtheclusterbackonlinewithoutmakingchangestotheclusterconfigurationfiles.Thisiswhyaclusterneedstohaveatleastthreeinstancesinit.Ifoneinstanceislost,thereis
stillmajorityintheclustertokeepitoperational.
Yetanothermethodcombinestheconceptofaclusterabovewithmultipleread-onlydatabasesontheback-end.Thisistypicallycalledawrite-master/read-slavesetup.Iftheapplicationneedstowritedata,thewritesalwaysgotothewrite-masterdatabase.Iftheapplicationneedstoreaddata,thenthereadsarefarmedouttoanynumberofavailableread-slaves.Thewrite-mastercouldbesetupasaGaleraClusterorMySQLCluster,whichtheread-slavescouldbesetupasstandaloneMySQLserversinanon-clusteredsetup.Itisnotuncommontoseetheread-slavesusecachingsoftware,suchaswithMemcached,tofurtherspeedupreads.Aloadbalancercouldbeusedtoevenlydistributereadsacrossalltheread-slaves.Whenaread-slaveisinitiallylaunched,itcanpulldownwhateverdatafromthewrite-masteritneedstohaveandonceallthedataisloadedandverified,itcanadditselftotheread-slavecollectiveandtakeontraffic.Thismodelismorecomplicated,butitdoesprovidemoreflexibilityinregardstoscaling(seeFigure5.7).
Figure5.7
TheaboveexamplesuseMySQLastheexampledatabase.OtherdatabasescanalsobeputintotheOpenStackcloudaswell,andwithsimilartypesof
configurations.Forexample,MongoDBandPostgreSQLsupportnativeclusteringandreplication.Somedatabasesevenhavenativesupportforthemaster-write/read-slavemodel.Ingeneral,youshouldresearchwhattypesofcapabilitiesthechosendatabasesolutionhasandtakeadvantageofwhateverhighavailabilityoptionsitprovides.
Finally,itwouldberemisstopointoutanotherpotentialdatabaselayerimprovement,whichistotakeadvantageofDatabase-as-a-Service(DBaaS).InOpenStack,thisisTrove,whichwasdiscussedpreviouslyinChapter2.IfthereisaDBaaSsolutionavailablefortheOpenStackcloud,takealookatwhatfeaturesitprovidesandhowitcanbeleveragedintheapplication.Offloadingthedatabasepiecetoanotherservicesimplifiestheapplicationtremendouslyandprovidestheadditionalhighavailabilityanddataprotectionneededwithouthavingtoreinventthewheel.
PuttingItAllTogetherNowthateachofthelayershasbeenexamined,itistimetoputthemalltogether.Userscomeintotheapplicationviaasinglelocation,theloadbalancer,whichisthenroutedtooneofseveralWebUIinstances.TheWebUIlayertalkstotheAPIinstancesthroughaloadbalanceraswell,eachAPIrequestdistributedamongstalltheAPIinstances.TheAPIlayertalkstothedatabasethroughaloadbalancertoaback-endcluster(seeFigure5.8).Theclusterissetupasmultimaster,allowinganydatabaseinstancetobehitbytheAPIinstances.
Figure5.8
Multi-RegionInstancesManyoftheimprovementslistedabovearetypicallyappliedataregionlevel,wherealltheinstancesareinthesameregion.Itispossiblethatpartsoftheapplicationexistinmultipleregions.Forexample,theWebUIandAPIlayersmayexistinoneregion,butthedatabaselayerisinanotherregion.However,ideally,allofthelayersneedtoruninmultipleregions.
Themaintricktorunninganylayerinmultipleregionsisloadbalancing.Eachlayerineachregionstillhasitsownloadbalancer,butthenthereisagloballoadbalancerthatroutestraffictoeachoftheregionalloadbalancers.IfaGSLBisabletobeused,itisaperfectusecaseforspreadinganapplicationacrossmultipleregions,sincetrafficcanberedirectedtothenearestgeographicallylocatedregiontotheuser.Figure5.9showsanexampleofhowtheWebUIorAPIlayercanbeorganizedtoworkinamulti-regionOpenStackcloud.
Figure5.9
Forthedatabaselayer,itsimilarlyusestheGSLBtoredirecttraffictothenearestgeographicallylocateddatabase.Insteadofabstractingeachoftheregionstotheirownsetofloadbalancersanddatabaseclusters,however,itcanbesimplifiedbytreatingtheGSLBasthemainloadbalancerandalltheregionaldatabasesasdatabaseinstanceswithinthesamecluster.Anothersimplificationthatcomesfromthissetupisthatonlytwodatabaseinstancesareneededforeachregion,sinceevenifasingleinstancegoesdown,thereareplentyofinstancesacrossalltheregionstoensuremorethan50percentoftheclusterisup.Figure5.10showsanexampleofamulti-regiondatabasesetup.
Figure5.10
SUMMARYWehavenowpulledtogetherourexampleappcreatedfortheOpenStackcloud.Itisagoodidea,however,toassumethatthecloudisahostileenvironment,presentingrisktotheapplication’suptimeandtheintegrityofitsdata.Knowingwhatkindsofthingscanhappentotheapplicationandwhatkindsoffailuresthatcanoccurinthecloudopensthedoortoimprovingtheapplicationtobeabletosurvivewhenthingsdohappen.
Oneofthebasicimprovementsthatapplicationsundergointhecloudistoenabletheapplicationtoscalewhenitneedsto.Theapplicationneedstoscalehorizontallywithinaregionanditneedstoscaleouttomultipleregions.Thisgivesmoreresiliencetotheapplicationsothatpiecesofitshuttingdowndon’ttakeoutthewholeapplication.Usingloadbalancersaspartofthescalingalsogivestheapplicationatypeofself-healingcapability,allowingpiecesoftheapplicationthatarenolongeraccessibleorfunctioningproperlytoberemovedfromthepoolssothatusersdon’tinadvertentlytrytousethem.
Whenlookingattheindividualcomponentsofanapplication,somepiecesoftheapplicationneedtobeimprovedindifferentwaysthanotherpieces.Forexample,webcomponentscanbescaledoutwithoutmucheffort.However,databasecomponentstypicallycan’tbescaledoutasmuch,sincescalingcanmakeitmoredifficulttomanagethedatabehinditandaffectperformance.Databasescanbescaledout,buttheyarescaledoutdifferentlythanhowthewebcomponentisscaledout.Databasesarebestmanagedasaclusterofinstancesandthischapterpresentedseveralwaysthatdatabasescanberuninthecloud.
Thesuggestionspresentedinthischapterarejustthetipoftheiceberg.Thereareanumberofdifferentwaysanapplicationcanbeimproved,anddevelopersareencouragedtoreachouttotheOpenStackcommunityandresearchtechniquesthatotherdevelopersareusingwhenbuildingapplicationsforthecloud.Thenext,andfinal,chaptertakesthecloudapplicationtothenextlevel,sincesimplybuildinganapplicationforthecloudisnotenoughtojustrunitthere.Deployingtheapplicationtothecloudinanautomated,dynamicwayalsobringschallengestothedeveloper.
6DeployingtheApplicationWHAT’SINTHISCHAPTER?
Anoverviewofthedifferentvirtualizationtechnologiesandhowdeploymentvariesbetweenthem
AlookattheorchestrationtoolsavailableinOpenStack
Adiscussionontheroleofconfigurationmanagement
Theminimumroleofmonitoringinaclouddeployment
Adiveintoapplicationscalingandelasticity
AnexampleofhowtoputallofthistogetheranddeployamodernappinanOpenStack-drivensystem
Considerationsforupdatingandpatching
Devopsisatermyouhaveprobablyheardofrecently.It’sadescriptionofsomeone(orateamofpeople)whotacklestheissuesofbothdevelopinganapplicationandconfiguring/maintainingtheenvironmentforthatapplication.
Foryears,theroleofaserveradministratorhasbeenquitedifferentfromthatofanapplicationprogrammer.Eachroletakesaprettyspecificskillset,andalotcanbesaidaboutdevopsbeingadifficultcompromise.Thetermhowever,couldnotbebettersuitedtowhatit’sliketodeployapplicationsinanOpenStack-drivenenvironment.
Whenwetalkaboutdeployinganapplicationtothecloud,ithasaslightlydifferentdefinitionthanwhatithastraditionallymeant.Traditionaldeploymentsareoftenfocusedondeployingchangestoanapplication,orontheinitialdeploymentofapieceofsoftware.OpenStackandothercloud-basedtechnologies,however,makeitpossibletoprogrammaticallydeploysoftwarealongwithalloftheservers,storage,andnetworkingnecessarytorunthatapplication.
Asyouwillsee,thishasanumberofadvantagesandcanbeaccomplishedinanumberofdifferentways.Thischapterwilltakealookatthesetechnologies,howtochoosebetweenthem,andhowtousethemtoquicklydeployanelasticapplication—somethingnearlyimpossibletodoinahardware-basedworld.Wewillthenconcludewithashortdiscussionabouthowthisnewdefinitionofdeploymentaffectsthetraditionalprocessofpatchingandupdatingsoftware.
BAREMETAL,VIRTUALMACHINES,ANDCONTAINERSBeforeyoucandeterminehowyou’regoingtodeploy,youfirsthavetodeterminewhatyou’regoingtodeploy.LookingatthedemoapplicationdevelopedinChapters4and5,thefirstthingthatneedstobedeployedisanumberofservers.Whatwasn’tdiscussedmuchinthosechapters,though,waswhattypeofvirtualizationthoseserverswoulduse.
InthesamewayOpenStackallowsthosewhoimplementittochoosetheirownhypervisor,storagedevices,andnetworkingequipment,italsoallowsdeveloperstodetermineforthemselveswhattypeofvirtualizationtheywanttouseforanygivenproject/application.Instances,orservers,canbelaunchedasacompletelyphysicalcomputer,asavirtualmachine(VM)runninginahypervisor,orasacontainer—anisolatedprocessingspacethatcanexistontopofavirtualmachineorontopofactualhardware.
Thechoiceyoumakebetweenthesethreetechnologieswillbethebiggestdeterminantofhowyoudeployyourapplication.Youwillfindstaunchdefendersofeach,butthechoiceisoftenasubtleexerciseincompromiseandpersonalpreference.Thus,it’simportanttounderstandtheirdifferencesbeforemovingforward.
BareMetalBaremetalprovisioningisexactlywhatitsoundslike:thecreationofaserveronphysicalhardware.AsoftheJunoreleaseofOpenStack,baremetalprovisioninghasbeenmovedfromtheNovadrivertoitsownservicecalledIronic.HardwareisregisteredthroughtheIronicAPI,butonceproperlyconfigured,serversarestilldeployedinthesamemannerasvirtualmachinesthoughtheNovaAPIorHorizon(seeFigure6.1).
Figure6.1
Baremetalserversareprimarilyusedwhenyouneedtheabsolutehighestperformanceandstabilitypossible.Whiletheoverheadofvirtualmachinesandcontainershasdroppedovertheyears,thereisnosuchthingassoftwarethatdoesn’tconsumememoryandprocessortime.DiskIO,andCPUpriorityareallguaranteedinabaremetalscenario.BaremetalserversarealsoagoodoptionifGPUsorotherhardwaredevicesthatcan’tbeeasilyvirtualizedarepartofyourapplication.
Additionally,evenifperformanceisn’tofthehighestconcern,therearetimesforregulatorypurposes,whenyoumightfinditnecessarytodeploybaremetalserversanyway.HardwareisolationprovidestheabsolutemaximumamountofserversecurityinanyOpenStack-drivenenvironment.
Thatbeingsaid,ifperformanceandisolationaretheupside,thenefficiencyandflexibilityareitsmaindownsides.Baremetalserverscannotbesubdividedbeyondtheirhardwiredcomponents.Thiseithertendstoleavealotofunderutilizedhardwareoutthere,orresultsindeveloperspiggybackingmultipleapplicationsontoeachphysicalserver.
