This document summarizes Cloud Based VDI with OpenStack. It discusses modifications made to Nova, Keystone, Glance, Quantum, and Swift to support a virtual desktop infrastructure using OpenStack. Key points include extending APIs, adding Active Directory support, implementing differential snapshots in Nova, enforcing storage quotas in Swift, and designing for disaster recovery. The overall goal is to launch and manage virtual machines, enable user login and authentication, check access policies, update storage rings, and implement content delivery, all through an OpenStack-based cloud computing platform.

1. 精 雲 科 技 股 份 有 限 公 司
Cloud Based VDI with
OpenStack
August 11, 2012
1

2. Agenda
2

3. Virtual Desktop Infrastructure (VDI)
3

4. Use Case 1 – Launch a VM
4

5. Nova
 A compute cloud for virtual desktop
 Using essex –2, Dec 16, 2011
 Will merge to folsom release
5

6. Modification to Nova
 Extended nova API
• Manage SPICE
• Manage images
• Single sign on
 SPICE port management
• iptables filter for SPICE port
• Report IP and SPICE port of a VM
6

7. Modification to Nova - continue
 Differential snapshot
• Launch VM with a base image and chains of differential
snapshot images
• Merge differential snapshots
• Encryption and decryption of snapshot images
7

8. Tuning and Testing
 libvirt parameters for desktop
• virtio PCI, block, ring, serial (SPICE), balloon, network,
• ide, qxl, usb
 Image run time location
• Local versus shared
 nova network
• One per nova API
• One per nova compute node
 VM’s per server
 User experience benchmarking
8

9. Glance
 A virtual desktop image repository
 Using essex-4, March 1, 2012
 No modification
 Will upgrade to folsom release
9

10. Quantum
 Evaluating and testing
 Will use folsom release
10

11. Use Case 2 – User Login
11

12. Keystone
 An authentication system for cloud storage, as well as
virtual desktop session
 Using essex-3, January 26, 2012
 Merging to folsom-2
12

13. Keystone – essex-3
13

14. Modification to Keystone
 Microsoft Active Directory (AD) backend
 Support domain, organizational unit
 Will support security and distribution groups
 Will merge with Keystone AD backend
• https://blueprints.launchpad.net/keystone/+spec/ad-
ldap-identity-backend
14

15. Use Case 3 – Check Policy
15

16. Policy Outside of Keystone
 Role based access control (RBAC)
 Keystone roles
• super admin, cloud admin, operation admin, client user
 Users of each role has permission to perform certain
actions
 Example VDI rule for client user
• Publish golden image
 Example Cloud Storage rule for client user
• Get own storage usage
16

17. Policy Outside of Keystone - continued
 Will merge with Keystone V3 API and RBAC
• https://blueprints.launchpad.net/keystone/+spec/imple
ment-v3-core-api
• https://blueprints.launchpad.net/keystone/+spec/rbac-
keystone-api
• https://blueprints.launchpad.net/keystone/+spec/rbac-
keystone
17

18. Swift
 Unstructured storage, as well as an object storage for
virtual desktop images
 Using 1.4.9, April 2, 2012
 Merging to folsom-2
18

19. Swift
19

20. Modification to Swift
 Support upload > 5GB
 Extended API for storage quota
• Enforce storage quota per user, organization unit (OU),
domain
• Report storage and bandwidth usage
 Metadata search
 Will merge with Swift blueprints
• https://blueprints.launchpad.net/swift/+spec/large-
single-uploads
• https://blueprints.launchpad.net/swift/+spec/storage-
quotas
20

21. Use Case 4 – Update Ring Files
21

22. Ring Server outside of Swift
 Build new rings
 Updated rings after add/delete storage nodes or disks
 Automatically push updated ring files to all proxy
servers and storage nodes
 Will merge with Swift blueprint
• https://blueprints.launchpad.net/swift/+spec/ring-
builder-server
22

23. Use Case 5 – Disaster Recovery
23

24. Tuning and Testing
 In main cloud storage
• Audit objects for integrity, but not impact regular traffic
• Timely container sync, but not impact regular traffic
 In backup cloud storage
• Rapid container sync for fast recovery
24

25. Use Case 6 – Content Delivery Network
25

26. On Top of Swift
 Global file lock
 Access control
 Object compression and decompression for transfer
26

27. Thank You
27