Lessons from Building OpenStack Public Cloud

写上你的文字你的文字

OpenStack China Tour #2 Shenzhen

主办方：中国 OpenStack 用户组 & CSDNOrganizer: COSUG & CSDN

关注 COSUG 官方微博 @OpenStack

OpenStack 中国行（北京）日程安排Before14:00 签到

14:00-14:40 基于 OpenStack建设公有云平台的开发实践程辉14:40-15:20 OpenStack在香港骆文钟15:20-15:30 Break

15:30-16:10 OpenStack中的块设备存储服务 Cinder 朱荣泽16:10-16:40 Juju – make your life easier in the cloudOpenStack- 候正鹏16:40-16:50 Break

16:50-17:20 企业私有云基础设施最佳选择GeorgeWang

17:20-17:50 Swift架构与实践杨雨

在这里写上你的标题

副标题文字副标题文字

作者名字 / 日期

标题文字标题文字副标题副标题副标题

作者 / 日期

Building OpenStack Public Cloud

For OpenStack China Tour Shenzhen

Hui Chengfreedomhui@gmail.com | freedomhui.com

CommunityManagerofCOSUGTechnicalManagerinSina.com

2012/9/21

Content

OpenStack in Sina Integration Extension NewServices

Sina Contribution to OpenStack community

03 OpenStack in Sina

First and most popular PaaS cloud in China, launched in 2009Support PHP, Python and Java runtime

About SinaCloud

OpenStack based public IaaS cloud

About SinaCloud

OpenStack based public IaaS cloud

SaaS cloud based on SAE tech.Design for the masses1-Click buy and install apps

About SinaCloud

(SinaCloudStore)

03 OpenStack in Sina

Sina Web Services(SWS)

To salute Amazon Web Services

It's an validated and successful cloud business model.

CustomersGame makers on Weibo platformSina PartnersCommon users out of Sina

VisionBuild an open and full-stack cloud ecosystem,

integrated IaaS, PaaS and SaaS platform.

Cloud Bridge

SWS Deployment

nova-computenova-network

nova-api

nova-computenova-network

glance

dashboard

keystone

schedule

RabbitMySQL

Sina SSO

SWS Deploy Stack

Dell R510

Ubuntu 12.04

OpenStack

LocalVolume

Security Policy

Nova Network

NetworkingisthebiggestchallengesforIaaS

NetworkTopology:

• VLAN

• FlatDHCP

• FlatDHCP&Multihost

SWS Network Topology

Network Topology (VLAN)

Drawback:• Pre-allocate network for future

projects• Hard-limit of vlan 4096• Traffic bottleneck in the gateway/NAT

Capability:• Accessibility of VMs within one tenant• Isolation of VMs from different

tenants• VM is able to access public network• VM can be accessible from public

network• Isolation between virtual network and

internal network

Network Topology(Flat)

Capability:• Accessibility of all VMs in the fixed IP

range• VM is able to access public network• VM can be accessible from public

network• Full isolation between virtual network

and internal network

Bonus:• Do not need pre-allocate for new

projects• Eliminating bottleneck between

tenants

Drawback:• Tenant isolation has gone• Traffic bottleneck still exists in NAT

Network Topology(Flat & Multihost)

Capability:• Accessibility of all VMs in the fixed IP

range• VM is able to access public network• VM can be accessible from public

network

Bonus:• Totally distributed architecture avoid

single-point failure.• Multiple gateway eliminates NAT

bottleneck• High speed between OS regions

Drawback:• Tenant isolation lessens• Need security facility(SWS-filter) to

protect intranetIf security problems were solved, this would be our best choice!