Toupgradeanapplicationrunningonbaremetaltobiggerhardwareoftenmeanstakingitdownwhilephysicalchangesaremade,orhavingalargevarietyofhardwareonhand.Thiscomeswithitsownsetofheadaches,andremovesmanyofthebenefitsprovidedbyasystemlikeOpenStack.Theabilitytostartsmall,growinstantly,andoffernumerousisolatedenvironments,areallgreatreasonstolookatothervirtualizationoptions.
VirtualMachinesFromtheperspectiveofdeployingaserverinOpenStack,virtualmachinesarestilltheindustrystandardatthemoment.Multiplevirtualmachinesrunontopofasinglehypervisorthatitselfrunsontopofasingleoperatingsystemresidingonasinglepieceofphysicalhardware(seeFigure6.2).
Figure6.2
Thebiggestadvantagestovirtualmachineswerealreadytouchedonearlierinthischapter.Virtualmachinesallowyoutosplitonelargephysicalserverintomanysmallerisolatedservers.Thesecaneachhaveauniqueconfigurationandrunningapplication.Thisavoidspiggybackingandhelpspreventoneapplicationfrom
takingdownanotherthatrunsonthesameserver.
UpgradingordowngradingavirtualserverisalsoasimplematterofaskingOpenStackforadifferentflavor.Thisisnotonlyhandyfortestingandtuningapplicationperformance,butcandrasticallyreducetheamountofhardwarerequiredforanygivenenvironment.Afterall,thereisnoneedtoplanfortheworstwhenyoucaninstantlydeployanewserverwithmoreresources.
Ofcoursetherearetrade-offswhenitcomestothiskindofvirtualization.WhileOpenStackcanbeconfiguredtoallowforover-subscriptionofresources,generallyspeaking,onceeitherallofthememory,CPU,ordrive-spacehasbeenallottedfromagivenpieceofhardware,theremainingassetscannotbeassignedtoanotherinstanceandessentiallygotowaste.Itisalsopossiblefortheschedulertofailtofindasinglepieceofhardwarethatmeetsalloftherequestedcriteria.Forexample,evenifaclusterhashundredsoffreegigabytes(GBs)ofRAMtotal,ifnosingleboxhasmorethan15GBfreeanda16GBserverisrequested,thenthecreationwillfail.Thisisagoodreasontoalwaysdeploythesmallestcomputingunitpossible.
Someefficiencyisalsolostduetothehypervisor.Whiletherehavebeengreatimprovementsinthistechnologyovertheyears,routingcallstoandfromthehostOSanddevicesisn’tfree.TheoverheadhereisdifficulttocalculateandcanvarybasedontheOS,device,andthesoftwareinvolved,butcaneasilyreachashighas15percent.Forsmallerenvironments,thisdoesn’tamounttomuch,butforlargerinstallations,thiscanbecomeadealbreaker.Entercontainers.
ContainersContainersarethenewbelleoftheball.Whiletheyarebasedonoldtechnology(variousformsofcontainershavebeenaroundforyears),theintroductionafewyearsagooftheDockertoolsettoeasilycreatenewcontainers,spurredthebigplayers(Google,Amazon,andMicrosoft)tobeginadoptingthetechnology.
ThereareseveraltypesofcontainerincludingLXC,BSDJails,andOpenVZ.LXChasgainedthemosttractionandcanbepackagedinseveralformats—DockerandRocketbeingthemostcommon.Therearesomegrowingdifferencesbetweenthesecontainertypes,formatsandpackagingtechnologies,butgenerallyspeakingtheyalldothesamething.Theyeachoffersoftwarethatcreatesvirtualenvironmentsmimickingafullvirtualmachine.ThetrickisthateachcontainerismissingthemainOSkernel.Callstothekernelareinsteadsentfromeachcontainertoasingledaemon,whichrunsonasingleinstanceofthehostOSoneachphysicalserver.ThismeanstheoverheadofhavingmultiplekernelsinaVMscenarioisgone(SeeFigure6.3).
Figure6.3
Thereisnodenyingthatcontainershavemanyadvantagesovervirtualmachinesorbaremetaldeployments.Containersallowforthecodeofanapplicationtobedeployedsimultaneouslywithitsserverconfigurationasthecontainerimagecancontainboth.TheydeploymuchfasterthanafullOSimage,astheyareonlyafractionofthesize(assmallasafewMBs),andtheycanprovideanexactcopyofanapplication(anditsconfiguration)fordevelopmentortesting(thiscanbeapositiveoranegativeintruth).
Dependingonwhomyouask,andthespecificsofyourapplication,containerscanalsobemuchfasterthantheirhypervisor-drivencounterparts.ThenativehostOSkernelandschedulerdecidewhichprocessesgetCPUtimeinsteadofhavingtogothroughoneschedulerperVMandthenanotherschedulerwherethehostOSdetermineswhichVMprocessgetsCPUtime.Greaterdensitycanalsobeachievedthroughtheuseofcontainers.Smallerimagesandfewerkernelsinmemorymeansmallercomputingunitsandgreatcostsavingsatscale.
Generallyspeaking,therenewedexcitementsurroundingcontainersiswelldeserved,butit’simportanttoacknowledgethattheyarenotasilverbulletforOpenStackDeployments.
Containersonamachine(orpod)mustsharetheexactsamekernel/operatingsystem.Thishasrepercussionsifanapplicationneedstomodifythekernel,orifthereisadesiretohostvariousoperatingsystems(orversions)onasinglepieceofhardware.
Therearealsosomesecurityconcernswhendeployingcontainersifanyofthemaretobegiventoanuntrustedsource.Exploitswhereauserescapestheircontainerandbreaksintoanotherhavebeenrecentlydemonstratedandreinforcethefactthatcontainersarenotaone-size-fits-allsolution,atleastnotyet.
Thebiggesthurdlewithcontainers,however,isthattheyaren’tyetavailableas
firstorderobjectswithinOpenStack.Fornow,containershavetobedeployedandconfiguredontopofvirtualmachinesthatarethemselvesmanagedbyOpenStack.Thediagramforthislooksalittledifferent(SeeFigure6.4).
Figure6.4
Thiscanprovidethesamelevelofisolation/securityasVMsifeachcustomerisgiventheirownVMtoruntheircontainerson,butOpenStackisessentiallyunawareofcontainersinthisscenario.ResizingandprovisioningcontainershastobedoneoutsideofNova.AdditionalconfigurationoutsideofNeutronisneededtocreateprivatenetworksandhandleinboundaccess.Containerscan’tbemanagedorvisualizedwithinHorizon,andtheperformancepenaltyofahypervisorinadditiontothecontainerdaemonactuallymakesthemlessperformantthanvirtualmachinesalone.
Therearesomeimpressivethird-partyoptionslikeCloudshiftandCloudifythatcanprovidecontainermanagementinthisconfiguration.However,thisstillhappensoutsideofOpenStack,anditremainstobeseenwhatplacethesetoolswillhaveoncecontainersonbaremetalbecomesavailable.
ContainersonBareMetalWhenpeoplespeakaboutcontainersonbaremetalinanOpenStack-drivenenvironment,theyaregenerallynotjustreferringtotheconceptofrunningcontainersdirectlyonthehostOS.
Thiscouldtheoreticallybeachievedbyprovisioningabaremetalserver,loadingonastandardLinuxdistribution(oramorededicatedoneforcontainerssuchasCoreOSorRancherOS),andrunningDockeroranothercontainersystemontopofthat.Thisideahassomeadvantagesoverbaremetalalone,likebeingabletosubdividehardware.Unfortunately,itstilllackstheorchestrationandmanagementcapabilitiesprovidedbyOpenStack.
Moreoften,whensomeonespeaksaboutcontainersonbaremetal,theyarereferringtoseveralnewprojectsthatattempttoprovideboththeefficiencyofeliminatingthehypervisoraswellasenablingOpenStacktomanagethesecontainersasfirstorderobjects.
Oneoftheseprojects,Magnum,wasdiscussedearlierinChapter3.IthasbeenavailablesinceKilo-2andmakesorchestrationengineslikeGoogle’sKubernetesandDocker’sSwarmavailableforcontainermanagement.Theparadigmisslightlydifferentandinvolvesthingslike“pods”and“bays,”butgenerallyspeaking,itprovidesvirtualmachine–stylemanagementforcontainersthatrundirectlyonhostoperatingsystems.
Intheory,containersonbaremetalprovidethebestofallworlds.Yougettheefficiency/densityofcontainers,thenativemanagementofVMs,and(accordingtosomeearlybenchmarks)nearlybaremetalperformance.
Unfortunately,aswithalotofrevolutionarytechnology,Magnumisn’talwaysavailable,andsupportedorchestrationengineslikeswarm,Mesos,andKubernetescouldstillusesometimetomatureandstabilize.Therearealsosomethird-partyoptionsoutsideofMangum/OpenStacklikeCloudifythatprovideinterestingsolutionsandsupport,but,youwilllikelyfindyourselfchoosingbetweenbaremetal,virtualmachines,andclassicallymanagedcontainersforquitesometime.
ChoosingtheRightTechnologyfortheProblemFromadeploymentperspective,virtualmachinesareusuallytheeasiestwaytogo.Unlikebaremetal,theyareefficient,andcanbescaledupwithacommand.UnliketraditionalcontainerstheycanbemanagednativelythroughOpenStack’sHorizonandthevariousAPIs.Unlikebaremetalcontainers,thetechnologyismature,andNova/Compute(asopposedtoMagnum)isdefinitelyavailable.
Inourdemoapplication,therearenospecificrequirementsforcustomhardwareorGPUutilizationineithertheweborresttiers.Neitheroftheseseemtorequirehardwarelevelperformance,nordotheyneedhardwarelevelisolation,sobaremetalisn’treallynecessary.Iflocaldrivesareused,itssometimespopulartouse
baremetalinMySQLservers(forperformancereasons),butgenerallyspeakingthisisn’tanissueaslongastheyareprovisionedwithenoughmemorytokeepthemfromaccessingthedisktoofrequently.Wealsowon’tbedeployingenoughserversinanyofthesetiersthatthesmalleroverheadofContainerswillreallycomeintoplay.Thisleavesuslittlereasontochooseanythingotherthantodeploystandardvirtualmachinesinallcaseshere.
Ifthiswerearealproductionproject,youwouldwanttoconsiderafewotherthingsbeforemakingthedecision:Whatkindofexpertiseisavailableonyourteam?WhatoptionsareavailableinyourOpenStackenvironment?Areyougoingtodistributethisapplicationinternallyorelsewhere?Theanswertothesequestionsshouldimpactyourdecision.Mostofthetime,asinglechoicewillmakethingseasier,butamixedenvironmentisalsoareasonableresponse.Certainsystems(Hadoop,MySql,etc.)maybenefitfromthemaximizedperformanceandstabilityofbaremetalprovisioning,whileyoumaywanttodeploypreconfiguredcontainersoremptyvirtualmachinesforothercomponents.
Whateveryouchoose,considerhowthiswillaffectyourdeployment.Forexample,sometoolslikeHeatareonlyavailabletofirstorderobjectslikevirtualmachinesandnotcontainers(fornow).Alternativelychoosingbaremetalmayrequireyoutopiggybacksomeofyourapplicationontoasingleserver.Regardless,theremainingsubjectsinthischapter:orchestration,configuration,andscalingarebuiltonthefoundationofthisinitialchoice,sochoosewisely.
ORCHESTRATIONANDCONFIGURATIONMANAGEMENTNowthatavirtualizationtechnologyhasbeenchosenforeachofourservertypes,theyactuallyneedtobeprovisionedandconfigured.Thenetworkfortheapplicationalsoneedstobesetupandappropriatesecuritygroupsandrestrictionsputinplace.ThiswasalldonemanuallyintheexamplesinChapters4and5,butinpracticeit’simportanttolookatdeployingacloudapplicationasmorethanjustusingOpenStackasaself-serviceportalforserverprovisioning(IAAS)and/oraseriesofavailableservices(PAAS).Embracingtheabilitytoscripttheconstructionofyourenvironmenthashugeadvantages.Meanwhile,treatingyourapplicationasifitliveswithinaclassicenvironment(deployingandconfiguringitthesameway)canresultinabsolutedisaster.
