Quick overview of Openstack architecture.

1. QUICK OVERVIEW

2. OBJECTIVE
To produce the ubiquitous Open
Source cloud computing platform that
will meet the needs of public and
private cloud providers regardless of
size, by being simple to implement
and massively scalable.

3. WHAT’S OPENSTACK?
Openstack is a Platform free and Libre Open Source of IaaS
Cloud Computing

4. WHAT’S OPENSTACK?
Openstack is a Platform free and Libre Open Source of
IaaS Cloud Computing
• Different components
• Interrelated Components
• Define component functions
• Define what services offer

5. WHAT’S OPENSTACK?
Openstack is a Platform free and Libre Open
Source of IaaS Cloud Computing
• Collaborative
• Open Code / Modifiable (Multiple implementations)
• Free
Managed by the nonprofit OpenStack Foundation

6. WHAT’S OPENSTACK?
Openstack is a Platform free and Libre Open Source of
IaaS Cloud Computing
• Infraestructure as a service
• Storage, Computing, Networking

7. WHAT’S OPENSTACK?
Openstack is a Platform free and Libre Open Source of
IaaS Cloud Computing
• Infraestructure as a service
• Storage, Computing, Networking
• Networks on demand
• Storage on demand
• Computing on demand
• Security groups

8. HISTORY
Started in July of 2010 by the NASA and
Rackspace, evolved two existing projects
• Nebula project of the NASA
• Cloud Files project of Rackspace

9. HISTORY/VERSIONS
Every six month has released a new version

10. PRINCIPAL SPONSORS
PLATINUM
GOLD

11. ARCHITECTURE
COMPONENTS
• DASHBOARD (HORIZON) provides a modular web-based
user interface for all the OpenStack services. With this
web GUI, you can perform most operations on your cloud
like launching an instance, assigning IP addresses and
setting access controls
• COMPUTE (NOVA): provides virtual servers upon demand,
based in images
• IMAGE (GLANCE): provides the images catalog (virtual
disks), available for use by compute service
• OBJECT STORAGE (SWIFT): Allows you to store or
retrieve files (but not mount directories like a fileserver.

12. ARCHITECTURE
COMPONENTS (CONT)
• BLOCK STORAGE(CYNDER): Provides persistent block
storage to guest VMs
• NETWORKING (QUANTUM): Provides "network
connectivity as a service" between interface devices
managed by other OpenStack services. The service works
by allowing users to create their own networks and then
attach interfaces to them.
• IDENTIFY (KEYSTONE): Provides the authentication and
authorization to all Openstack services and the all
services available catalog in the Openstack
implementation

13. ARCHITECTURE

14. ARCHITECTURE

15. ARCHITECTURE

16. COMPONENTS
(HORIZON)
Horizon is a modular Django web application that provides
an end user and administrator interface to OpenStack
service.
Provides support for two roles, admin and member
Ussually is deployed as mod_wsgi in Apache web server
The code is separated in reusable python modules
Need a DDBB but as it relies mostly in the another services
of Openstack, it store very little data

17. COMPONENTS
(HORIZON)

18. COMPONENTS (NOVA)
Nova is the most complicated and distributed component of
OpenStack. A large number of processes cooperate to turn
end user API requests into running virtual
nova-api - manages API calls
nova-compute - manages hypervisor calls
nova-scheduler - determines assigned host to a VM
nova-volume and nova-network are replaced in
folsom by cinder and quantum

19. COMPONENTS (NOVA)
• nova-api:
• Supports EC2 API, OpenStack Compute API and Admin API
• Manages the API calls inside nova service
• API frontend to OpenStack environment
• It also initiates most of the orchestration activities (such as running an
instance) as well as enforces some policy (mostly quota checks)
• nova-compute:
• Manages the VM execution on the different hypervisors
supported by OpenStack (XenAPI for XenServer/XCP, libvirt
for KVM or QEMU, VMwareAPI for VMware, etc)
• Orchestrates image usage by VM's with Glance service through
glance-api component
• Manages networks to be used by VM's through the quantum server
component

20. COMPONENTS (NOVA)
• nova-schedule:
• Determines in which physical host should run a given VM
based on the resources required
Nova interacts with many other OpenStack services: Keystone for
authentication, Glance for images and Horizon for web interface.
The Glance interactions are central. The API process can upload
and query Glance while nova-compute will download images for
use in launching images

21. ADDITIONAL
COMPONENS (NOVA)
• Queue:
• provides a central hub for passing messages between daemons.
This is usually implemented with RabbitMQ today, but could be
any AMPQ message queue (such as Apache Qpid). New to the
Folsom release is support for Zero MQ
• SQL database:
• stores most of the build-time and run-time state for a cloud
infrastructure. This includes the instance types that are
available for use, instances in use, networks available and
projects. Theoretically, OpenStack Nova can support any
database supported by SQL-Alchemy but the only databases
currently being widely used are MySQL and PostgreSQL
• nova-console, nova-vncproxy and nova-consoleauth:
• Provides console services to allow end users to access their virtual
instance's console through a proxy