Security in OpenStack

Static filters --- L2 Filter

MAC, IP, and ARP spoofing protection Notconfigurable Definedin/etc/libvirt/nwfilter/*.xmlImplemented by ebtables ebtables-tnat--list

Security Group --- L3 Filter

Role-based firewall OnesecuritygroupisaRoleIngress filtering Targetistheinstance SourcecanbeCIDRoranothergroupImplemented by iptables Seedetails:iptables-tfilter-n-L Whitelistmechanism(ACCEPTrules)

Security Enhancement

SWS Filter

Prevent Intranet Penetration• Intranetistheinternalnetwork

outsideofOpenStackEgress filtering• Targetisinternalnetwork• SourceisinstancesinOpenStackImplementation• Whitelistmechanism(ACCEPTrules)• Onthetopofnova-filter-topForward

ChainRational• SWSfilterismanagedbycloudmanager• OnlyexplicitauthorizedpacketscanreachInternalnetworkC• PacketshouldbecontrolledwithinComputeNode

Security Enhancement

Security Group VS SWS Filter

SWS Load Balancer

Load Balance • Dispatchrequest• Supportmultipleroutingalgorithm• Healthcheck

Acceleration• Reality:narrowbandwidthbetweenISPs• BuildingfiberchannelsfromISPstopivot• Giventhesameendpointwithinuser’sISP

IPv4 Shortage• Reality:dozensofpublicIPssupport

hundredsofVMs• IPv4hasbeenexhausted• IPv6isnotrealisticyetinChina

Unicom MobileTelecom

Router

SmartDNS

DNS Acceleration Design

High speed fiber-optic

Public Network

Others ISP

L7 Load Balancer

Layer 7 Load Balancer

Consideration:1.dispatchrequestbyHostheader2.nginxmodule

L4 Load Balancer

Layer 4 Load Balancer

Consideration:1.dispatchrequestbyTCP port2.lvs+haproxy

ssh–p2000root@socket.abc.com

SWS Security Enhancement

SWS Filter

Prevent Intranet PenetrationIntranetistheinternalnetwork

outsideofOpenStack

Egress filtering• Targetisinternalnetwork• SourceisinstancesinOpenStack

Implementation Whitelistmechanism(ACCEPTrules) Onthetopofnova-filter-topForward

SWS Security Enhancement

Security Group VS SWS Filter

Object Storage – Swift Integration

Storage Firewall

SWS continuas integration

Storage Firewall

Sina Contribution - Essex

• Sina creating OpenStack community project Dough & Kanyun, to contribute metering & billing capability• Present in OpenStack Design Summit & Conference• Claim and submit dozens of blueprints in OpenStack Launchpad• Top 10 Companies by bugfixes

Sina Contribution – Folsom

zhu@zrz-dev:~/git/smaffulli/openstack-gitdm$./gitdm-l20-n</opt/stack/gitlog/all.logGrabbingchangesets...doneProcessed3081csetsfrom291developers154employersfoundAtotalof797390linesadded,412196removed(delta385194)

Rackspace

RedHat

NebulaSina

CanonicalIB

Cloudscaling

HPNicira

SolidFire

Changeset

Sina Contribution – Folsom

zhu@zrz-dev:~/git/smaffulli/openstack-gitdm$./gitdm-l20-n</opt/stack/gitlog/all.logGrabbingchangesets...doneProcessed3081csetsfrom291developers154employersfoundAtotalof797390linesadded,412196removed(delta385194)

RackspaceSina

RedHat

NebulaIn

CanonicalNTT

Employers

Sina Contribution - Stackers

• Nova——Jian Wen• Swift——Alex Yang• Quantum——Jiajun Liu• Cinder——Rongze Zhu

What's the kanyun

Monitoring tools Trackingthetenantresourceusage: CPU 、 mem 、 disk 、 networktraffic

Metering tools Datacollectionandstatistics

Kanyun: Monitoring system

Aggregator

API daemon

Compute

Responds to client request

Calculates/stores metrics

Retrieve usage info

Dashboard

Billing

https://github.com/sinacloud/kanyun (updated at 8/9)

Worker

NovaCompute

Worker

What's the kanyun

Dough:Billing system

Keep track of billing info to charge tenants Flexiblecustomizationofpaymentpolicies Howmuch/oftentochargeforresourceunit Handlesprepaidorpay-as-you-go CouponSupport

Farmer API daemon

KanyunAPI(Metering)