Inaclassicallyprovisionedenvironment,youmightbegivenaccesstoapowerfulserver,spendseveralhours/days/weeksmanuallyconfiguringit,andthendeployyourapplicationtothatserver.Thisworksmoderatelywell.Modernserversarebuiltwithharddrivearrays,multiplepowersupplies,andhavefaulttolerantram.Intheeventofafailure,thehopeisthattheredundantcomponentscantakeoveranddowntimecanbeavoided.
AswasdiscussedearlierinChapter5,resilienceinacloud-basedapplicationdoesn’trelyonredundanthardware.Instead,commodityhardwareisoftenused,andmultipleserversandisolatedapplicationtierscreatesresiliency.Expectinganygivenservertolockup,stoptakingrequests,orjustdisappearisallpartoftheplan.Evenifmorerobusthardwarewereused,whenitjusttakesthepushofabuttontopermanentlydeleteallofyourcarefullyconfiguredservers,itisimportanttobeabletorecreatethemquickly.
Thisiswhyscriptingtheorchestrationandconfigurationofyourenvironmentisavitalpartofdeployinganycloud-basedapplication.Doingthisnotonlyprovidesthepreviouslydescribedbenefits,butitalsoensuresconsistencybetweenservers,self-documents,andisaperfectopportunitytoworkonyourdevopsskills.Itisalsothebasisforaddingelasticitytoourdemoapplication,asyouwillseeshortly.
OrchestrationTools:Heat,Murano,Cloudify,andMoreMuchlikeweneededtolookatallofthevirtualizationoptionsbeforedeterminingwhatwasgoingtobedeployed,it’simportanttolookatalloftheorchestrationoptionsbeforemakingadecisiononhowthesethingsaregoingtobedeployed.Withrespecttothis,thereareanumberofoptionsthatarecommonlyemployedthatareallreferredtoasorchestrationtechniquesortools.
Thefirstoftheseisjusttocreateyourownscriptfromscratch.Thereisnothingtostopyoufromdoingthisinthelanguageofyourchoice.Thecompute,networking,andplatformAPIsprovideallofthebasicsyouneed.Aslongasa1:1ratioiskeptbetweenapplicationsandKeystoneprojects,Horizonwillevenprovideyouwitha
prettyclearvisualization/inspectionofyourenvironment.Thisisaperfectlyviableoption,andthoughitrequiresalotofinitialeffortupfront,itisacommonorchestrationsolution.ItisespeciallyusefulwhendealingwithcomponentsorservicesthatexistoutsideofOpenStack.
Asfarasintegratedsolutionsgo,Heat(beingthemainorchestrationcomponentofOpenStack)istheobviouschoice.Itstemplatefilesallowyoutodescribeyourenvironmentinawell-documentedmanner.UsingHeateliminatessomeofthegruntworkofmanualscripting,suchashavingtoprovidedetailedoutputanderrorhandling.Heatalsosupportsseveraldifferentconfigurationmanagementoptions,makingthenextstepinthedeploymentprocesseasierstill.
Muranoisanotheroptionforsomewhatprogrammaticorchestration.Asdiscussedearlier,itprovidesbothanapplicationcatalog,aswellasawaytozipupapplicationsforthird-partyconsumption.PackaginganapplicationforMuranoalongwithallthewizardsandscriptedorchestrationisgenerallyoverkillthough,unlessyouareplanningondistributingtousersinotherOpenStackenvironments.Ultimately,Muranoismoreaboutdistributionthanitisaboutorchestration,andsoitisnotgenerallyarecommendeddeploymentmechanismforcustomapplications.
Ofcourse,noconceptinOpenStackwouldbecompletewithoutahealthydoseofthird-partyapplicationsthatprovidealternatesolutions.CloudFoundryandCloudifybothofferorchestration.IftheseareavailablewithinyourOpenStackinstallationtheyaredefinitelyworthalook.TheirsuccessisdueinparttotheirfriendlierUIandtheirabilitytosimplifytheorchestrationprocess.However,becausetheycommunicatetoOpenStackviathesamenativeAPIsyouhaveaccessto,thereislittletheycanaccomplishthatyoucan’taccomplishyourselfwithalittlemanualscriptingworkorthroughHeat.
Lastly,therearenewcompanies,suchasRancherLabsandprojectslikeKubernetesandMesos,thatarestartingtoprovidecontainer-focusedorchestrationsolutionsthatliveontopof,orworkwith,OpenStack.Thesearethebleedingedgeofvirtualizationtechnologyandassucharelikelytoseehugechangesbeforemainstreamadoption.Theyare,however,worthmentioningincaseyouarelookingforacontainer-focusedsolution,needtospanmultipleclouds,and/orhaveexperienceusingRocket,Dockerorsimilartechnology.
Sincewehavechosentousevirtualmachinesovercontainersforourdemoapplication,andtheapplicationisn’tmeantforwidedistribution,thatleavestwogoodchoicesfororchestration:manualscriptingandHeat.IfthedemowasamorecomplexapplicationoriftherewerecomponentsthatsimplycouldnotbemanagedwithinHeat,thenrawscriptingwouldbethego-tosolution.ItisalsopossibletouseHeatasacomponentofalargerscript,asitisessentiallyanAPIaswell.Asisthough,HeatisreasonablywelldocumentedandprovidesasinglesimplifiedsystemforcommunicatingtoallofthedifferentOpenStackcomponentsthedemoapplicationisgoingtouse.Thismakesitthebestchoicefor
nowandtheremainderofthisbookwillfocusontheuseofHeattemplatesfordeployment.
ConfigurationManagementandCloudInitIforchestrationisanythingthatoccursabovetheserverlevel,configurationmanagementcangenerallybeconsideredtobeanythingthatneedstobemodifiedattheserverlevelorbelowinordertogetyourapplicationupandrunning.Addingspecificsoftware,updatingconfigurationfiles,orevenpullingdownanapplicationfromGitoccursundertheumbrellaofconfigurationmanagement.Inthecaseofthedemoapplication,thiscouldmeanApacheforthewebtierorNode.js/PythonfortheRestlayerandMySQLforthedatabase(s)alongwithalloftheirrespectiveconfigurationfiles.
BeforewegetintotoolslikePuppetandChef,whichreallyarethestandardforconfigurationmanagementthesedays,thereisanotheroptioncalledCloud-Initthatiswellworthyourtimetoexplore.Technicallyspeaking,itisjustaLinuxpackagethathandlesearlyinitializationofacloudinstance.Fromadeveloper(ordevops)perspective,itisalsooneofthesimplestwaystorunscriptsafteraserverhasbeenprovisioned.
Whatyouchoosetodointhesescriptsand/orwhatlanguageyouwanttoemployisuptoyou.Cloud-Initsimplyrunswhatyoutellittoeitherbyincludingthescriptunderuser_dataaspartofyourAPIcalltoNova,orthoughHeatasfollows:
heat_template_version:2014-10-16
description:Simpletemplatetodeployasinglecomputeinstance
parameters:
image_id:
type:string
label:ImageID
description:Imagetobeusedforcomputeinstance
resources:
web_server:
type:OS::Nova::Server
properties:
image:{get_param:image_id}
flavor:m1.small
user_data_format:RAW
user_data:
#!/bin/bash
echo"Youjustranthiscommand!"
Inthisexampletheserverwouldfirstbeprovisioned,andthenthecommandinuser_datawouldbeexecutedand“Youjustranthiscommand,”wouldbeoutputtothecommandline.Thiscanactuallybeviewedthoughthespice-consoleonceitisavailableinHorizonaspartofthebootsequence.
Itshouldbeprettyeasytoseehowyoucouldexpandonthisconcepttoconfigureaservertomeetyourneeds.InsteadofmanuallyinstallingXYZafterprovisioningit,youcouldsimplywriteascripttoinstallXYZandincludeitaspartofyourHeat
template.Aslightlymoreusefulexamplemightlooklikethefollowing:
heat_template_version:2014-10-16
description:Simpletemplatetodeployasinglecomputeinstance
parameters:
image_id:
type:string
label:ImageID
description:Imagetobeusedforcomputeinstance
resources:
web_server:
type:OS::Nova::Server
properties:
image:{get_param:image_id}
flavor:m1.small
user_data_format:RAW
user_data:
#!/bin/bash
yuminstall–qygit
yuminstall–qynpm
gitclonehttps:/github.com/folder/package.git/var/usr/share/app
node/usr/share/app/server.js
echo"Youjustinstalledandstartedanodeapp!"
Creatingastackwiththistemplatewouldprovisionasinglesmallserverwiththespecifiedimage.ItwouldthenbeconfiguredwithGitandNPM(Node.js),soyoucandownloadaprojectfromGitHubandstartit.Forourdemoapplication,differentinstallationandconfigurationscriptswouldbeinsertedforeachoftheservertypes.
DependingonyourOpenStackconfigurationandyourbaseimage,Cloud-Init’sCloudconfigYamlformatmayalsobeavailable.Itprovidessomeexcellentfunctionalitywithouthavingtowritealotofcode.Convertingourearlierexamplewouldresultinsomethinglike:
heat_template_version:2014-10-16
description:Simpletemplatetodeployasinglecomputeinstance
parameters:
image_id:
type:string
label:ImageID
description:Imagetobeusedforcomputeinstance
resources:
web_server:
type:OS::Nova::Server
properties:
image:{get_param:image_id}
flavor:m1.small
user_data_format:RAW
user_data:
runcmd:
-yuminstall–qygit
-yuminstall–qynpm
-gitclonehttps:/github.com/folder/package.git/var/usr/share/app
-node/usr/share/app/server.js
-echo"Youjustinstalledandstartedanodeapp!"
Thisisaprettysimpleexample,butitisafairlycomplexandpowerfulsystem.ForfurtherreadingonCloud-InitandsomegreatexamplesofhowtoconfigureaserverwiththeCloudconfigformattakealookathttp://cloudinit.readthedocs.org/en/latest/topics/examples.html.
Puppet,Chef,Salt,andAnsibleWhileCloud-Initisageneralsystemforrunningscriptsforwhateverpurposeyoulike,therearenumeroustoolsdedicatedsolelytoconfigurationmanagement.Puppet,Chef,Salt,andAnsiblearen’ttheonlyoptionsinthisrealm,buttheyaredefinitelythebiggestplayers,andtheyhavesomeimportantsimilaritiesanddifferencestoconsideriftheyaretobeusedaspartofanOpenStack-backeddeployment.
Firstoff,alloftheseapplicationssharetheideaofplugandplaymodules(calledrecipesinChef,andplaybooksinAnsible).TheseprebuiltblocksarethebiggestthingthatdifferentiatesthemfromconfiguringaserverwithBashorotherscriptingtoolslikeCloud-Init.Modulesareavailablefrompublicrepositoriesthatanyonecansubmittoorretrievefrom,similartoPIPinPythonorNPMinNode.js.Additionally,theyhaveallattemptedtocomeupwithasimplelanguage/structurefordescribingaserver’sconfiguration,handleinstallationerrors,andprovidedifferentconfigurationsforserversindifferentroles.Theformatsarefamiliar—JSON,YAML,etc.,buttheactualsyntaxandmethodologyareproprietaryandnotportableacrosssolutions.
Thelanguagetheywerebuiltupon,theirneedtohaveinstalledclients(Ansible,forexample,doesn’tneedone),andthebreadthanddepthoftheirmodulelibraries,arereallywhatdifferentiatesthesetoolsfromeachother.Aswithmosttechnologies,youwillfindenthusiasticsupportersanddissentersofeach,butformostpurposestheyareequivalent.Infact,theirsimilarity,andtheabilitytodevelopagenericsyntaxfortheiruse,isabigreasonwhythereisgrowingsupportforallofthesetoolswithinOpenStack.