22. COMPONENTS
DEPRECATED (NOVA)
• nova-volume:
• manages the creation, attaching and detaching of persistent
volumes to compute instances (similar functionality to Amazon’s
Elastic Block Storage). It can use volumes from a variety of
providers such as iSCSI or Rados Block Device in Ceph. A new
OpenStack projects, Cinder, will eventually replace nova-
volume functionality.
• nova-network:
• is very similar to nova-compute and nova-volume. It accepts
networking tasks from the queue and then performs tasks to
manipulate the network (such as setting up bridging interfaces
or changing iptables rules). This functionality is being
migrated to Quantum, a separate OpenStack service. In the
Folsom release, much of the functionality will be duplicated
between nova-network and Quantum.

23. COMPONENTS (NOVA)
NOVA-CLI
List availables image and flavors
nova image-list
nova flavor-list
Create a keypair in order to access the VM
nova keypair-add mykey > mykey.pem
Launch a VM using images and flavors
nova boot <MYMACHINE_NAME> --image "<IMAGE_ID>" –flavor <FLAVOR_ID> --key_name
<MYKEY_NAME> --file /root/.ssh/authorized_keys=my_authorized_keys
It's possible to resize a VM from a flavor to a different one
nova resize <VM_ID> <NEW_FLAVOR_ID>
And send data to the cloud-init executed on the VM
nova resize-confirm / nova resize-revert

24. COMPONENTS (NOVA)
NOVA-CLI
Managing security groups. Check the default one
nova secgroup-list
Each security group has an associated rule set
nova secgroup-list-rules default
Adding new rules to our security group
nova secgroup-add-rule default tcp 80 80 0.0.0.0/0
List floating ip’s in our pool
nova floating-ip-pool-list
Create new floating ip
nova floating-ip-create nova
Floating IP can be associated to a running VM
nova add-floating-ip <VM_NAME> <FLOATINGIP_IP>

25. COMPONENTS
(GLANCE)
Provides a VM image catalog and repository services
allowing the registration and retrieval of those.
Provides a RESTful API that allows querying of VM image
metadata as well as retrieval of the actual image
Support the retrieval of the images from multiple storages
(Filesystem based, Swift based, S3 based)
Images supported (raw, vhd, vmdk, vdi, iso, qcow2, aki, ari and
ami)
Containers supported (ovf, aki, ari and ami)
Creation image tools supported (Oz – KVM, VMBuilder - KVM,
Xen, VeeWee – KVM)
http://docs.openstack.org/trunk/openstackcompute/admin/content/
starting-images.html

26. COMPONENTS
(GLANCE)
• glance-api accepts Image API calls for image
discovery, image retrieval and image storage
• glance-registry stores, processes and retrieves metadata
about images (size, type, etc)
• A database to store the image metadata
• A storage repository for the actual image files

27. COMPONENTS
(SWIFT)
Provides object storage services
Fault-tolerance and highly scalable architecture
Designed to run on commodity hardware
Large object support (Object maximum size is 5GB)
Considerations Swift Cluster
• RAID not good for disk backend
• Proxy servers are I/O and CPU intensive
• Object, container and account services more I/O and
disk intensive

28. COMPONENTS
(SWIFT)

29. COMPONENTS
(SWIFT)
• Proxy server
• Manages the swift service infrastructure
• Look for the account, container and object, and route to
the appropriate resource
• Manages the swift API
• Provides fault-tolerance architecture for object servers
providing alternatives to failing hosts
• The ring
• Maps the logical name of a resource stored in swift to its
physical location
• Separate rings for accounts, containers and objects
• Manages how many times a partition is replication along
the swift cluster (3 by default, on different zones)

30. COMPONENTS
(SWIFT)
• Object server
• Blob storage server
• Objects stored as binary files + xattrs (FS supported)
• Replicas of the objects across the cluster are consistent with
the last write (if removed .ts)
• Object server - xattrs
• Extended attributes of a file provided by the filesystem
• XFS recommended by Rackspace
• Container server
• Manages the object-container relationship and some stats
about it
• Knows what objects are associated to a given container and
its total size
• Its backend is replicated along the cluster (default sqlite)

31. COMPONENTS
(SWIFT)
• Consistency servers · Replication
• Manages replication for objects, containers and accounts
• Capable to handle hw outages (disk failure, network outage)
• rsync for object, HTTP/rsync db for containers and accounts
• Objects stored as binary files + xattrs (FS supported)
• Replicas of the objects across the cluster are consistent with
the last write (if removed .ts)
• Consistency servers · Updaters
• Manages the update process under high load behaviours on
the swift cluster
• Consistency window
• Consistency servers · Auditors
• Check the integrity of objects, containers and accounts
• Reload from replicas those which are not consistent