Subscribe orunsubscribeQuery info

Check status /Retrieve usage /

Create purchases

Dashboard

https://github.com/sinacloud/dough (updated at 8/9)

deduct

03Dashboard

SWS v1

SWS v2

SWS V3

Open API & CLIBuild an cloud ecosystem

vMotionHigh AvailabilityFault Tolerance

EBSSelf-developed SolutionOpenSouce(Gluster/Ceph/Sheepdog)

Quantum IntegrationNicira-alike product research

SWS V3

Multi-IDC SupportMulti Regions/ZonesBuild for failure

User ConsoleMore User friendly

Admin ConsoleBe able to manage resourses like usersPhysical server deployment & managementNetwork & Storage ManagementIdentity and Access Management

03Thank you, OpenStack Community and Foundation.

Weibo: @程辉freedomhui@gmail.com

Lessons from Building OpenStack Public Cloud

Documents

Transcript of Lessons from Building OpenStack Public Cloud

Building Software Systems at Google and Lessons Learned

OpenStack 101

Introducción a OpenStack Horizon€¦ · principales de OpenStack: Nova, Glance, Swift, etc. Ideal para que usuarios noveles utilicen OpenStack Como todos los componentes de OpenStack

Kolla - the new way to deploy OpenStack · Projects to Deploy OpenStack Deploy on machine puppet-openstack Deploy on lxc openstack-ansible Deploy on docker Kolla OpenStack on OpenStack

Openstack Architecture

PTG Dulin Schedule - OpenStacklists.openstack.org › pipermail › openstack-dev › ... · OpenStack-Ansible OpenStack-Charms OpenStack-Helm Oslo Project Infrastructure Helproom

Openstack Overview

Felhő alapú hálózatok (VITMMA02) OpenStack › sites › default › files › Cloud... · OpenStack vs. DevStack » OpenStack » komponensek szolgáltatásként futnak » DevStack

OpenStack on the Fabric - OpenStack Korea January Seminar 2014

SUSE OpenStack Cloud 7 - Novell · SUSE OpenStack Cloud 7 ... OpenStack Cloud-Foundry OPNFV CNCF OpenDaylight. 14 Ködoszlatás • IaaS – OpenStack • CaaS – Kubernetes ...

Red Hat OpenStack Platform 13 Red Hat OpenStack Platform の ... · OpenStack Platform 13 にアップグレードします。 コンテナーイメージの取得 OpenStack Platform

OpenStack Networking Quantum · OpenStack のケ゠フルザゥキテのひとつ OpenStack Compute （Nova ） OpenStack Identity （KeyStone ） OpenStack Image Service （Glance

Solum - OpenStack PaaS / ALM - Austin OpenStack summit

"OpenStack in Japan", from OpenStack Days Taiwan 2016

Red Hat OpenStack Platform 14 · 2019. 4. 1. · Red Hat OpenStack Platform 14 Director 설치 및 사용 Red Hat OpenStack Platform director를 사용하여 OpenStack 클라우드

OpenStack Day Tokyo 2013 · 2019-06-07 · “OpenStack ‐ Business Ready!” Date March 12, 2013 10:00‐18:40 Venue Akihabara Convention Hall 2F 2F Akihabara Dai Building, 1‐18‐13

Building social business models: lessons from the Grameen ...ethmar.social/wp-content/uploads/2017/08/... · ﺔﻣﺪﻘﻣ ﻞآ ﻦﻴﺑ ﻦﻣ ﺺﺨﺷ يأ ،ﻲﻣﺎﻨﻟا

Red Hat Enterprise Linux OpenStack Platform 5 OpenStack の ...

[OpenStack 하반기 스터디] Docker를 이용한 OpenStack 가상화

150114 OpenStack Korea 정기세미나 session3 - OpenStack 네트워크와 SDN

Red Hat OpenStack Platform 13 Red Hat OpenStack Platform の ... · OpenStack Platform 13 にアップグレードします。コンテナーイメージの取得 OpenStack Platform