Let’slookatwhatasimplePuppetManifestmightlookliketoconfigureaservertorunApacheandPHP:
#installapache
package{'apache2':
ensure=>installed
}
#startapacheandensureitsrunning
service{'apache2':,
require=>Package['apache2'],
ensure=>running
}
#installphp
package{'php5':
require=>Package['apache2'],
ensure=>installed
}
#createaninfo.phpfiletoshowthatthisallworked
file{'/var/www/html/info.php':
ensure=>file,
content=>'<?phpphpinfo();?>',
mode=>0444,
require=>Package['php5']
}
WiththePuppetclientcorrectlyinstalledandtheprecedingfilesavedasmanifest.pp,youcouldthenexecutethistemplateasfollows:
$sudopuppetapply./manifest.pp
Puppetdealswithanyerrorhandling,determinestheorderthingshavetohappeninbasedupontherequirestatements,andhandlesallofthedifferencesinOStypes.Forexample,usingthesetools,youdon’thavetowriteonescriptforCentOSthatinstallssoftwareviaYum,andanotherversionthatsupportsapt-getinstallationonDebianorUbuntu.
Aswasmentionedbefore,HeatactuallyprovideshooksforallofthesetoolsintheformofaSofwareConfigresource.IfyourconfigurationsupportsChef,thenaHeattemplatetosetupWordpressmightlooklikethis:
resources:
wordpress_config:
type:OS::Heat::SoftwareConfig::Chef
properties:
cookbook:http://www.mycompanycom/hot/chef/wordpress.zip
role:wordpress
#inputparametersthatthechefrole(s)need
inputs:
wp_admin_user:
type:string
mapping:wordpress/admin_user
wp_admin_pw:
type:string
mapping:wordpress/admin_password
db_endpoint_url:
type:string
mapping:wordpress/db_url
#variousotherinputparameters…
#Havechefoutputthefinalwordpressurl
outputs:
wp_url:
type:string
mapping:wordpress/url
FromtheOpenStackdocumentationathttps://wiki.openstack.org/wiki/Heat/Blueprints/hot-software-config-spec:
TheresourcetypeOS::Heat::SoftwareConfig::ChefindicatesthatthisisaChef-specificSoftwareConfigdefinition.ThecookbookpropertypointstotheusedChefcookbook,andtherolepropertypointstotheroletobesetupviathisSoftwareConfig.TheinputssectioncontainsthedefinitionofinputparametersthathavetobepassedtoChefforconfiguringtherole.Inputparametersaredefinedintermsofnameandtype.Inaddition,amappingspecifiestowhichroleattributetherespectiveinputparametersneedstobeassigned(i.e.Chef-specificmetadata).
Ifthisseemsconfusing,don’tworry.ThisexampleissimplymeanttoshowthedevelopersbehindOpenStackareawareofthesetools,andthatifyouarefamiliarwiththem,thereareanumberofwaystotightlyintegratethemintoyourdeployment.Again,exactlyhowyouchoosetoconfigureyourserversandyourapplicationisentirelyuptoyou.Yourcompanyand/oryouroperationsteammayhavealottosayonthesubject,orthechoicemightbeyoursalone.What’simportantistohaveageneralunderstatingoftheoptionsavailableandformagameplan.
Withthatinmind,let’stogoovertwootherimportantpiecesoffunctionalitythatalloftheseconfigurationmanagementsolutionsprovide.Firstoff,theyoffercentralizedmanagementofservers.Oncetheclientisinstalled,andtheserverhasbeenregisteredintothemaster,youcanuseawebinterfacetodothingslikesearchforaserver,seewhatsoftwareisinstalled,orevenpush/scheduleapatchforit(seeFigure6.5).
Figure6.5
Thisconfigurationisn’trequiredthough,andthesetoolscanallbeusedinmasterlessmodewherethiscentralauthorityisentirelyabsent.ThereisalotofcrossoverbetweenwhatthesecentralizedsystemsandwhatOpenStack/Horizoncanoffer,soit’snotunusualtousetheminthismasterlessmanner.
Theotherpieceoffunctionalitytheyallofferistheabilitytoexecutearbitrarycommandsonremoteservers.Thisisanaspectofthesamemechanismthatallowsthemasterserverstopatchremotecomputers.Ansibleinparticularcanbeanindispensibletoolwhenusedforthispurpose.
UnlikePuppet,Chef,andSalt(tosomeextent),Ansibledoesn’trequiretheinstallationofaspecializedclienttosupportremotecommandexecution.ItusesSSHandprivate/publickeystoachieveasimilarresult.ItisalsoeasytoconfigureAnsiblewithalocalfiletopushthesecommandstomanyserversatonce(asopposedtosequentially).ThismakesremoteexecutionquickandeasyfromanycomputerwithAnsibleinstalled.AconfigurationfileforAnsiblelookslikethis:
[devservers]
dev.cloud.mycompany.com
[prodservers]
prod01.cloud.mycompany.com
prod02.cloud.mycompany.com
prod03.cloud.mycompany.com
[otherservers]
server1.cloud.mycompany.com
server2.cloud.mycompany.com
Thisfiledefinesthreegroupsofservers(devservers,prodservers,andotherservers).Commandscanberunonanindividualbox,agroup,orallgroupsatonce.Youcanalsodeterminehowmanyserverstorunthecommandonsimultaneously.Soif,forexample,youwanttoupdateGitonallofyourproductionserversatonceyoucouldrun:
$ansibleprodservers-a"yumupdate-yqgit"-f3-umyusername
––sudo––ask-sudo-pass-i/myuser/ansible_hosts
SinceYumoftenrequiressudoaccess,theask-sudo-passvaluehasbeeninvoked,and-f3indicatesthatyouwanttorunitonthreeserversatonce.Iftherewere6serversdefinedintheprodserversgroup,thenitwouldrunthisintwoseparatebatches.Thisisoftenusefultoavoidthingslikecacheslammingortoavoidrebootingallofyourserversatonce,makingyourapplicationtemporarilyunavailable.
Ansibleishighlyrecommendedasaneasywaytoexecuteremotecommands,butthisdoesnotmakeitashoe-infortheconfigurationsolutionforourdemoapplication.Infact,thereisonedrasticallydifferentoptiontoconsider.
WhereDoSnapshotsFitIn?OrShouldThey?Withalloftheseconfigurationoptionsit’svalidtoaskwhereimagesfitintoadeployment.Ratherthanscripttheconfigurationofaserverorseveralserverswithdifferentroles,itisdefinitelypossibletotakeasnapshotofaserveronceit’sconfiguredandsimplydeployitinthisconfiguredstate.Whilethereareafewcaveatstothatand/orbuildingacustomimage,thiswillusuallywork.ImagescanbeuploadedthroughHorizonorthroughtheGlanceAPI,andanumberofpre-configuredimagesareavailablefromcompanieslikeBitnamitomakethiseveneasier.Generallyspeakingthough,thisisn’tagreatsolution.
Imagesarebulkyandcumbersome.Ifyouwanttomodifyasinglevalueinasinglefile,youcanenduphavingtore-createanentireimagealloveragain.ThisisactuallyoneofthemainproblemsthatDockerisattemptingtosolvewiththeDockerFilecontainersystem.Testingchanges,debugging,andevenstoringalltheseimagescanbeatimeandspaceconsumingprocess.Configurationscriptsontheotherhand,actliketinyzipfilesthatexpandonaservertocreatefullyconfiguredboxes.Theyareeasytoedit,store,andversion.Dependingonthesoftwareinvolved,it’sevenpossibletousethesamescripttoconfigurewindows
andLinuxboxes.
Thereareatleastafewsituations,though,wherecreatingcustomimagescanbeanextremelyeffectivesolution.Ifyouarenotusingcontainers,yourconfigurationscriptstakealongtimetorun,andyouaredeployingthemfrequently,thenusingimagesorsnapshotscanbeamuchfasteroption.Thisisoftenthecasewithlargewindowsbuilds..NETcomponentsandenterpriseclasswindowssoftwarecantakehourstocompletelyinstallandgetrunning.Imagescanalsobeusefulwaytodistributesoftware.EnsuringsoftwaresuchasPuppet,orGitisalreadyinstalledcanpreventanynumberofteamsfromhavingtoinstallandconfiguretheseitemsthemselves.Inthisscenario,acombinationofpre-configuredimagesandpostprovisioningconfigurationscriptsareusedeffectively.
Becausetheneedsofourdemoapplicationarerelativelysimple,andthetoolsarenativetoOpenStack,therestofthischapterwillfocusonusingCloud-Initanduser_datawithinHeattohandleserverconfiguration.Thiswillkeepthingslight,andwon’trequireadeepknowledgeofanyoftheconfigurationmanagementtools.Whenitcomestoyourownapplicationthough,weencourageyoutoexperimentandchoosewhatworksbestforyou,yourteam,andyourapplication.
MONITORINGANDMETERINGItmightseemoddatthispointtobeginadiscussiononmonitoring.Wehaveyettoevenlookatacompletedeploymentsolution.However,monitoringisapre-requisiteofelasticityandrequiredtosomeextenttomakescalinguseful.Afterall,withoutknowingtheloadonasystem,it’shardtoknowifyouneedtoincreasetheserverorstacksize.Thisholdstrueevenifsuchchangesaredonemanuallyorprogrammatically.
YoumayalsofindifPAASorexternalcomponentsaren’tused,thatyourdeploymentactuallyincludesitsownmonitoringsystem.ThismayseemalittleInception-like,butit’snotverycomplicatedinpractice.Monitoringserverscanbedeployedandconfiguredinasecondproject,stack,orevenseriallybeforetheapplicationserverswithinthesameproject.Itisalsolikely,ifyouworkwithinalargercompany,thatsomesortofcentralizedmonitoringisavailableforyoutouse.
OpenStackdoeshaveacoupleofbuilt-inmonitoringoptionsthatcanbeusefulfordeployments.MonascaisaPAAScomponentthatoffersmonitoringasaservice.Itconsistsofanumberofsub-components:anagentthatrunsoneachserver,aCLItospeaktotheMonascaRESTAPI,astoragesystemformetrics,analertsystem,andananalysisenginethatenablesthealertsandanumberofotherfeatures.
TheresultofcollaborationbetweenHPandRackspace,Monasca,canbeacapable,butstunninglycomplexmonitoringsolution.Forafullexplanationandsomeinterestingreading,visithttps://wiki.openstack.org/wiki/Monasca.
Theotherfirst-partysystemthatofferssomelevelofmonitoringisCeilometer.CeilometerisdiscussedinChapter3.Itwasprimarilybuiltasatelemetryservicetomeasureutilizationandtostorethatdataforlateranalysis.LikeMonasca,Ceilometercanmeasurethingslikeload,andtriggeralertswhencertainthresholdsaremet.UnlikeMonasca,itcanalsoreportdetailedinformationonthingslikehowmuchprocessortimewasusedbyagivenvirtualmachineorproject.Themoststraightforwarduseofthisistoenableusagebasedbillingormetering.Youmayfinditusefulforthingslikecomparingtheefficiencyofserverconfigurationsordeterminingwhichapplicationsareoverprovisioned.FurtherdocumentationonCeilometercanbefoundathttps://wiki.openstack.org/wiki/Ceilometer.
Ifyouarelookingforanofftheshelfsolutionthatisn’tintegratedwithOpensStack(or,asisoftenthecase,theseservicesarenotavailable),thenbothNagiosandSensuareworthalook.ThesesolutionsbothfunctionbyaddingaclienttoeachserverthatyouwanttomonitoranddeployingacentralizedmonitoringserverthatcollatesthisdataanddisplaysitwithinawebbasedGUI.SimilartoPuppetandChef,therearecommunitysubmittedchecksthatcanberunontheclientservers.ThesecommonlywatchthingslikeCPUuseandavailablememoryandsendresultsoralertstohandlersonthecentralhub.There
arealsoanumberofcommunity-builthandlersavailabletosendthingslikeSMSoremailmessages,orlogresultstoadatabaseforlateranalysis.
Nagiosiscurrentlyfreeforuptosevenmonitoredservers,whileSensu(beingthenewkidontheblock)isfreeforthenon-enterpriseversion.Bothofthesesystemsarecompletelyscriptableandcanthusprovideanylevelofmonitoringnecessary,aswellasanyfunctionalityrequiredtotriggerelasticchangeswithintheapplication.