32. COMPONENTS
(SWIFT)
• The Account Ripper
• Manages the deletion of an account and all the data
associated to it (both objects and containers)
• Undelete feature is not currently supported

33. COMPONENTS
(CINDER)
Provides block storage to VM's managed by Nova
Supports new third party storage drivers
Ability to create image from volume
Support for NFS as block storage
Storage backend support for(Netapp,EMC,IBM)
• A storage driver for Cinder is provided
• Allows to connect directly the storage with the
hypervisor

34. COMPONENTS
(CINDER)
• cinder-volume
• Manages the volume creation and the interaccion with the
backend storage
• cinder-api
• Manages the calls to the Cinder API
• cinder-scheduler
• Manages the volume location

35. COMPONENTS
(QUANTUM)
Provides network services to VM's running in Nova
Several backends plugins (OVS, LinuxBridge, ...)
Floating IP's (NAT)
Considerations
• Very intensive CPU use
• Very high networking load

36. COMPONENTS
(QUANTUM)

37. COMPONENTS
(QUANTUM)
• quantum-server
• Manages the Quantum service API calls
• Orchestrates the provisioning of virtual network elements
(networks, subnets, routers, ...) for its use with VM's
provided by Nova
• quantum-agents
• L3 agent: Manages the provisioning of network
connectivity to external networks, including floating IP
pools associated to those
• DHCP agent: Allocates IP address for the VM's on a given
network/subnet

38. COMPONENTS
(QUANTUM)
• quantum-plugins
• Provides an interface between the logical view and the
physical way (different implementations)
• The following plugins are currently supported (Open
vSwitch, Cisco UCS/Nexus, Linux Bridge, Nicira NVP, Ryu,
NEC, OpenFlow, Big Switch - Floodlight REST Proxy)

39. COMPONENTS
(QUANTUM)
• quantum-plugins
• Provides an interface between the logical view and the
physical way (different implementations)
• The following plugins are currently supported (Open
vSwitch, Cisco UCS/Nexus, Linux Bridge, Nicira NVP, Ryu,
NEC, OpenFlow, Big Switch - Floodlight REST Proxy)

40. COMPONENTS
(KEYSTONE)
The OpenStack identity service
Provides the following services: identity, token, catalog
and policy
Used by all services of the OpenStack family
Accessible through the Identity API
Supported keystone backends(Default sqlite):
Key Value Store (KVS), SQL, PAM, LDAP(just identity)

41. COMPONENTS
(KEYSTONE)
SERVICES
• Catalog: Provides a directory service for the endpoints of the
OpenStack services
• Policy: Provides access to resources to users based on the
permissions these users have on those
• Identity: Provides auth validation for users, tenants and roles
• Token: Manages all the token auth process, once the
user/tenant credentials have been verified

42. COMPONENTS
(KEYSTONE)

43. COMPONENTS
(KEYSTONE)
Endpoints
Keystone is not just about auth, but also a directory service
Each OpenStack service has an endpoint associated(REST
API)
The Keystone directory service provides the URL of the end
points of the different OpenStack services

44. HA
GLANCE
• glance-api - (Pacemaker + Corosync)
• glance-registry

45. HA
NOVA
Configure different instances of Nova
• Networking – use nova-network (configure all network
connections in all Nova nodes)
CINDER
• quantum-server (API) – (Pacemaker + Corosync)
• l3-agent - one per external network (active/passive)
• dhcp-agent + ovs - (active/passive)

46. HA
Font-end API servers
• load balanced with h/w load balancer
• use s/w LB for smaller deployments
• run nova-scheduler on each
MySQL DB
• multi-master configuration
• alternative: drbd + pacemaker in active/passive

47. HA
RabbitMQ service
• Pacemaker with Active-passive configuration
• Virtual IP for the service - used for rabbitmq
config in nova.conf
Glance
• Run on multiple servers
• Use another VIP in your pacemaker setup or
load-balancer
• Use swift as backend storage

48. HA
Compute servers
• Each run their own copy of nova-api (only
instances running on the node use this)
• nova-network (multi-host configuration) with
private network
Swift
• Run swift-proxy across all swift-storage nodes
on a small setup

49. HA
Storage block
Volumen with Pacemaker + iSCSI target
• CEPH / GlusterFS (Work in Progress)
QUANTUM
• quantum-server (API) – (Pacemaker + Corosync)
• l3-agent - one per external network (active/passive)
• dhcp-agent + ovs - (active/passive)

50. HA
Keystone
• Run on multiple servers
• Use another VIP in your pacemaker setup or
load-balancer
Horizon
• Run on multiple servers
• Use another VIP in your pacemaker setup or
load-balancer