Generallyspeaking,it’shardtorecommendanyoftheseasgreatsolutions.Monascashouldbeaslamdunk,butit’sratherenigmaticandCeilometerdoesn’tprovidealotofflexibilitywhencomparedtosystemslikeSensuandNagios.Meanwhile,theexternalsolutionsbothoffergoodusability,butaren’tnativelyintegratedwithOpenStack.Addingthesetoourdemoapplicationforexample,wouldmeandeployingandconfiguringthecentralserversandclientsaswell.
Ceilometeralerts,though,arefairlywelldocumentedandcanbeconfiguredandusedwithinHeattemplatestoenablesomelevelofelasticity.Forthatreasonaloneit’sthebestchoiceforthedemoapplication.Inarealworldscenarioyouwouldwanttoseeperformancegraphs,andbeabletologandalertyourteammemberstospecificapprelatedmetrics(suchasthenumberofconnectionsorsessioncounts).Asafreesolution,Sensuisprobablyagreatplacetostartifyouneedtopushbeyondwhatwillbedemonstratedhere.
ELASTICITYAsmentionedinChapter5,elasticityistheideathatapplicationscanprogrammaticallyshrinkandgrowtomatchload.Inanon-cloudscenario,thesizeand/ornumberofserversdeployedaregenerallydeterminedbythemaximumcapacityyouwanttoaccommodate.Inanelasticcloudapp,thesizeand/ornumberofserversshouldideallybetheminimumrequiredtoaccommodatethecurrentload,andgrowtothemaximumthatcanbeaffordedasloadincreases.Thisisslightlydifferentthanscalability,whichissimplyanapplicationscapacitytogrow.
Theprimarymotivationbehindelasticityisthatusingtheabsoluteminimumcomputingunitsneededatanypointintimecanleadtogreatsavingsatscale.Evenifyouaren’tpayingbytheserveratahostedsolution,beingabletoscaleuponlytheapplicationsthatneeditatanytimecanleadtodrasticallysmallerserverrooms.
Thereareotherbenefitsaswell,though,beyondcostsavings.Elasticityandresiliencyareveryintertwined.Insteadofdealingwithdowntimeonanapplicationthatisgettingtoomuchtraffic,elasticapplicationsautomaticallygrowtomeetdemandandstayalive.Theycanalsobeforcedscaleupinorderhandlehardwareandnetworkfailuresevenintimesoflow/moderatetraffic.Usingconceptslikeanti-affinity(basicallyusingserversindifferentracks)anelasticappisalsoeasiertokeeprunningwhileapplyingpatches,orwhenservicinghardware.Additionalsetsofserverscanbemadeavailabletousewhilesetsofthemaretakendownformaintenance.
Ofcourse,noteverythingneedstobeelastic.
MakingSureYouNeedScaling/ElasticitySomethingyouwon’thearmuchofisthatnotallapplicationsneedtoscale.Notscalingisn’tinteresting.Notscalingisn’tcool.Notscalingwon’twinyouanyawards.However,ifyoucanavoidscaling,thenyoucanfocusyoureffortselsewhereandgreatlysimplifyyourdeployment.Someexamplesofapplicationsorenvironmentsthatmaynotneedtoscale:
Intranetwebsites:Theseseelimitedtrafficanddowntimedoesn’taffectcustomers.
Postprocessingsystems:Systemsthatanalyzedataorcrunchnumberscanbenefitfromscalingupandgoingfaster,butifit’snotmissioncriticalandyoucanwaitfortheresult,thenfasterresultsaren’talwaysworththeeffort.
Single/FixedServerApplications:Generallyspeaking,thereisstillplentyofsoftwareonlyrunswellonbig,fast,stablehardwareandcanprovidespeedbenefitswhenextramemory/processorispresent.Iftherequirementsofyourapplicationwon’tallowfordistributedcomputingacrossmultipleservers,and
itcansoakupasmanyresourcesasyoucangiveit,thengoasbigasyoucanonasingleinstanceandmoveon.
Evenifyourapplication,oragiventierofyourapplication,doesnotfitintooneofthesecategoriesandyouwantittoscale,thisdoesnotmeanitneedstobeelastic.Elasticityisgreatforcostsavingsandcanallowyourapplicationtogrowrapidlywithoutyourintervention,butthatisnotalwaysdesirableornecessary.Elasticityaddsyetanotherlayertoanalreadycomplicatedlistoftechnologiesandtakestimeandenergytoimplementandperfect.Somesituationsthatmaynotbeappropriateforelasticityinclude:
Anythingthatreceivesmanictrafficpatterns:Spinningupnewserversisfast,butevenwhenusingcontainersthereissomelatency.Thesamecanbesaidaboutspinningthemdown.Loadbalancingchangesandconfigurationupdatescanalsotaketimetocomplete.Ifyouhavetodealwithquick,massivefluctuationsintraffic,it’sbesttosimplyplanformaximumcapacityandletitrun24/7.
Whenworkingwithnobudget:Ifyou’reluckyenoughtohavenobudgetthenit’sonelessthingonthetodolist.Simplyscaleupbeyondanythingreasonableandaddmorecomputeifthingsevergetclosetomaxcapacityandrunwithabigmarginoferroratalltimes.
Whenworkingwithfixedbudgets:It’sunnecessarytogrowanapplicationifthereisnobudgettopayforadditionalservers.It’salsounfortunatelycommontoloosebudgetiflessserversareusedforagivenperiodoftime.Ifyouabsolutelyneedfixedcostsforfixedperiodsoftime,thenascalablebutnon-elasticapplicationisareasonablewaytogo.Youcanjustscalethingsmanuallyeachquarterorwhenthebudgetchanges.
Whenathereisanon-elasticbottleneck:Thereisnopointinquicklyscalingyourappupanddowntohandletrafficifanexternalfactorlimitstheutilityinthis.Ifyourapplicationhasanon-elasticthrottlethenconsiderscalingmanuallytomatchthis.
Intheend,ifit’spossibletoscaleyourapplication,it’sworthconsideringdoingso,anddoingsoprogrammaticallyinanelasticfashionaspartofyourdeployment.Ifyouwanttoseeallthebenefitsfromaclouddeployment,thenthisisallbutmandatory.Bothyourcustomapplications,aswellasmanyofftheshelfsystemscangainspeed,resilience,andcostsavingsifyoudo.
Lookingonceagainatourdemoapplication,it’seasytoseethattheuserfacingwebtieraswellastheResttiercouldbothbenefitfromelasticscaling.Thedatabaselayerthoughisn’tquiteasscalableandwouldnotimmediatelybenefitinperformancefromadditionalservers.It’salsonotatrivialprocesstoaddaservertoanexistingGalreaclusterasthereplicationcantakealongtimetocatchup.Sothisisgoodexampleofanapplicationthatisentirelyscalable,butonlybenefitsfromelasticityonseveralofthecomponents.
ScriptingVerticalVersusHorizontalScalingBeforeyoucanaddelasticitytoanapplication,itmustfirstbescalable.Beforeyoucanscale,youmustfirstdeterminethetypeofscalingyouwanttouse.Thesimplestformofthisisjusttoincreasethesizeoftheserversinvolved,addingmoreCPU,Ram,orDisk(dependingontheapplication).Thisiscalledverticalscaling,andcanbeappliedtoalmostanyapplicationrightoutofthebox.
BylettingyoudefinetheFlavor(size)ofanygiveninstancewhenyouprovisiontheserver,OpensStackmakesverticalscalingrathereasy.It’sworthnotingthatnotallOpenStacksetupswillletyouincreasethesizeofanexistingserver,anditisalmostalwaysnecessarytocreateanewinstanceifthedesiredsizeissmaller.Aslongasyourdeploymentisscriptedthough,itshouldn’tbehardtocreateandconfigureanewserver.
Imagineyouwereusingthefollowingheattemplate:
heat_template_version:2014-10-16
description:Simpletemplatetodeployasinglecomputeinstance
parameters:
flavor_size:
type:string
label:FlavorSize
description:Thesizefotheflavortobeused
resources:
web_server:
type:OS::Nova::Server
properties:
image:CentOS6_64
flavor:{get_param:flavor_size}
Savingthefiletotest.yamlandrunningthefollowingcommandwouldcreatethesmallestserverpossible:
$heatstack-createtest_stack-ftest.yaml-P"flavor_size=m1.tiny"
Toscalethisverticallytoalargerinstanceyoucouldsimplycall:
$heatstack-updatetest_stack-ftest.yaml-P"flavor_size=m1.large"
HeatwouldthenhandlethecallintoNovatoincreasethesizeofthisinstanceandyourapplicationwouldhavethatmuchmorehorsepowertorunwith.Horizontalscalingisalittlemorecomplicated.
Horizontalscalinginvolvesaddingextraserverstoanapplication,usuallybehindaloadbalancerthathandlestheinitialrequestandroutesittoanindividualinstance.Thiscanaddthecomplexityofprovisioningandconfiguringtheloadbalanceraspartofyourdeployment,butscalinganapplicationhorizontallyusuallyprovidesmuchgreatercapacity.It’snotuncommontorunhundredsofserversdedicatedtoaspecificpurposeinahorizontallyscaledapplication.Thelimitofaverticallyscaledapplicationmeanwhileisthemaximumsizeofasingle
instance/flavor.Verticallyscaledapplicationsalsomissoutontheresiliencyandmaintainabilityaddedbytheextraserversinvolved.
InChapter5wedeterminedthatboththewebtier,aswellastheAPItier,shouldbothusehorizontalscaling.Itwillprovidemuchgreatercapacity,andtheapplicationwillbenefitfromtheaddedresiliencythattheseparateserversprovide.Thatbeingsaid,it’sworthnotingthatmostofthetechniquesthatfollowcanalsobeappliedtoscalinginalimitedverticalfashion.Afterall,throwinghardwareattheproblemissometimesthefastestsolution.
LoadBalancingRevisitedChapter5discussesloadbalancingindepth.HardwaresolutionssuchasA10,softwaresolutionssuchasHAProxy,andloadbalancingasaservice(LBAAS)thoughNeutronarealloptions.Yourchoicehereaswellwillgreatlyaffectyourdeploymentsolution.
MostofthesesolutionshaveAPIsthatcanbetappedintobyeithertheorchestrationorconfigurationmanagementsolutions.Aswhenusingthirdpartysolutionsformonitoring,itmayalsobenecessarytoincludetheprovisioningandconfigurationofyourloadbalanceraspartofyourdeployment.HAProxysolutionsoftenlooklikethis,astheproxyservercansimplybeanotherVMwithinanOpenStackproject.
IfLBAASisavailableandfunctioningcorrectlyinyourOpenStackinstallation,itisagreatoption.ItiseasilyconfigurableviaHeat,and/orcanbetappeddirectlyviatheNeutronAPI.Thisisstillrelativelyimmaturetechnologythough,andformanypeople,hardwareorsoftwaresolutionsaretheonlyoption.
ThedeploymentofourdemoapplicationwillfocusonLBAASandNeutron.Astimegoeson,thissolutionisonlygoingtogetbetterandbemorewidelyavailable.Inthemeantime,ifforanyreasonyouneedtocreateyourownsolution,HAProxyisadecentchoice.Itdoesexposeasinglepointoffailure,asitgenerallyexistsonsinglemachine,butitisavailabletoeveryoneforfree,anditmakestheautomaticadditionorremovalofserversrelativelyeasy.
AnearlyinfiniteamountofinformationonhowtoinstallandconfigureHAProxyisavailableathttp://www.haproxy.org/.Assumingthatitisalreadydeployedandconfigured,thefollowingNode.jsscriptdemonstratesabasicauto-updateconceptthatcouldeliminatetheneedtoupdateyourloadbalanceraspartofyourdeployment:
#!/usr/bin/envnode
varHAProxy=require("haproxy");
varOSWrap=require("openstack-wrapper");
varFS=require("fs");
varuser='my_username';
varpass='my_password';
varpid='my_project_id';
varkurl='keystone_url';
varproxy_cfg='/etc/haproxy/haproxy.cfg';
varhaproxy=newHAProxy('optional/socket/path.sock',{});
OSWrap.getSimpleProject(user,pass,pid,kurl,function(error,project){
if(error){console.error(error);return;}
project.nova.listServers(error,server_array){
if(error){console.error(error);return;}
FS.writeFileSync('/etc/haproxy/haproxy.cfg','
listenapp*:80\n
modehttp\n
balanceroundrobin\n
optionhttpclose\n','utf8');
varip='';
for(vari=0;i<server_array.length;i++)
{
//assumingonlyonenetworkandafixedip
foreach(networkinserver_array[i].addresses)
{ip=network[0].addr;break;}
FS.appendFileSync(proxy_cfg,'server'+i+''+ip+':80\n','utf8');
}
haproxy.reload(function(error){
if(error){console.log(error);return;}
});
});
});
InstallingthisasacronjobontheproxyserverwouldcauseittocontactyourOpenStackinstallationeveryXminutes,retrievealistofservers,writethemtotheconfigurationfile,andhotreloadtheproxywiththenewconfigurationfile.
Withthedecisiononloadbalancingoutoftheway,andeitherhandledviaLBAAS/NeutronorautomaticallyviaHAProxy,wecanmoveforwardandlookmorecloselyatsomeoptionsforprogrammaticallyscalingourapplication.
ScalingwithHeatandResourceGroupsAsopposedtodefiningeveryserverasanindividualentry,HeattemplatesallowyoutospecifyaResourceGroupandthenumberofduplicatesthatyouwouldlikeofthatresource.ReworkingourHeattemplatefromearlier,weget:
heat_template_version:2014-10-16
description:Templatetomulitpleserversofthesamekind
parameters:
server_count:
type:number
label:ServerCount
description:Thenumberofserversdodeploy
resources:
tiny_cluster:
type:OS::Heat::ResourceGroup
properties:
count:{get_param:server_count}
resource_def:
type:OS::Nova::Server
properties:
image:CentOS6_64
flavor:m1.tiny
user_data_format:RAW
user_data:
runcmd:
-yuminstall–qygit
-yuminstall–qynpm
-gitclonehttps:/github.com/folder/package.git/var/usr/share/app
-node/usr/share/app/server.js
-echo"Youjustinstalledandstartedanodeapp!"
Savingthefiletogroup.yamlandrunningthefollowingcommandwouldcreatethesmallestserverpossible:
$heatstack-creategroup_stack-fgroup.yaml-P"server_count=2"
Toincreasethenumberofserversinthisstacktofouryoucouldcall:
$heatstack-updategroup_stack-fgroup.yaml-P"server_count=4"
Usingthistechnique,differenttypesofResourceGroupscanbedefinedforeachtierofthedemoapplicationandeachResourceGroupcanbescaledindependently.Thisconceptprovidesadeploymentsolutionthatcoverseverythingexceptloadbalancing,monitoring,andelasticity.ThesethingshavebeenleftoutbecauseitisquitepossibleoneormoreoftheminyourapplicationwillhavetobehandledoutsidetherealmofOpenStack.Thegoodnewsisthatifyoufindyourselfinthissituation,HeatandResourceGroupscanstillbeusedinthisfashionaspartofabroaderdeploymentscript.Theothertechnologiesdiscussedinthischapter,suchasanexternalA10,canthenbeincludedinthatscripttofilloutthedeploymentsolution.
Ifyouareluckythough,andLBAASthroughNeutronisavailablealongwithCeilometeralerts,youhaveacompletedeploymentsolutionforelasticscalingthatfitsneatlywithinaHeattemplate.
PuttingItAllTogetherwithHeat,Ceilometer,andAutoScalingGroupsBeforewegointothefinalexampleanddemonstrateacompletesolutionfordeployinganelasticapplication,let’sreviewthechoicesthathavebeenmadeinthischapterregardinghowthedemoapplicationwillbedeployed.
Virtualization—VirtualMachinesforallthreetiers
Orchestration—Heat
ConfigurationManagement—Cloud-Init/user_data
Monitoring—Ceilometer
Scaling—Horizontalforallthreetiers
Elasticity—ViableforthewebandAPItiers
LoadBalancing—Neutron/LBAAS
Withthatinmindlet’slookatanotherexample.Thisonewillconsistoftwodifferentfiles.Thefirst,willdescribeasingleserverasaresource.Forthesecond,aparentfilewillusethisresourceaspartofanauto-scalinggroup:
heat_template_version:2014-10-16
description:SimpleWebServer+LoadBalancerMember
parameters:
network:
type:string
description:thenetworkalloftheserverswilluse
pool_id:
type:string
description:theloadbalancerpool
parent_stack_id:
type:string
description:theIDofthecallingstack
resources:
server:
type:OS::Nova::Server
properties:
flavor:m1.tiny
image:cirros-0.3.4-x86_64-uec
metadata:{"metering.stack":{get_param:parent_stack_id}}
networks:[{network:{get_param:network}}]
user_data_format:RAW
user_data:|
#!/bin/sh
#AtinyHTTPserverthatrespondswiththeIPaddressoftheserver.
IP='ip-finetaddr|grepinet|grep-v127.0.0.1|awk'{print$2}'
|cut-d/-f1'
LENGTH='echox$IP|wc-c'
cat>/tmp/http-response<<EOF
HTTP/1.0200OK
Content-Type:text/plain
Content-Length:$LENGTH
$IP
EOF
unix2dos/tmp/http-response
nohupnc-p80-s$IP-n-lk-ecat/tmp/http-response&
#now,let'saddsomeloadtotriggerCPUalarms
#findanumberofsecondstoburnbaseduponIPaddress
#thiswaydifferentoneswillburnCPUatdifferenttimes
#60,180,300,420secondsatatime
#thensleep120s
SECONDS='echo$IP|awk-F.'{print60+$4%4*120}''
cat>/tmp/load.sh<<EOF
#!/bin/sh
while[1]
do
if["0"-eq\'echo|awk'{printsystime()%$SECONDS}'\'];then
sleep120
fi
done
EOF
chmod777/tmp/load.sh
#cirrosdoessomethingweirdto/bin/shsoweneedsomethingelseto
runus
#later-andthereisno"at"
nohupwatch-t/tmp/load.sh&
member:
type:OS::Neutron::PoolMember
properties:
pool_id:{get_param:pool_id}
address:{get_attr:[server,first_address]}
protocol_port:80
Let’scallthisfileweb-server.yaml.Lookingatitbriefly,ittakesparametersthatdescribewhichnetworkandloadbalancingpooltouseaswellasaparametertodefinetheparentstackthisserverwillexiston.Alloftheseparameterswillactuallybesuppliedbytheparenttemplate,whichwewilllookatmomentarily.Firstthough,it’simportanttogooverwhat’sbeingconfiguredinuser_data.AspartoftheCloud-Init,thisserverwillbeconfiguredtorunalittleHTTPservicethatjustreturnstheprivateIPoftheinstance.So,whenyoucallfromtheloadbalancerVIP,youcanseewhichinstancehandledtherequest.EachinstancealsorunsabackgroundprocessthatalternatelyburnsCPUforanywherefrom60-480seconds,dependingonitsIPaddress,andthensleepsfor120seconds.Thissimulatesloadandtriggerstheelasticscalingupanddown.
Asforthemain/parentheattemplate,thatwouldlooksomethinglikethis:
heat_template_version:2014-10-16
description:AutoScalingWebApplication
parameters:
network:
type:string
description:thenetworkalloftheserverswilluse
subnet_id:
type:string
description:theloadbalancersubnet
external_network_id:
type:string
description:theUUIDoftheexternalNeutronnetwork
resources:
web_server_group:
type:OS::Heat::AutoScalingGroup
properties:
min_size:2
max_size:5
resource:
type:web-server.yaml
properties:
pool_id:{get_resource:pool}
network:{get_param:network}
parent_stack_id:{get_param:"OS::stack_id"}
scaleup_policy:
type:OS::Heat::ScalingPolicy
properties:
adjustment_type:change_in_capacity
auto_scaling_group_id:{get_resource:web_server_group}
cooldown:30
scaling_adjustment:1
scaledown_policy:
type:OS::Heat::ScalingPolicy
properties:
adjustment_type:change_in_capacity
auto_scaling_group_id:{get_resource:web_server_group}
cooldown:30
scaling_adjustment:-1
cpu_alarm_high:
type:OS::Ceilometer::Alarm
properties:
description:IftheavgCPU>40%for30secondsthenscaleup
meter_name:cpu_util
statistic:avg
period:30
evaluation_periods:1
threshold:40
alarm_actions:
-{get_attr:[scaleup_policy,alarm_url]}
matching_metadata:{'metadata.user_metadata.stack':{get_param:
"OS::stack_id"}}
comparison_operator:gt
cpu_alarm_low:
type:OS::Ceilometer::Alarm
properties:
description:IftheavgCPU<15%for90secondsthenscaledown
meter_name:cpu_util
statistic:avg
period:90
evaluation_periods:1
threshold:15
alarm_actions:
-{get_attr:[scaledown_policy,alarm_url]}
matching_metadata:{'metadata.user_metadata.stack':{get_param:
"OS::stack_id"}}
comparison_operator:lt
monitor:
type:OS::Neutron::HealthMonitor
properties:
type:TCP
delay:5
max_retries:5
timeout:5
pool:
type:OS::Neutron::Pool
properties:
protocol:HTTP
monitors:[{get_resource:monitor}]
subnet_id:{get_param:subnet_id}
lb_method:ROUND_ROBIN
vip:
protocol_port:80
lb:
type:OS::Neutron::LoadBalancer
properties:
protocol_port:80
pool_id:{get_resource:pool}
lb_floating:
type:OS::Neutron::FloatingIP
properties:
floating_network_id:{get_param:external_network_id}
port_id:{get_attr:[pool,vip,port_id]}
outputs:
scale_up_url:
description:>
Invokethescale-upoperationbydoinganHTTPPOSTtothis
URL;
value:{get_attr:[scaleup_policy,alarm_url]}
scale_dn_url:
description:>
Invokethescale-downoperationbydoinganHTTPPOSTto
thisURL;
value:{get_attr:[scaledown_policy,alarm_url]}
pool_ip_address:
value:{get_attr:[pool,vip,address]}
description:TheIPaddressoftheloadbalancingpool
website_url:
value:
str_replace:
template:http://host/
params:
host:{get_attr:[lb_floating,floating_ip_address]}
description:>
ThisURListhe"external"loadbalancedurl
Let’scallthisfilefinal.yaml.Itcontainsallofthenecessaryinstructionstocreatemultipleserversasdefinedbytheweb-server.yamlfile.Itwillmaintainaminimumoftwooftheseservers,andscaleuptoamaximumoffiveasdefinedbytheminandmaxsizeoftheauto-scalinggroup.ItalsoimplementstheCeilometeralarmsthattriggerscalingupwhenaCPUaveragegoesabove40percentfor30seconds,triggerscalingdownwhenCPUaveragegoesbelow15percentfor90seconds,andappliesthesealarmstothesevergroupaspolicies.
Tocreate/updateastackwiththistemplateyouwouldfirstneedtomanuallycreateanetwork,subnet,androuterfortheservers/loadbalancer.Youwouldthenpassthesevaluesinasparameterslikethis:
$heatstack-create-ffinal.yaml-P"network=web-net;subnet_id=$subnet_id;
external_network_id=$public_net_id"autoscale;
Thatshouldoutputanumberofthingsincludingthewebaddressoftheloadbalancerthatwillroundrobintothetwowebservers.HittingthatURLrepeatedlyshoulddisplaythevariousIPaddressesoftheprovisionedserversinroundrobinfashion.Afterashortperiodoftime,newserversshouldbeaddedandnewaddresseswillappear,thenasloaddecreasestheyshoulddisappear.Ifyouwanttotrythisforyourself,thesetemplatesalongwithascripttocreatethenecessarynetworksareavailableinthefinal_deploymentfolderoftheGitHubrepoforthisbookat:https://github.com/johnbelamaric/openstack-appdev-book.
Tousethismethodtodeployourdemoapplication,wewoulduseacombinationoftwoAutoScalingGroups(oneforthewebandonefortheAPItier),andaResourceGroupfortheMySQLtier.Theuser_dataportionofeachgroupwouldthencontaintheconfigurationcommandsforthatservertypeandeachgroupcouldbescaledindependently.Scriptslikethisgenerallytakealotlongertocreatethanitwouldtomanuallyprovisionandconfigureanenvironmentonetime.Hopefullythough,youcannowseetheadvantagehereofbeingabletoprogrammaticallyrecreateeverythinganapplicationneedsatthepushofabutton.Ifaprojectwastobewipedout,oradev/testareaneeded,anotherenvironmentcouldbeinstantlycreatedandputtowork.
Thisisnotaonesizefitsallsolution.Thechoicesmadewereallbasedonpersonalpreference,easeofuse,andtherequirementsofthedemoapplicationandenvironment.Therearemanyotheroptions,andwhendeployingyourowncloudapplication,yourfinalsolutionwilllikelyinvolvedifferentchoicesandlookvastlydifferent.Thisistobeexpected.Hopefullythough,younowhavethebasicknowledgeandskillstomakethosechoices,andscriptthedeploymentofyourowncloudbasedapplication.
UPDATINGANDPATCHINGTherearetimeswhenyouwilldeployanapplicationandyourworkisessentiallydone.Applicationswilloftenkeepthemselvesuptodateviaautomaticupdate.Modernbrowsersareagoodexampleofthis.Manyofthemsimplycheckforanupdateonstartup,downloadthepatchandapplyitbeforestarting.Oftenthough,applicationshaveanumberofcomponentsthatneedtobemanuallyupdatedquitefrequently.ThejQuerylibrarywithinmanywebbasedapplicationisagoodexampleofthis.Theserversthemselvesmayalsoneedtobepatched.Securityupdatesforexploits,andfixesthatimproveperformancearebothcommonplaceinanycompany.
Atfirst,itmayseemlikethetraditionalmethodsshouldsimplybeemployedhere,andtheycanbe.Manuallyupdating,andrebootingserverswilldefinitelypatchthem.Anystandardmethodologyforpromotingcodechangeswillalsowork.Oncedeployed,anOpenStackbackedapplicationiscomparableforthemostparttoonelivinginahardwareonlyworld.
Theminimalcostofdeployingnewservers,though,andtheabilitytoprogrammaticallyscriptnetworkingallowsforsomeuniquewayshandleon-goingmaintenance.
PatchingOptionsIfyouworkwithinalargercorporatestructure,it’slikelythatsomekindofpatchingmechanismalreadyexistsforyou.Allowingevenafewmachinesonanetworktobecompromisedduetomissingsecurityupdatesisarealworldproblem.Evenifyouareinthissituationhowever,it’sunlikelythatallofyourpatchingwillbetakencareofbythismeans.Patchesforspecializedsoftwareforyourapplicationandupdatesthatdon’taddressaperformanceorsecurityissueareoftenstilltheresponsibilityofdevops.
Oneoptionforpatchingdependsonyourconfigurationmanagementchoice.IfyouoptedtousethirdpartytoolslikePuppetorChef,theircentralizedadministrativefeaturescanmakepatchingabreeze.Theybothallowforscheduledupdates,andaswasmentionedearlier,remoteexecution.Ifyoudesignedyourapplicationwithmultipleregionsormultipleload-balancedclustersasdiscussedinChapter5,itshouldbeasimplemattertopatch/rebootoneregion/clusteratatimeandavoidanydowntime.
Ansible’sremoteexecutionabilitycanbeasolidsolutionhereaswell.Yourapplicationwilllikelycontainmanysmallservers.YoucangrouptheseintoarbitrarysetsinanAnsibleconfigurationfileandthenexecuteupdatecommandsononegroupatatime.Thisisagoodwaytoavoidbothdowntimeandtheneedtore-provisionalltogether.
OpenStackdoesn’tprovideanyspecificfirstpartytoolsforpatching.Instead,thecomponentswehavealreadydiscussedcanbeusedandGlance/Imagesare
anothercommonavenueforpatching.Thoughstillnotrecommendedasacompletesolution,updatedimagesarefrequentlyavailableandcanbeusedtohandlebasicOSupdates.Tobringasystemtocompliance,anapplicationcansimplybere-deployedinpartorintotalwiththesenewimages.
ThiswouldbeagreatreasontoincludetheimageasaparameterinyourHeattemplate.Runningthefollowingcommandcouldthenupdatealloftheserverswiththisnewimage:
$heatstack-updatetest_stack-ftest.yaml-P"image=CentOS64-Update2"
Ofcoursethismayre-provisionallofyourserversatonce,soevenifyoudon’thavemultiplelogicalclusters,itmightbeusefultosplityourserversintodifferentResourceGroupssolelyforpatchingpurposes.Thiswayit’spossibletochangetheimageonjustonegroupatatime:
$heatstack-updatetest_stack-ftest.yaml-P"group1_image=CentOS
64-Update2;group2_image=CentOS64-Update3"
CI/CDinanOpenStackWorldNomoderntextfordevelopers(ordevops)wouldbecompletewithoutatleastsomementionofagilemethodology.Itstenantsarepervasiveinthemodernworkplaceandtechnicalcommunity.Theneedtofrequentlyreleaseupdates,toA/Btest,andtoprogrammaticallytestthecodebaseofanapplicationaspartofadeploymentareallchallengingaspectsofCI/CD(ContinuousIntegration/ContinuousDelivery)andagilephilosophyinanytypeofenvironment.Fortunately,withOpenStack,yourdeploymentsolutioncanactuallyprovidesomeuniquesolutionstothesechallenges.Let’slookattheseoneatatime.
Thefirstrequirementhereisforfrequentreleases.Ifyouaremigratinganapplicationtothecloud,theninalllikelihoodyourcurrentmechanismforupdatingproductioncodewillcontinuetowork.Thiscanbehandledinallofthesamemannersdiscussedpreviouslyforpatching.Onceanapplicationhaspassedallofitstests,itisajustamatterofcontactinganyofOpenStack’sAPIssuchasHeatorNovatoprovisionnewserversandteardowntheoldones.Ifcontainersareyourvirtualizationtechnologyofchoice,youwillalmostcertainlybedeployingallofyourchangesinthismanner.Ifnot,thenAnsibleorsimilartechnologycanalsobeusedremotelyexecutecommandsonbatchesofserverstoupdatecodefromacentralrepository.
OpenStackpresentsthenextchallengewithmoreintriguingsolutions.TheneedtoA/Btestcanbeintegraltomakinginformedchoicesinanapplication’sevolution.Traditionalmethodsofhandlingthisincludebuckets,whereanapplicationrunsseveraldifferentversionsonthesamemachine,orcodebasedsolutionsthatprogrammaticallypresentdifferentoptionstodifferentusers.Theabilitytoactuallyduplicateportionsofyourproductionenvironment,however,
canallowyoutoquicklydeploymultipleversionsoftheapplicationsimultaneously.ThisprovidesacompleteseparationofthecodebaseAfromcodebaseB,allowingperformancecomparisonsandpreventingonecodebasefromcrashingtheother.Oncethetestisconcluded,AorBcanthenbetorndownandthoseresourcesdedicatedtootherprojects.
Thelastitem,applicationtesting,whichusuallyincludesunitaswellasfunctionaltests,alsohassomeuniquesolutionsinacloud-basedworld.Unittestscanberunjustaboutanywhere,butfunctionaltestsoftenrequireafullyfunctionalenvironment.Thisisanotheropportunitytouseyourdeploymentscripttocreateanotherworkingenvironmenttorunthesetestsin.It’sreasonabletopictureasystemwhereacommithooksetsoffacalltocreateanenvironment,testsarerun,resultsarepublished,andtheenvironmentisthentorndown.Usingyourdeploymentscript,template,orwhatevertechnologychosen,ensuresthatthistestenvironmentcanperfectlymimictheproductionenvironmentandisneveraffectedbyprevioustests.It’sevenpossibleinthisscenarioformultipletestenvironmentstoberunningmultipleversionsoftheapplicationanditstests,asopposedtowaitinginaqueueforasinglededicatedtestenvironment.
Ingeneral,OpenStackshouldmakebothCI/CDandpatchingmucheasier,oratleastpresentawholehostofsolutionsthatwereunavailablebefore.Manyofthesesolutionsaren’tspecifictoOpenStackandareavailablewithinanycloudenvironment.However,yourdeploymentsolutionwilllikelybeveryOpenStackspecific,andwillimpacthowyougoaboutpatchingandupdatingyourapplication/environment.Itisforthatreasonthatthischapterisconcludedwiththisdiscussiononmaintenance.Itisonelastthingtoconsiderbeforesettlingonafinaldeploymentsolution.
SUMMARYIfyouhavebeenintheroleofadeveloperorasystemadministrator,makingallofthenecessarychoicesandscriptingthemcanbeabigshift.Bridgingthesetwoworldscomeswithalotofbenefitthough,anditislikelytobethewaythingsmovegoingforward,sincethesebenefitsoftenariseintheformofhugecostsavings.Thereiscurrentdemandfordevopsexpertiseforthisreason.Whilethedeploymentofcontainersandthird-partydevelopmentwillcontinuetoevolve,thefundamentalconceptofprovisioningyourhardwareandnetworking,alongwithyoursoftware,isheretostayinoneformoranother.ThefactthatOpenStacktriestoprovideanopen-endedplatformfortheseconceptstoflourish,makesitagreatchoiceregardlessofwhichtechnologiesendupwinningintheend.
BOOKWRAPUPInthisbookwehavediscussedexactlywhatOpenStackisandwhatitprovides.ThevariouscomponentsandprojectsthatcomprisethebulkofOpenStackhavebeendescribed.Examplesofhowtocreateandimproveapplicationsusingsomeoftheuniqueaspectsofthecloudhavebeencovered.Wehavealsoprovidedoptionsfordeployingandmaintainingtheseapplications,allofwhichwillhelpyougetstartedusingOpenStack.
OneofthegreatjoysofworkingwithinanOpenStackbackedenvironmentistheabilitytoexperimentwithoutconsequence.Youcanlockupaserverandrebootitfromawebsitewithoutcallingdowntotheserverroom.Youcanallocateandde-allocateassetslikedrivespace,IPaddressesanddatabaseswithoutthefrustrationofservicetickets.Evenmisconfiguringaservertothepointwhereitisunusable,canbefixedbydeletingandre-provisioningitinseconds.Thiskindofself-serviceinfrastructureisattheheartofthedevopsmovementandmakeslearningOpenStackfunandexciting.Itcanalsomakeitalittleoverwhelming.
ThesheerbreadthofwhatcanbeaccomplishedusingOpenStackisabitdaunting.It’smorethanjustanotherprogramtouseoranotherlanguagewithyetanotherwayofwritingifthenstatements.OpenStackandothercloud-basedsolutionsrepresentafundamentalshiftinhowthewebiscreated,andhowmodernweb-basedapplicationsaredesigned.Itrequiresacompletelynewskillsetaswellastheabilitytothinkofpreviouslyphysicalobjectslikeservers,andnetworkingequipmentasobjectsinasoftwareprogram.Eventhenamesofthesethingsthemselvescangetoverwhelming.SortingouttheNova’s,Neutrons,Kilos,andKubernetestakesbothtimeanddedicationaswellassomeinterestinthesubject.
Forsome,thismaycomenaturally,butformostofusittakesalotofexperimentation,failure,andwell…morefailure.Masterycomeswithitsownrewards,andinthecaseofOpenStack,itcanallowyoutodothingsthatyouhavewantedtodoforyearsandgiveyoucontroloveryourenvironmentinawaythatyouhaveneverhadbefore.
Inadditiontothisbook,thereareanumberofresourcestohelpyougainthismastery.Firstandforemost,thewebisfulloftutorials,blogs,andAPIdocumentationforOpenStack.Somesitesyoumightfindusefulinyourjourney:
https://www.openstack.org/:ThecentralhubforallthingsOpenStack,andworthexploringevenifyou’renotlookingforananswertoaspecificquestion.
http://developer.openstack.org/api-ref.html:OneofseveralAPIreferencesavailable.Italwaysseemstobemissingafewthings,butisupdatedfrequentlyandisprobablyyourbestbetforAPIdocumentationandexamples.
https://developer.rackspace.com/blog/:RackspacecontinuestoprovidegreatuptodatetutorialsandinterestingdiscussionsonalltopicsOpenStack.
https://wiki.openstack.org:Coversgreatdescriptionsofallofthemajor
projects,andisagoodplacetostartifyouwanttodigdeeperintoanyindividualcomponent.
Ifyouwanttogobeyondtheweb,moreandmoreclassesandphysicalworldresourcesarebecomingavailableasOpenStackadoptionincreases.AnothermajoravenuetoincreaseyourOpenStackknowledgeandexpertisemightbeoneofthesemi-annualconferencesheldallovertheworld.Youcanseewherethesearebeingheldat:https://www.openstack.org/summit/.
SharingyourexperienceswithOpenStackandparticipatinginthecommunityisalsoagreatgatewayofactuallycontributingtoOpenStack.Thiscanbeassimpleasprovidingdocumentationonamissingmethodorvalue,orascomplexasprovidingapatchforthenextmajorrelease.Exactlyhowmuchyouwanttogetinvolvedisuptoyou,butdoingsocanberewardingandisanexcitingpartofwhatitmeanstoutilizeopensourcesoftware.
Intheend,OpenStackisaboutchoice:thechoiceofhowtoimplementit,thechoiceofhowtouseit,andthechoiceofhowtoparticipateinitslifecycle.This,morethananythingelse,iswhatmakesOpenStackauniqueofferinginasurprisinglycrowdedfield.NowgoanduseOpenStacktobuildthenextgreatsuccessstory!
OpenStack®CloudApplicationDevelopment
ScottAdkinsJohnBelamaricVincentGierschDenysMakogonJasonRobinson
OpenStack®CloudApplicationDevelopment
PublishedbyJohnWiley&Sons,Inc.10475CrosspointBoulevardIndianapolis,IN46256www.wiley.com
Copyright©2016byJohnWiley&Sons,Inc.,Indianapolis,Indiana
PublishedsimultaneouslyinCanada
ISBN:978-1-119-19431-6
ISBN:978-1-119-23964-2(ebk)
ISBN:978-1-119-19434-7(ebk)
Nopartofthispublicationmaybereproduced,storedinaretrievalsystemortransmittedinanyformorbyanymeans,electronic,mechanical,photocopying,recording,scanningorotherwise,exceptaspermittedunderSections107or108ofthe1976UnitedStatesCopyrightAct,withouteitherthepriorwrittenpermissionofthePublisher,orauthorizationthroughpaymentoftheappropriateper-copyfeetotheCopyrightClearanceCenter,222RosewoodDrive,Danvers,MA01923,(978)750-8400,fax(978)646-8600.RequeststothePublisherforpermissionshouldbeaddressedtothePermissionsDepartment,JohnWiley&Sons,Inc.,111RiverStreet,Hoboken,NJ07030,(201)748-6011,fax(201)748-6008,oronlineathttp://www.wiley.com/go/permissions.
LimitofLiability/DisclaimerofWarranty:Thepublisherandtheauthormakenorepresentationsorwarrantieswithrespecttotheaccuracyorcompletenessofthecontentsofthisworkandspecificallydisclaimallwarranties,includingwithoutlimitationwarrantiesoffitnessforaparticularpurpose.Nowarrantymaybecreatedorextendedbysalesorpromotionalmaterials.Theadviceandstrategiescontainedhereinmaynotbesuitableforeverysituation.Thisworkissoldwiththeunderstandingthatthepublisherisnotengagedinrenderinglegal,accounting,orotherprofessionalservices.Ifprofessionalassistanceisrequired,theservicesofacompetentprofessionalpersonshouldbesought.Neitherthepublishernortheauthorshallbeliablefordamagesarisingherefrom.ThefactthatanorganizationorWebsiteisreferredtointhisworkasacitationand/orapotentialsourceoffurtherinformationdoesnotmeanthattheauthororthepublisherendorsestheinformationtheorganizationorWebsitemayprovideorrecommendationsitmaymake.Further,readersshouldbeawarethatInternetWebsiteslistedinthisworkmayhavechangedordisappearedbetweenwhenthisworkwaswrittenandwhenitisread.
ForgeneralinformationonourotherproductsandservicespleasecontactourCustomerCareDepartmentwithintheUnitedStatesat(877)762-2974,outsidetheUnitedStatesat(317)572-3993orfax(317)572-4002.
Wileypublishesinavarietyofprintandelectronicformatsandbyprint-on-demand.Somematerialincludedwithstandardprintversionsofthisbookmaynotbeincludedine-booksorinprint-on-demand.IfthisbookreferstomediasuchasaCDorDVDthatisnotincludedintheversionyoupurchased,youmaydownloadthismaterialathttp://booksupport.wiley.com.FormoreinformationaboutWileyproducts,visitwww.wiley.com.
LibraryofCongressControlNumber:2015953113
Trademarks:Wiley,theWileylogo,Wrox,theWroxlogo,ProgrammertoProgrammer,andrelatedtradedressaretrademarksorregisteredtrademarksofJohnWiley&Sons,Inc.and/oritsaffiliates,intheUnitedStatesandothercountries,andmaynotbeusedwithoutwrittenpermission.OpenStackisaregisteredtrademarkofOpenStackFoundation.Allothertrademarksarethepropertyoftheirrespectiveowners.JohnWiley&Sons,Inc.,isnotassociatedwithanyproductorvendormentionedinthisbook.
ABOUTTHEAUTHORS
SCOTTADKINSisatechnicalleadfortheCloudOperationsteamatComcast.HehelpstheteamdeploynewinternalOpenStackenvironments,aswellashelpingonboardotherteamsintothecloud.Inparticular,ScotthelpsnewcomerstothecloudunderstandthepetversuscattlemodelandhowtheirapplicationscanbeadjustedtorunmoreeffectivelyintheOpenStackcloudenvironment.ScotthasbeenaUNIXandLinuxSystemsAdministratorformorethan30years.PriortohisworkatComcast,hewasatechnicalleadatSavvisCommunicationsfortheUNIXteam.ScottlivesinLeesburg,Virginiawithhiswifeandfourchildren.
JOHNBELAMARICisasoftwareandsystemsarchitectwithnearly20yearsofsoftwaredesignanddevelopmentexperience.Hiscurrentfocusisoncloudnetworkautomation.HeisakeyarchitectoftheInfobloxCloudproducts,concentratingonOpenStackintegrationanddevelopment.HebringstothishisexperienceastheleadarchitectfortheInfobloxNetworkAutomationproductline,alongwithawealthofnetworking,networkmanagement,software,andproductdesignknowledge.HeisacontributortoboththeOpenStackNeutronandDesignateprojects.HelivesinBethesda,MarylandwithhiswifeRobinandtwochildren,OwenandAudrey.
VINCENTGIERSCHistheco-founderandCTOofFlat.io,wherehemainlyworksontheautomationofdeploymentandscalingoftheSaaSapplication.Priortothat,attheUniversityofKentandinpartnershipwithJANET,hedesignedandimplementedthesupportoftheIETFABFAB(ApplicationBridgingforFederatedAccessBeyondWeb)inOpenStackKeystonetoprovideanon-webfederatedauthentication.RecentlyheworkedasanR&DPlatformEngineeratOVH.com,developingaDockerhostingplatformbasedonOpenStack.HeisfromNantes,France.
DENYSMAKOGONisadeveloperandsoftwarearchitectofcloudplatforms,mainlyfocusedondevelopinganddesigningplatformandSoftware-as-a-ServiceapplicationsforOpenStack.HeisaleadsoftwaredeveloperforGigaspaces,concentratingonCloudifyproductdevelopmentalongwithbringingwell-designedandproduction-readyintegrationwithVMwarecloudplatforms,includingvCloudAir.HeisacontributortotheOpenStackDBaaSplatformandOpenStackCloudValidationopensourceframework.HelivesinKharkiv,Ukraine.
JASONROBINSONisaseniorplatformdeveloperatGoDaddy.HehelpsteamstransitiontraditionalapplicationstotheirinternalOpenStackcloudwithafocusonorchestrationandresiliency.PriortohisworkwithOpenStack,hewasanarchitectonGoDaddy'scloudstorageproductandaprincipaldeveloperoftheirwebmailoffering.Jasonhasbeenworkingasaprofessionalwebdeveloperfor18years,andinadditiontoservingasaleadengineerfortech-centeredcompanieslikeGoDaddy,Verizon,andGTE,hehasdoneextensiveworkinthefieldsofe-commerce,telemedicine,andstreamingmedia.Whennotpursuingtheperfectlyscalableapplication,Jasonisanavidrunner,maker,amateurphilosopher,andmostrecentlyafather.
ABOUTTHETECHNICALEDITORSCHRISDENT,SeniorSoftwareEngineeratRedHat,primarilyfocusesonimproving,integrating,andtestingOpenStack.PriortoRedHatheworkedasafreelanceconsultantdesigninganddevelopingHTTPAPIsforcollaborativedocumentsystems.
LARSBUTLERisacoreengineerforZeroVMandledtheproject'sminidesignsummitatOpenStackSummitAtlanta.HispreviousF/OSSworkincludesOpenQuakeEngine,ascalabledistributedcalculationengineforcomputingglobalearthquakehazardandrisk,developedincollaborationwiththeSwissSeismologicalService.
JOETALERICO,PerformanceEngineeratRedHat,isaseasonedSeniorComputerEngineerexperiencedinintegratingleadingedgetechnologiesintoexistinginfrastructures.HehasdevelopedsolutionsandautomationframeworksaroundtechnologiesrangingfromCloud,Virtualization,Storage,EndUserComputing,UnifiedCommunications,Datacenter,IPTV,andAndroid.
CREDITSPROJECTEDITORCharlotteKughen
TECHNICALEDITORSChrisDent,LarsButler,JoeTalerico
PRODUCTIONEDITORChristineO'Connor
COPYEDITORChristinaRudloff
MANAGEROFCONTENTDEVELOPMENT&ASSEMBLYMaryBethWakefield
PRODUCTIONMANAGERKathleenWisor
MARKETINGDIRECTORDavidMayhew
PROFESSIONALTECHNOLOGY&STRATEGYDIRECTORBarryPruett
BUSINESSMANAGERAmyKnies
ASSOCIATEPUBLISHERJimMinatel
PROJECTCOORDINATOR,COVERBrentSavage
PROOFREADERChristinaRudloff
INDEXERRobertSwanson
COVERDESIGNERWiley
COVERIMAGEAlexandraLande/Shutterstock
ACKNOWLEDGMENTSIwouldliketothankmywifeandchildrenfortheirpatienceandsupportwhileIworkedonthisproject.IwouldliketoalsothanktheOpenStackcommunityforeverythingtheydotobuilduponandsupporttheopensourcecloud.WithouttheOpenStackcommunity,wewouldnothavethecloudplatformwehavetoday!
—SCOTTADKINS
Iwouldliketothankmywifeandchildrenfortheirsupportandencouragementthroughoutthisproject.
—JOHNBELAMARIC
Iwouldliketothanktheentireteam,whohelpedmetocompletethisprojectandgavetheappropriatelevelofsupport,andmyfamily,whohelpedmetostayfocusedonthisbook.
—DENYSMAKOGON
IwouldliketothankmywifeTarawhotookcareofallofuswhileIwasworkingonthisbook,mybrotherforgivingmemyfirstcomputerand,ofcourse,myparents,whosupportedmeevenwhenIdecidedtopursueaphilosophydegree(everyparent'sworstnightmare).
—JASONROBINSON
WILEYENDUSERLICENSEAGREEMENTGotowww.wiley.com/go/eulatoaccessWiley’sebookEULA.